Security awareness programmes that change behaviour rather than tick boxes: role-based training, phishing simulations with a teaching loop, and the evidence trail ISO 27001, NIS2 and your insurers expect.
Awareness fails when it is generic and yearly. We build a rolling programme tuned to your roles, your threats and your incidents.
Developers, finance, executives and new joiners each get the risks they actually face, not the same slideshow.
Realistic, current lures with an immediate teaching moment on every click, measured by improvement and never used to shame.
Short scenario exercises for the people who would take the first call, because the first hour decides the incident.
Practical guidance on using AI tools safely at work: what to share, what never to paste, and how to spot AI-enabled fraud.
Completion, click-rates, reporting-rates and trends: the metrics that satisfy auditors and actually mean something.
Every activity mapped to ISO 27001 A.6.3, NIS2 training duties and DORA awareness obligations, with evidence filed as you go.
A discreet phishing baseline and role-risk mapping: where your human attack surface really is.
Core training rolled out by role, with leadership visibly first through the door.
Monthly micro-content, simulations and drills timed to real-world campaigns and your own incidents.
Quarterly evidence packs for auditors, insurers and the board: improvement shown, gaps named.
It can pass an audit; it rarely changes behaviour. The standard asks for awareness appropriate to role and risk, and a light monthly rhythm evidences that far more convincingly than one November marathon.
Not run properly. We never publish individual results, every click lands on a 60-second lesson rather than a reprimand, and reporting a phish is celebrated louder than avoiding one.
Anonymised and with your approval, yes, and it is the most effective content there is. Nothing lands like "this nearly happened here".
Yes: accredited TRECCERT courses for implementers and auditors run separately. See our training courses page.
A 30-minute scoping call with a senior consultant, with no obligation and no sales deck.