Free Training & Career Tips... Subscribe to Get Weekly Career Tips
By Subscribing You are Agreeing to Terms and Conditions
Cybersecurity awareness training teaches your staff to recognise and resist the everyday attacks that target them: phishing emails, business email compromise, fake invoices, password theft, ransomware and social engineering. The aim is that one careless click does not breach your systems or your customers’ data. BOTI runs the practical, facilitator-led Cyber Security Awareness Training course for whole teams in South Africa. It sits alongside our other computer skills and cyber awareness courses, and it is delivered in-house, at our Johannesburg venue or live online.
This course at BOTI todayCyber Security Awareness Training (1 day)
The current course runs at your offices anywhere in South Africa, live online or at a BOTI venue. The course page has the up-to-date outline and group prices.
See the current courseGet a quote for your teamSee all Strategy, Risk, Governance and Compliance courses
Learning on your own? Self-paced e-learning from R595 (excl. VAT) · Ask your employer to pay
You may have invested in firewalls, antivirus and IT controls, yet staff still click suspicious links, reuse weak passwords or pay fraudulent invoices. This course closes the gap that technology cannot. Many incidents start with a person being tricked rather than a system being hacked, and that is exactly what awareness training addresses. Tell us about your team and BOTI will send you a quote.
The business problem: your people are the attack surface
Strong security software does not stop one tired employee on a Friday afternoon from approving a fake payment. Many incidents begin with a person being tricked, not a server being hacked. For South African businesses, three problems add to the risk:
- Phishing and business email compromise. A convincing email, apparently from a director, a supplier or the bank, asks staff to change banking details, approve a payment or “verify” a password. One click or one wrong transfer, and the money or the credentials are gone.
- POPIA exposure. Under the Protection of Personal Information Act, your organisation is legally responsible for safeguarding personal information. A breach caused by an untrained employee is still a breach you must report and account for.
- Uneven habits. Some staff are careful; others are not. Without a shared, trained standard, your defence is only as strong as your least security-aware person.
Cybersecurity awareness training strengthens the human layer that technology cannot cover. Your team learns to spot the attack, pause, verify and report, so caution becomes a company-wide habit. The same skills apply to email, payments, passwords and devices, so the protection reaches every desk.
Who this course is for
This is corporate training for South African organisations developing their own staff. It is not a technical certification for IT specialists or a study path for individuals. It is written for the people who carry the risk and the budget:
- HR and L&D managers rolling out a consistent, documented security-awareness standard across the workforce.
- Business owners and MDs of SMEs who cannot afford a breach and want practical protection without a large IT team.
- Compliance, risk and POPIA officers who need evidence that staff have been trained on data protection.
- Department and operations managers in finance, admin, sales, HR and customer service, whose teams handle email, payments and personal information every day.
No technical or IT background is required. The course is built for everyday business users: anyone who uses email, a password and a company device.
What the cybersecurity awareness course covers
The programme is practical and scenario-based. Delegates work through realistic attacks of the kind South African workplaces face, not abstract theory. A typical outline is below.
| Module | What your team learns |
|---|---|
| 1. The threat landscape | How modern attacks work, why staff are targeted, and the real cost of a breach. |
| 2. Phishing and email scams | Spotting suspicious emails, links and attachments, and verifying before clicking or paying. |
| 3. Business email compromise | Recognising fake invoices, banking-detail changes and “urgent” director requests; verifying payments safely. |
| 4. Passwords and authentication | Strong, unique passwords, password managers and multi-factor authentication (MFA), in plain language. |
| 5. Social engineering | How attackers manipulate people by phone, by message and in person, and how to resist pressure tactics. |
| 6. Ransomware and malware | How infections spread, the warning signs, and what to do if something looks wrong. |
| 7. POPIA and data protection | Handling personal information responsibly, your obligations, and recognising a reportable breach. |
| 8. Safe device and remote work | Securing laptops and phones, public Wi-Fi risks, and good habits for hybrid teams. |
| 9. Reporting and response | A simple “see something, say something” routine so incidents are flagged early, not hidden. |
Outlines are tailored to your sector and systems. A finance team focused on payment fraud and a customer-service team handling personal data will leave with different priorities.
Want this scoped to your team’s systems and risks? Phone 011 882 8853 or request a quote. You can also ask BOTI to help you draw up a short phishing red-flags list that your staff can pin up and use after the course.
Why awareness training is a high-value security spend
Training your people is one of the broadest ways to reduce cyber risk. Software stops known threats. Trained staff stop the social-engineering attacks designed to slip past it. The same alertness protects email, payments, passwords, devices and personal data across the whole business.
Documented, regular training also helps you show that you took reasonable steps to protect personal information under POPIA. A focused programme can equip a team in a day. For many South African organisations, awareness training is a cost-effective layer of a security strategy and the natural partner to your IT controls.
Delivery formats
You choose the format that fits your team:
- In-house / on-site at your premises. This is usually the most practical option for a group, and it can be built around your own systems, policies and real examples.
- At BOTI’s venue in Sunningdale, Johannesburg, for teams that prefer to train away from daily interruptions.
- Live online, instructor-led. This suits distributed and hybrid teams anywhere in South Africa, with no travel and a fully interactive session.
Combining these formats lets head office, branch and remote staff all reach the same standard.
Accreditation
Cybersecurity awareness is delivered as a practical, facilitator-led short course aimed at immediate behaviour change. It does not lead to a qualification. Attendance is recorded, so the training can be reported in your Annual Training Report (ATR) as staff development and serves as evidence of POPIA-related staff awareness.
BOTI is a QCTO-accredited Skills Development Provider and a Level 1 B-BBEE contributor. If you need accredited training in related areas, see BOTI’s accredited programmes. Tell us your reporting objective and we will recommend the right structure.
Funding: using your skills development budget for protection
Security-awareness training is staff development, so the spend can sit inside your existing skills-development planning. As general guidance only:
- Employers pay the Skills Development Levy (SDL) at 1% of the leviable amount (total remuneration). Employers whose leviable amount over the next 12 months will not exceed R500,000 are exempt[1].
- Training for your staff is recorded in your Workplace Skills Plan (WSP) and Annual Training Report (ATR). The SETA mandatory grant pays back 20% of levies paid when the WSP/ATR is submitted by 30 April and your levies are up to date. Unclaimed mandatory grant money moves to discretionary funding by 15 August[2].
- The B-BBEE skills-development target is 6% of the leviable amount, not 6% of payroll. That is 3.5% on learning programmes for black people plus 2.5% on bursaries for black students at higher education institutions[3]. Sector codes may differ.
Planned, documented team training therefore counts as skills development spend. Your verification professional decides how it is recognised on your scorecard.
Where skills development supports tender readiness, note that the Preferential Procurement Regulations, 2022 allow organs of state to score “specific goals”, rather than relying only on a generic B-BBEE level. The Public Procurement Act 28 of 2024 never came into force. On 17 September 2026 the Constitutional Court declared the whole Act invalid[4]. Public procurement still runs under the PFMA, the MFMA, the PPPFA and the 2022 Regulations, and Parliament may pass a new procurement law.
This is general information, not financial or legal advice. Confirm the specifics with your SETA, SDF or B-BBEE verification professional.
Why BOTI
BOTI is a South African corporate training company offering 450 courses, with a client base that includes Sasol, Glencore and the City of Johannesburg. We deliver practical training for whole teams, in-house, at our venue or online, tailored to the threats, systems and policies your people actually face. For security awareness, that practicality is the point: your team leaves able to spot and stop a real attack.
Cybersecurity awareness rarely sits alone. Clients often pair it with related programmes:
- POPIA Basic Training, which covers the data-protection obligations that awareness training helps you meet.
- POPIA compliance training, our guide to training staff on personal information.
- Compliance training, for a broader governance and risk foundation across the business.
- Microsoft Office training, the everyday digital skills where safe email and file habits matter most.
- In-house and on-site training, group delivery with clear attendance records for your ATR.
- The full BOTI course range of management, finance, HR, admin and compliance training for teams.
Frequently asked questions
What is cybersecurity awareness training for employees?
It is practical training that teaches your staff to recognise and resist the everyday cyber-attacks that target people rather than systems. These include phishing emails, fake invoices and banking-detail scams, password theft, ransomware and social engineering. Delegates learn to pause, verify and report, and to handle personal information in line with POPIA. No technical background is required.
Do our staff need an IT or technical background?
No. The course is designed for everyday business users, such as finance, admin, sales, HR, operations and customer-service staff, not for IT specialists. It focuses on practical habits and judgement, explained in plain language, so the whole team can apply it.
How does cybersecurity awareness training help with POPIA compliance?
Under POPIA your organisation must take reasonable steps to protect personal information, and staff awareness is part of that. This course trains your people to handle personal data responsibly and to recognise a reportable breach, and documented attendance gives evidence that staff have been trained. It is general guidance, not legal advice, so confirm your obligations with your information officer.
Can cybersecurity awareness training be delivered at our offices or online in South Africa?
Yes. BOTI delivers the course in-house at your premises, at BOTI’s venue in Sunningdale, Johannesburg, or as live online instructor-led sessions for distributed and hybrid teams anywhere in South Africa.
Does cybersecurity awareness training count toward our skills development spend?
Yes, it is staff development. Training delivered to your staff is recorded in your Workplace Skills Plan and Annual Training Report, and the spend can count toward the skills development element of your B-BBEE scorecard. BOTI cannot promise grants or points, so confirm the specifics with your SETA, SDF or B-BBEE verification professional.
Request a quote
Help your people become a strong line of defence. Request a quote and a BOTI consultant will scope a cybersecurity awareness course around your team’s systems, sector and risks.
Book the Cyber Security Awareness Training course for your team. Call BOTI on 011 882 8853 or email [email protected]. Training runs in-house at your premises, at BOTI’s venue in Sunningdale, Johannesburg, or live online. This course is not accredited. It is delivered as a professional skills programme, and delegates receive a BOTI certificate of attendance.
Sources
- Skills Development Levy – South African Revenue Service (SARS), 2026.
- Mandatory Grants – Health and Welfare SETA (HWSETA), 2026.
- Codes of Good Practice on B-BBEE: Code Series 300, Statement 300 – Skills Development (Government Gazette 42496) – Department of Trade and Industry, 31 May 2019.
- Godongwana notes Constitutional Court judgment on Public Procurement Act – SAnews (South African Government News Agency), 18 September 2026.