According to the Cyber Security Breaches Survey 2025/2026, published by DSIT and the Home Office on 30 April 2026, 43% of UK businesses identified a cyber breach or attack in the last 12 months. That is roughly 612,000 organisations, with an estimated 5.19 million cyber crimes committed against UK businesses over the same period. Phishing remains the most common entry point.
Against that backdrop, the National Cyber Security Centre published updated guidance, Phishing attacks: defending your organisation, in September 2026. It is a significant document for anyone responsible for phishing awareness training UK-wide, because it challenges several assumptions that still underpin most corporate training programmes.
What the NCSC guidance actually says about training
The NCSC is direct on one point that many L&D buyers will find uncomfortable: training alone cannot solve the phishing problem, and over-relying on it is a strategic mistake.
The guidance states that phishing mitigations "often place too much emphasis on users being able to spot phishing emails," and that this approach "risks wasting both time and money without improving security." Asking staff to scrutinise every email they receive is, in the NCSC's words, "an unrealistic and counter-productive goal."
This does not mean training is irrelevant. It means training must be positioned correctly within a broader, layered defence model.
The four-layer model and where training fits
The NCSC structures its phishing defences across four layers:
- Make it difficult for attackers to reach your users - technical controls including DMARC, SPF and DKIM, email filtering and reducing your organisation's digital footprint.
- Help users identify and report suspected phishing messages - this is where staff training sits, alongside clear reporting processes and a positive security culture.
- Protect your organisation from the effects of undetected phishing emails - device hardening, malware protection, multi-factor authentication and privileged access controls.
- Respond quickly to incidents - logging, monitoring and a practised incident response plan.
Training occupies layer two. It is necessary but not sufficient. The NCSC is explicit that "some phishing attacks will always get through," so organisations must invest in all four layers, not just the one that produces a completion certificate.
The problem with phishing simulations
The updated guidance takes a notably cautious position on phishing simulations. The NCSC warns that simulations "can create legal risk" because "no one can be expected to spot all phishing emails," and that punishing people for clicking on test emails "starts to resemble entrapment."
More practically, the guidance notes that blaming users for clicking does not work. People click for a range of reasons, including personality traits and situational pressures such as being busy or stressed. Threatening punishment does not change those factors.
The NCSC also flags a cultural risk: employees who fear reprisals will not report genuine incidents. A blame-oriented culture actively undermines the reporting behaviour that gives organisations their best early warning of a real attack.
This does not mean simulations are always wrong. The guidance suggests that if you use them, you should focus your metrics on how many people reported a suspicious email, not just how many clicked. It also suggests an alternative: asking participants to craft their own phishing emails, giving them a richer understanding of the influence techniques attackers use.
What good phishing awareness training UK organisations should commission
If simulations are not the answer on their own, what should L&D and security leaders commission instead? The NCSC guidance points to several practical requirements for effective staff training.
Contextual, role-based learning. The guidance notes that customer-facing departments receive high volumes of unsolicited emails, while staff with access to financial assets or IT systems are more likely targets for sophisticated spear phishing. Training should reflect those different risk profiles rather than delivering a single generic module to everyone.
Reporting culture, not just recognition skills. The guidance emphasises creating "an environment that encourages users to report phishing attempts," including when they have already clicked. Training should normalise reporting and make the process simple and quick. Staff need to understand that reporting a mistake is the right thing to do.
Process awareness alongside technical signals. The NCSC recommends helping staff understand normal ways of working for key tasks, such as how payments are authorised, so they can recognise unusual requests. This is scenario-based learning in practice: not abstract rules, but realistic situations drawn from the organisation's own workflows.
Trackable completion and LMS reporting. For cyber insurance, board reporting and incident response readiness, organisations need auditable evidence that training has been completed. The NCSC itself makes its own Top Tips for Staff eLearning package available as a SCORM-compliant download, explicitly designed for integration into an organisation's own LMS. That is a clear signal that trackable, standards-based delivery is the expected baseline, not a premium add-on.
Why generic slideshows fail against this model
A once-a-year awareness video or a static PDF walkthrough cannot meet the requirements the NCSC sets out. Those formats cannot adapt to different roles, cannot simulate realistic decision-making pressure, cannot measure whether a learner has genuinely understood the material, and cannot produce the LMS completion data that insurers and auditors increasingly require.
Scenario-based eLearning, built to SCORM or xAPI standards and deployed through an LMS, addresses each of those gaps. It can present realistic phishing scenarios drawn from the learner's own sector, branch at decision points to show consequences, and report granular completion and assessment data back to administrators. That data trail matters: it demonstrates due diligence to cyber insurers, satisfies board-level reporting requirements, and provides evidence of training completion in the event of an incident investigation.
Alistair's take
The NCSC's updated guidance is a useful corrective to the compliance-checkbox approach that still dominates a lot of corporate cyber security training. The four-layer model is sound, and the caution around punitive phishing simulations reflects what practitioners have known for some time: fear does not build vigilance, it suppresses reporting.
What the guidance does not do is tell you how to build the training itself. That is where L&D expertise matters. The organisations that will get the most from this guidance are those that treat phishing awareness training as a design problem, not a procurement tick-box. That means thinking carefully about role-based scenarios, realistic decision points, a reporting culture that is reinforced rather than undermined by the training, and LMS infrastructure that produces the audit trail the business actually needs.
At Neon Learning, we have supported 40+ clients across sectors with custom eLearning development, including scenario-based modules built to SCORM standards with full LMS reporting. The NCSC's guidance gives L&D and security leaders a clear framework. The next step is commissioning training that genuinely reflects it.
Commission phishing awareness training that meets NCSC standards
Neon Learning designs scenario-based, SCORM-compliant cyber security eLearning with full LMS reporting, built around your organisation's real workflows and risk profile.