Your Office Spends More on Coffee Than Cybersecurity Training—and That’s How You Get Hacked

27 Mar

Let’s be honest—your office probably has better coffee than security

Every year, companies proudly invest in productivity tools. Ergonomic chairs. State-of-the-art espresso machines. Free fruit Fridays. Team away days. Branded hoodies.

Yet somehow, when someone brings up Cyber Security Awareness Training, you’d think they asked for a line-item budget to colonise Mars.

This isn’t a dig. It’s an observation. One that comes up time and time again with UK businesses—especially SMEs.

“We can’t afford training.”
But you can afford 30 flat whites a week and a bean-to-cup machine that requires its own postcode?

Right.

A hard truth: Your people are your biggest risk—and your best defence

You already know the tech side. Firewalls. MFA. Endpoint protection. All important.

But here’s the thing no one wants to say out loud: Your biggest cyber threat has a staff ID badge and a love of cat videos.

Phishing emails still account for the vast majority of breaches.
Most successful attacks require human interaction: a click, a reply, a download.
Even the most secure system can be undone by Dave in Sales clicking “URGENT INVOICE.PDF.exe”.

Your infrastructure might be Fort Knox. But if your team can’t spot a fake email from a Nigerian prince (or worse, a fake Microsoft admin), you’re one bad click away from ransomware.

Training doesn’t need to be expensive. It just needs to exist.

This is where things get extra frustrating. Quality Cyber Security Awareness Training isn’t just important—it’s also cheap. Really cheap.

Let’s break it down.

A decent training platform (like ours or others on the market) gives you:

Regular micro-learning content (5–10 mins per session)
Phishing simulations that test and train in real time
Reporting dashboards so you can actually see who's paying attention
Reminders that your team isn't above being duped (even the IT guy)
Certificates, because who doesn’t love a badge for the fridge?

And how much does it cost?

Less than your monthly biscuit bill.

Businesses with 50 staff spend less than £1,000 a year on awareness training. That’s £20 per person per year—less than a round at the pub.

Still think you can’t afford it?

Let’s do the maths: Coffee vs. Cyber

The average UK office worker drinks 2 cups of coffee a day. Let’s say 250 working days a year. That’s 500 cups.

Now, if your company’s providing the coffee—and you’re not buying dirt cheap instant—it’s costing you roughly £0.30 to £0.50 per cup.

For 50 staff? That’s £7,500 to £12,500 a year on coffee alone.

Meanwhile, your budget for Cyber Security Awareness Training? Probably £0.00.

That’s right. The thing that could stop a £50K ransomware disaster is worth less than a bag of beans.

The real cost of skipping training

Okay, so let’s imagine you don’t train your team.

Here’s what you might be in for:

Data breach – You lose client data, and your reputation takes a beating. Hello, ICO fine.
Ransomware – Your systems are locked. Your backups are flaky. You either pay the ransom or start again from scratch.
Downtime – Even a few hours offline can cost thousands in lost revenue and productivity.
Supply chain risk – You might not be the target. But if you're the weak link in someone else’s chain, it’s still your problem.

And here’s the kicker: all of these scenarios can start with one poorly trained employee falling for one carefully crafted email.

Yet you’re worried about spending £1.65 a month per person to avoid it?

Come on.

You don’t need to train like GCHQ

We’re not asking for James Bond-level cyber drills.

Cyber Security Awareness Training is about building habits:

Stop. Think. Don’t click random links.
Understand what phishing looks like.
Don’t reuse passwords across 15 logins.
Know when to call IT, and when to delete the dodgy invoice.

And yes, make it ongoing. Cyber criminals don’t do “one and done,” so neither should you.

Quarterly updates. Monthly micro-learning. Occasional phishing tests that catch them out and make them laugh. It’s low effort, high return.

Staff actually like good training

Gone are the days of droning voiceover slideshows and 45-minute death-by-PowerPoint sessions.

Modern training is smart. Engaging. Dare we say… fun?

It’s also:

Mobile friendly
Fast to complete
Easy to track
Customisable (if you want to throw in something specific about Brenda always clicking things, go for it)

And when your staff feel empowered to spot threats, they become part of the solution—not part of the risk.

Bonus win: It ticks off compliance too

Here’s a neat side effect. Regular security awareness training helps you:

Pass Cyber Essentials / Cyber Essentials Plus
Meet GDPR obligations
Strengthen your insurance application
Sleep better at night

(Well, maybe not the last one—but you get the point.)

Want to test if your team needs training?

Here’s a free challenge: send your staff an obviously fake phishing email and see how many reply. Add a subject like “YOU’VE WON AN IPHONE! JUST CLICK HERE!”

If even one person clicks, you’ve got your answer.

(Also: maybe don’t use their real inboxes, unless you enjoy awkward HR chats.)

You already insure the building. Why not your people?

It’s weird, isn’t it? Businesses will pay for fire extinguishers, insurance, and CCTV without blinking. But training the humans inside the building? That’s “too much”.

Cyber Security Awareness Training is not optional in 2025. It’s your basic hygiene. Like washing your hands or locking the doors.

If you’ve got time to worry about which oat milk goes best with the Jura E8 bean-to-cup masterpiece, you’ve got time (and budget) for training.

TL;DR

People are the biggest cyber risk—and your best defence
Most breaches come from human error (usually email)
Awareness training is dirt cheap, quick, and effective
You’re already spending more on coffee
Training saves you money, pain, and your business reputation

Your Next Step

Still unsure? Let us run a free phishing test and show you how many people fall for it. No obligation. Just cold, hard proof that Cyber Awareness needs to be on your 2025 roadmap—right after you order more oat milk.

Noel Bradford

Noel Bradford – Head of Technology at Equate Group, Professional Bullshit Detector, and Full-Time IT Cynic

As Head of Technology at Equate Group, my job description is technically “keeping the lights on,” but in reality, it’s more like “stopping people from setting their own house on fire.” With over 40 years in tech, I’ve seen every IT horror story imaginable—most of them self-inflicted by people who think cybersecurity is just installing antivirus and praying to Saint Norton.

I specialise in cybersecurity for UK businesses, which usually means explaining the difference between ‘MFA’ and ‘WTF’ to directors who still write their passwords on Post-it notes. On Tuesdays, I also help further education colleges navigate Cyber Essentials certification, a process so unnecessarily painful it makes root canal surgery look fun.

My natural habitat? Server rooms held together with zip ties and misplaced optimism, where every cable run is a “temporary fix” from 2012. My mortal enemies? Unmanaged switches, backups that only exist in someone’s imagination, and users who think clicking “Enable Macros” is just fine because it makes the spreadsheet work.

I’m blunt, sarcastic, and genuinely allergic to bullshit. If you want gentle hand-holding and reassuring corporate waffle, you’re in the wrong place. If you want someone who’ll fix your IT, tell you exactly why it broke, and throw in some unsolicited life advice, I’m your man.

Technology isn’t hard. People make it hard. And they make me drink.

https://noelbradford.com