Cybersecurity Training UK: Choosing Courses and Providers
A buyer's guide to cybersecurity training in the UK, covering free NCSC e-learning, NCSC assured courses, apprenticeships and the questions to ask any provider.
Key Takeaways
- Two audiences, two routes. Staff need short, repeatable awareness training. IT and security professionals need accredited, role-based courses.
- Start free. The NCSC's Top Tips for Staff e-learning is free, takes under 30 minutes and can be shared by link or loaded into your own learning platform.
- Look for assurance. NCSC Assured Training is certified by APMG against NCSC criteria, which gives you an independent quality benchmark.
- Funding rules changed in 2026. Levy and non-levy apprenticeship funding both altered from August and October 2026, so check current terms before committing.
- Ask for evidence of change. Choose providers who can show how they measure behaviour, not just completion.
Cybersecurity training UK businesses can buy falls into two groups: awareness training that helps every employee spot and report threats, and professional training for the people who run, secure and audit your systems. Your choices include free NCSC e-learning, courses assured under the NCSC Assured Training scheme, private providers, and apprenticeships.
Most businesses under-invest in the first group. The government's Cyber Security Breaches Survey 2025/2026 found that only 19% of UK businesses had provided staff training or awareness raising on cyber security in the period covered, compared with 84% of large businesses.
This guide is about buying and choosing training. If you want to build an awareness programme from scratch, see our separate guide on how to train employees on cybersecurity awareness.
Who needs which type of cybersecurity training
Buying the wrong type of course is the most common mistake. Match the training to the role first.
| Audience | What they need | Typical format |
|---|---|---|
| All employees | Recognising phishing, safe passwords, device security, reporting incidents | Short e-learning, repeated at least annually, plus simulated phishing |
| Managers and directors | Risk ownership, incident decisions, regulatory duties | Briefings, tabletop exercises |
| IT and helpdesk staff | Secure configuration, identity management, monitoring | Vendor and accredited technical courses |
| Security specialists | Incident response, testing, governance and risk | Accredited professional courses and apprenticeships |
Keep the content relevant to the job. A finance team that approves supplier payments needs worked examples of invoice fraud, while a field engineer needs guidance on public Wi-Fi and lost devices. Generic content is quickly ignored.
Staff who handle personal data also need data protection awareness. Our guide to GDPR awareness training for UK staff covers that separately.
↑ Back to ContentsThe free NCSC e-learning for staff
The NCSC's Top Tips for Staff is a free introductory e-learning course aimed mainly at small businesses, charities and voluntary organisations, though any organisation can use it. As at October 2026, the NCSC describes it as taking under 30 minutes and covering why cyber security matters and how attacks happen, then four areas: strong passwords, securing devices, phishing, and reporting incidents.
- You can share the online course link with staff, in English or Welsh, with no login needed, and it ends with a short quiz.
- Alternatively, download a SCORM package to load it into your own learning management system.
- It is introductory, so treat it as a baseline rather than a full programme.
For a small business with no budget, this is a sensible first step. It does not replace role-based training, phishing simulations or a conversation about your own policies.
↑ Back to ContentsNCSC Assured Training and what it tells you
NCSC Assured Training, formerly the NCSC Certified Training scheme, is described by the NCSC as a benchmark for cyber security training that assures the quality of both course content and delivery. The NCSC sets the standards and assessment criteria, while APMG, an independent certification body approved by the NCSC, certifies the courses. Content must be mapped to the Cyber Security Body of Knowledge (CyBOK).
According to the NCSC Assured Training page, courses fall into three types:
- Awareness level: a foundation for newcomers to cyber security.
- Application level: in-depth courses for professional development.
- Courseware: materials used with an assured trainer and a quality management system.
The NCSC lists assured courses by level, with provider, duration and study options such as classroom, online or self-paced. If a provider claims to be NCSC assured, check the course appears on that list or on the APMG website.
↑ Back to ContentsProfessional routes for IT and security staff
For technical staff, there are three broad routes:
- Vendor courses for the platforms you run, such as Microsoft security courses for a Microsoft 365 estate.
- Industry certifications. Qualifications such as CompTIA Security+ and CISSP are widely recognised, but they are a topic in themselves, and our separate certifications article covers them.
- NCSC assured application-level courses for those who want an independent quality mark.
Choose by job role and the systems the person manages. A helpdesk technician who resets passwords needs different skills from someone running incident response. Before paying for courses, consider whether you need a permanent hire at all. Our comparison of outsourced IT support vs in-house IT sets out the trade-offs.
↑ Back to ContentsApprenticeships and funding as at October 2026
Apprenticeships can be a cost-effective way to build in-house capability, particularly for technician and early-career security roles. Funding rules were changing as at October 2026, so confirm current terms with a training provider or on GOV.UK before you commit. According to the government's Growth and Skills Levy factsheet:
- From 1 August 2026, levy-paying employers pay 25% of the cost of new starts aged 25 and over once their levy funds run out, up from 5%. Existing apprentices keep the earlier 95% government rate.
- Funds entering levy accounts now expire after 12 months, down from 24, for funds arriving from August 2026.
- For non-levy employers, the factsheet says 100% of training costs are covered for new starts under 25, and a £2,000 hiring payment applies for new employees aged 16 to 24 from 1 October 2026, with first payments from January 2027.
- Short apprenticeship units of 30 to 140 delivery hours are available for existing employees aged 19 and over in specified skills areas.
Check the standard before you enrol
Apprenticeship standards are withdrawn and replaced from time to time. Ask any provider which standard the course is based on, whether it is funded for new starts, and how the end-point assessment works.
Cybersecurity training UK: how to choose a provider
Use the same discipline you would for any supplier. Ask for evidence rather than brochures, and run a short pilot with one team before you roll anything out to the whole company.
- Accreditation. For professional courses, is it NCSC assured, and can you verify it on the NCSC or APMG list?
- Relevance. Does the content reflect UK threats, UK law and tools your staff actually use?
- Instructors. Do they have practical experience beyond teaching?
- Measurement. Can they report on completion, quiz results and behaviour, such as phishing report rates?
- Delivery. Can it be done in short sessions that fit the working day, with accessible formats?
- Cost model. Per user, per course or per year? What does a reasonable renewal look like?
- References. Ask for contactable customers of a similar size to yours.
If you already use an IT partner, ask whether training is part of the service. Many managed IT support arrangements include awareness training and phishing simulation, which keeps it tied to the controls you actually run. Our wider guide to choosing an IT support company applies the same questions to the provider as a whole.
↑ Back to ContentsComparing quotes and measuring results
Prices for training vary widely with format, class size, accreditation and whether the course includes exams, so treat any single figure you see quoted with caution and ask for a written breakdown. Common pricing models are:
- Per user, per year for e-learning libraries and phishing simulation platforms.
- Per delegate for classroom or live online professional courses, sometimes with exam fees separate.
- Per day for on-site workshops, tabletop exercises or director briefings.
Whatever the model, agree in advance how you will judge value. Completion rates show attendance, not learning. Better indicators include the proportion of staff who report suspicious emails, how many click simulated phishing links over time, and how quickly incidents are reported to IT.
Also decide who owns the programme internally. Training that nobody manages tends to be completed once and forgotten. A named owner, a calendar of refreshers and a short report to leadership each quarter keep it alive, and the same owner can collect questions from staff to shape the next session.
↑ Back to ContentsConnecting training to certification and audit
Training is easier to justify when it supports a recognised standard. Cyber Essentials focuses on technical controls, but certification bodies and customers also expect people to follow them. Our Cyber Essentials certification guide explains the process.
An independent cyber security audit can also show where staff behaviour is creating risk, which tells you what training should cover first. That is better than buying a generic course library and hoping it fits.
↑ Back to ContentsChoosing cybersecurity training in the UK
For cybersecurity training UK organisations can rely on, start with the free NCSC e-learning for staff, add role-based courses for managers and technical teams, use NCSC assured courses where an independent quality mark matters, and check the current apprenticeship funding rules before committing. Choose providers who can show evidence of changed behaviour, and agree how you will measure it before you sign.
If you want help deciding what your team needs, talk to NetMonkeys.
↑ Back to ContentsFrequently Asked Questions (FAQs)
Is there free cybersecurity training in the UK?
Yes, and it comes from an authoritative source. The NCSC offers Top Tips for Staff, a free e-learning course that takes under 30 minutes and covers passwords, device security, phishing and incident reporting. You can share a link with staff or download a SCORM package for your own learning platform. It suits small organisations as a sensible first step before adding role-based training.
What is NCSC Assured Training?
It is a scheme, formerly called NCSC Certified Training, that benchmarks the quality of cyber security course content and delivery. The NCSC sets the criteria and APMG certifies courses, which fall into awareness level, application level and courseware. It helps buyers verify the quality of a course independently, rather than relying on a provider's own marketing claims.
How do I choose cybersecurity training UK providers can deliver well?
Check accreditation, relevance to UK threats and law, instructor experience, reporting on behaviour change, delivery format, cost model and customer references. For professional courses, confirm NCSC assured status on the NCSC or APMG list. Ask whether your IT provider already includes awareness training and phishing simulation in its service.
Can I fund cybersecurity training through an apprenticeship?
Possibly, depending on the role and your employer status. Apprenticeships suit technician and early-career security roles. Funding rules changed during 2026, including co-investment and expiry rules for levy employers and support for non-levy employers hiring under-25s. Check the current GOV.UK guidance and ask providers which standard and funding band apply.
How often should staff do cyber security awareness training?
Run a full induction for new starters, refresh at least annually, and add short reminders and phishing simulations through the year so the lessons stay fresh. The NCSC e-learning is a convenient annual baseline. Increase the frequency for finance, HR and administrator roles, because attackers target them more often.
Do IT staff need certifications such as CompTIA or CISSP?
Not always, and it depends on the role. Certifications are recognised signals of knowledge, but the right choice depends on the role and the systems managed. Vendor courses and NCSC assured application-level courses are alternatives. Match training to what the person does day to day and to your own risk profile, rather than collecting qualifications for their own sake.
What is the best cybersecurity training in the UK for a small business?
There is no single answer, and rankings are rarely verifiable. Start with the free NCSC e-learning for everyone, add role-based training for administrators, and use your IT provider or an assured course provider for deeper needs. Judge success by behaviour, such as how many staff report suspicious emails, rather than by course completion alone.
Speak to a NetMonkeys specialist
Practical, plain-English IT advice for UK businesses, from our Manchester headquarters and our teams in London and Nottingham.
Book a conversation
