Where to spend a small security training budget first

With a small budget, spend first on protected time and a reporting path, then on one hands on developer lab and a yearly tabletop. Buy a training platform only after you know which behaviors you want to change. Free material from government and nonprofit sources can cover a lot.

The ranked list

1. Protected time. The scarcest resource is attention. Block 30 minutes a month for everyone and two hours a quarter for developers. This costs salary, not a license.
2. A reporting path. A shared mailbox or button and a named responder. Nearly free, and it turns awareness into action.
3. Phishing resistant sign in. Not training, but it limits the harm of a click. Hardware keys or passkeys for admins first.
4. One developer lab per quarter. Build it on your own code. Cost is a few hours of an engineer's time.
5. A yearly tabletop. CISA's tabletop packages offer scenarios, objectives and discussion questions that can be customized, and the page does not state a cost, and it names its audience as stakeholders and partners, so check it fits you.
6. A champions program. Time again, plus recognition.
7. A paid platform. Only if you need scale, reporting or content you cannot make.

Free material to use

• CISA's guidance on teaching employees to avoid phishing offers a clear outline and notes that free training materials may be available from your IT provider, trade association or a nonprofit.
• NIST SP 800-50 Rev. 1 is a free lifecycle guide to planning a learning program.
• OWASP projects offer community material on culture and secure development.

How to judge a paid platform

Ask:

• Can we customize content to our stack and policies?
• Does it report behaviors, such as reporting rates, not just completions?
• Can we export records for audits?
• Does it avoid punishing individuals in its reports?
• What is the full cost, including admin time?

Run a pilot with one team and compare to what you can build yourself.

Spend on people, not just content

A mentor, a conference day or a certification for your security lead may return more than a site license. Check the real requirements first. For example, ISC2 publishes its experience rules for CISSP, so you can plan around them.

What to skip at first

Elaborate gamification, a leaderboard, expensive simulations and long annual videos.

Review each quarter

Keep a one page scorecard: time to report, lab completion, tabletop actions closed. Move money toward what changes behavior.

Quick check

Sources

• CISA, Teach employees to avoid phishing
• CISA Tabletop Exercise Packages
• NIST SP 800-50 Rev. 1
• ISC2 CISSP experience requirements

Last reviewed: 19 October 2026.