Human risk · Phishing simulation
Security awareness training.
Certificates expire. Reflexes don't.
Simulation-first awareness: we simulate, train the actual gap and prove the change in three numbers your board can read.
3
Numbers that matter — click rate · report rate · time-to-report
0
Value of a certificate nobody remembers
Q/Q
Behavior tracked campaign over campaign, not annually
The gap
Your last training produced certificates. Your next phish produces clicks.
Every intrusion story has a human chapter — and most awareness programs never touch it, because they optimize for completion instead of behavior. Three patterns repeat:
Certificate theater
Annual e-learning, 98% completion, zero behavior change. The training happened; the reflex didn't.
The untargeted blast
The same generic module for finance, engineering, and the board — though each faces different lures and holds different keys.
The unmeasured program
No baseline, no trend, no cohorts. If you can't show the click rate falling, you can't defend the budget — or the risk posture.
The only questions that matter
“Who clicks?”
Click rate — by role, department, and repeat cohort
“Who reports?”
Report rate — the reflex that actually saves you
“How fast?”
Time-to-report — the head start your SOC gets
A rising report rate beats a falling click rate. Train for both.
The loop
Simulate. Measure. Train. Repeat.
Training aimed at the gap the simulation actually exposed — not the module the calendar happened to schedule.
Simulate
Live phishing campaigns with realistic, current templates — BEC lures for finance, credential harvests for IT, whaling for executives.
Measure
Click rate, report rate, and time-to-report — by department, role, and repeat-clicker cohort. The baseline nobody can argue with.
Train the gap
Role-based modules aimed at who actually clicked and why — delivered via workshops, e-learning, or your LMS. Minutes, not marathons.
Re-simulate
The next campaign proves whether behavior moved. The delta is the deliverable — tracked quarter over quarter.
The metrics
A trend your board can read.
Four campaigns, three numbers, one direction — the quarterly report that defends both the budget and the posture.
Behavior trend · four campaigns
Prepared for: · 1,240 recipients
| Campaign | Click rate | Report rate | Time-to-report |
|---|---|---|---|
| Q1 · Baseline | 24% | 11% | 4.2 hrs |
| Q2 | 15% | 26% | 1.9 hrs |
| Q3 | 9% | 41% | 38 min |
| Q4 | 5% | 58% | 12 min |
Repeat-clicker cohort: 31 → 6 · coached individually (names withheld from general reporting)
Baseline before budget
The first campaign costs little and ends every argument about whether the problem exists.
Cohorts, not shaming
General reporting is by department and role; the repeat-clicker cohort gets coaching, not a wall of shame.
Audit evidence, free
ISO 27001 Annex A awareness controls are evidenced by the same reports — no parallel paperwork.
Seat time is a cost. Behavior is a result.
Start with the baseline
Find your real click rate. Then watch it fall.
One baseline campaign establishes the number; the loop takes it from there. Most organizations are surprised twice — first by the baseline, then by how fast it moves.
Track record
Programs delivered for state-owned enterprise groups.
Build the program
Pairs well with
Managed Email Security
The filter stops most of it before the inbox; training builds the reflex for what slips through. Two layers, one failure mode covered.
Managed SOC
A reported phish is telemetry. Where the SOC is subscribed, user reports feed the same watched queue as every other signal.
Enterprise AI Skills & Governance Training
The same workforce, the other reflex — using AI productively and safely. Many clients run both programs as one people agenda.
FAQ
Common questions
Straight answers. If yours isn't here, ask us directly.
Direction of proof. Compliance e-learning proves attendance; this program proves behavior. It starts with a live simulation to establish your real click rate, trains specifically against what the simulation exposed, then re-simulates to show the delta. The certificate is a by-product; the falling click rate is the product.
Not if the program is framed right — and framing is part of the delivery. Simulations are announced as a standing practice (never by date), results are reported by cohort rather than by name for general campaigns, and the follow-up is training, not punishment. The culture goal is confident reporting: the click rate falling matters less than the report rate rising.
Each role gets its own threat picture: finance trains against BEC and payment-diversion lures; executives against whaling and impersonation; IT and developers against credential harvesting and OAuth-consent traps; general staff against the current campaign styles our SOC actually sees. Modules are short, current, and updated from live threat data — not a 2019 slide bank.
Three headline numbers — click rate, report rate, time-to-report — tracked by campaign, department, and repeat-clicker cohort, with an executive one-pager and a detailed report each quarter. ISO 27001 Annex A awareness evidence falls out of the same reporting, so the audit answer is a by-product of the program, not extra work.
Yes — modules deliver through your LMS (Moodle integration is standard) or ours, and workshop formats are available for teams where e-learning underperforms. Completion data syncs wherever HR needs it; the behavioral metrics live in the program dashboard.
With quarterly cycles, meaningful movement typically shows by the second campaign — click rates falling and, more importantly, report rates climbing as people learn the reflex. Programs we've run for large enterprise groups treat the repeat-clicker cohort as its own workstream; that's where targeted coaching earns its keep.
Related
More in People & Training
The next phish is already written. Is the reflex?
Simulate first, train the gap, and put three falling-and-rising numbers in front of the board each quarter. Start with the baseline campaign.