Most security awareness programmes exist to produce a number for an auditor. Everyone completes a forty-minute video in December, the completion rate hits 100%, and the click rate on the next simulation is unchanged.
Two things are wrong with that, and both are fixable.
We Don't Punish the Click
Naming and shaming people who fall for a simulation produces exactly one outcome: they stop reporting. So the day it's real, the person who clicked sits quietly and hopes — and you lose the hours that mattered.
The metric that predicts whether you survive a real phishing attack is report rate and time-to-report. How many people flagged it, and how fast. Click rate is a distraction. Some percentage of humans will always click, which is why the answer to "one click breaches us" is better controls, not better humans.
So we measure reporting, we make reporting effortless, and we treat a fast report as the win it is.
Simulations Built From Your Real Attack Surface
Generic templates get spotted. "Your Microsoft password expires today" is a poster on the wall by the third round.
We build campaigns from what an attacker would actually find about you: your real vendors, your real invoice workflow, your real tools, the conference you just sponsored, the personnel changes you announced on LinkedIn. Where we've run an exposure audit, we use those findings — because that's what a real attacker would be working from.
The point isn't catching people out. It's making the training match the threat.
Training People Will Actually Finish
Short, role-specific, spread through the year rather than dumped in one December afternoon.
Finance gets invoice fraud and business email compromise — the payment-redirect attack that quietly takes more money from mid-sized companies than ransomware does.
Marketing gets ad account and social credential phishing, plus impersonation.
Executives get targeted attacks, because their names are public and their approval moves money.
Developers get repository hygiene, secrets handling and dependency risk.
Everyone gets the short version: how to report, and why reporting fast is never the wrong call.
The One Aimed at Marketing Teams
If you run significant paid spend, your ad accounts are a target in their own right.
Business account takeover follows a consistent path. A convincing message to someone with admin access. Credentials captured. Then the account runs someone else's campaigns on your card and your reputation until you notice. Recovery is slow and largely automated. Brands lose weeks.
We test for it specifically, and we fix what surrounds it: admin access reviewed, MFA enforced, business manager permissions cleaned up, and a documented path for the hour you discover it's happening.
What You Get
- A baseline assessment before any training, so you can prove change later
- Simulation campaigns through the year at varying difficulty
- Role-specific training modules
- A reporting mechanism that takes one click
- Reporting on report rate, time-to-report and repeat-risk patterns, by department — without a leaderboard of named individuals
Questions We Get Asked
Won't simulations make our team distrust internal email?
A little healthy scepticism is the goal. Problems only appear when simulations are used punitively, which is why we don't run them that way and why we brief leadership on that before the first campaign.
How often should simulations run?
Monthly to quarterly, varying in difficulty. Annual campaigns test nothing — people remember the season.
Do you need to send from our domain?
Yes, for realistic simulations. We work with your IT team to configure it safely, so the simulations reach inboxes without weakening your genuine mail security.
Someone clicked. What now?
They get a short, non-punitive teaching moment at the point of the click. That's the moment training actually lands, and it's worth more than the video.
Ready to take the first step?
