KENYA · GUIDE 0600 · EDITION 4.2
Small business cybersecurity training in Kenya: Marketing and Finding Buyers
Reach a buyer who can accept the offer
Small employers and owner-managed businesses.
Approach business groups with a practical agenda and explicit non-testing boundaries.
Begin with the problem and specification rather than promising a return on investment you cannot establish. The proposed output is: Teach small-business cybersecurity awareness using safe examples.
Make the first message specific
Explain what you will deliver, what is excluded and what the prospect needs to confirm before a quotation. Use this scope when preparing a sample, demonstration or introduction:
Train staff on the business's actual account, payment, device, and reporting practices, using safe examples and a named escalation route for suspicious requests.
Ask who approves purchases, who accepts the output and how payment is arranged. These can be different people. An informal recommendation is useful for an introduction but does not replace the buyer's approval.
Use proof that matches the promise
Ask participants to examine realistic messages and payment-change requests, explaining their verification decision and reporting action without interacting with any live malicious content.
Keep approved examples, inspection records or handover evidence that demonstrate this result. Obtain permission before using a customer's name, photograph, premises or work. Do not invent reviews, imply an endorsement or display private contact details as marketing proof.
Follow the lead through to collection
| Stage | What to record |
|---|---|
| Contact | Source of the introduction and permission to follow up. |
| Qualified enquiry | Required specification, buying authority and timing. |
| Quotation | Scope, exclusions, price, delivery and payment stages. |
| Accepted result | Ask participants to examine realistic messages and payment-change requests, explaining their verification decision and reporting action without interacting with any live malicious content. |
| Repeat decision | Record participant decisions, misunderstood examples, verification barriers, reporting confidence, owner process gaps, and agreed follow-up actions that make safer daily business behaviour possible. |
Run a short session on one practical risk using fictional messages.
Review what it cost to obtain and fulfil a paying order, including travel and follow-up. High enquiry counts do not compensate for a route or delivery arrangement that loses money. Keep cancellations, complaints and refusals visible when evaluating a channel.
Training misses its purpose when staff memorize warning signs but still have no practical way to verify an urgent payment instruction from apparent management.
Expand outreach only when the promised scope can be delivered reliably. Use permission-based follow-up and an achievable response time instead of bulk unsolicited messages.
A scope-led outreach draft
The supplied draft below is ready to adapt, not a message already sent:
Hello [owner], I can teach eight staff a safe 90-minute session on suspicious requests, reporting and recovery responsibilities. Please supply your internal procedure first. We will use fictional examples and leave account secrets and recovery factors with their owners.
Replace claims with proof of this offer
| Sales claim to substantiate | Evidence before repeating the promise |
|---|---|
| Required result | Record observed understanding and gaps, not a claim the business is secure. |
| Input suitability | Confirm contacts are current. |
| Failure to address honestly | Staff rely on logo to trust email |
Remove placeholders and replace assumed prices with an approved scope and actual cost estimate. Do not advertise technical certification, current stock, guaranteed income or results you cannot substantiate. Record enquiries, accepted quotes, declined quotes, delivered orders and collected balances separately; a sent message is not a sale.