Does this include simulated phishing emails to our staff?

Only where you give written approval, with HR sign-off and legal sign-off where your jurisdiction requires it, and only once a reporting route exists for people to use. The purpose of a simulation is to measure whether the programme is working, never to catch an individual, and results are reported as aggregate trends rather than as a list of names. A programme can be effective without simulations, and for very small teams it usually is.

Our insurer wants proof of annual training. Does this produce that?

Yes. Attendance is recorded per session with dates, the material is versioned, and the same content is packaged for onboarding so new starters are covered without waiting for the next annual session. That record is normally what an insurer or auditor is actually asking for, and it is worth checking their exact wording before deciding on the size of the programme.

How long do the sessions take, and what do staff have to do?

A main session of twenty to thirty minutes, built around three situations from your own industry rather than generic examples, plus a one-page desk card people keep. After that it is a short reminder each month, under a minute to read. The design goal is that nothing feels like an exam, because programmes that feel like exams produce people who hide their mistakes.

What is the single change that prevents the most loss?

A written verification procedure for changes to supplier bank details — any request to change payment details is verified by calling a phone number you already held before the request arrived, never a number in the email itself, and approved by a named second person. Invoice redirection fraud is the most expensive thing that happens to ordinary businesses and it is stopped by one phone call. That procedure is written for your finance team as part of this work.

We are a small team. Is this worth buying at all?

If you handle supplier payments, customer data or patient records, yes — and small companies are where a single session lands hardest, because everyone is in one room and the examples can be about your actual suppliers. What you probably do not need is a full year-long programme with a simulation platform. A session, a desk card, a reporting route and twelve reminders is the version that fits, and it sits at the lower end of the range.

What is the reporting route and why does it matter more than the training?

A single button in your mail client, or a single address, where anyone can send something that looks wrong and get an actual answer back. It matters more than the teaching because recognition without a route to report goes nowhere, and because the message that gets forwarded within two minutes is the one you can act on. Setting it up and making sure it is answered is part of the work, not an extra.

Cybersecurity

Security awareness training

A programme built on your industry's real fraud, not generic slides — sessions, a reporting route people actually use, monthly reminders and the attendance record your insurer wants.

From: $500–$6,000
Typical time: 1–4 weeks
Usually bought by: Every company

What this actually solves

The most expensive incidents in ordinary businesses do not involve anybody breaking a system. They involve somebody being convincingly asked to do a normal thing. A supplier writes to say their bank details have changed, in the same tone as always, quoting the same thread that has been running for weeks, on the day the invoice was genuinely due — because someone has been reading that mailbox quietly for months and waited for the right moment. The payment goes out. Nobody notices for three weeks.

There is no technical control that fully closes this. It is closed by a habit and a written procedure, and by an environment where the person who is slightly unsure feels able to check. That is what a training programme is actually for, and it is why generic slides about strong passwords do not move the number.

The second reason companies buy is duty. Insurers and auditors now routinely require at least annual security training with an attendance record. It is easy to treat as a tedious obligation, which is precisely why doing it well is valuable — the same hour can either produce a tick in a box or genuinely change what happens when the finance team gets an unexpected email about a bank account.

How the programme is built

Work out what would actually happen to this company. An exporter's realistic risk is invoice redirection on supplier payments. An online retailer's is customer data and account takeover. A clinic's is patient records. The training is built around whichever one it is, because people learn from situations they recognise and ignore situations they do not. Two to three days.
Baseline. A short survey establishing what people already know and, more usefully, what they currently do when something looks odd. It takes a few minutes per person and it is what the quarterly measurement is later compared against. Two to three days.
Build the session and the material. A twenty-to-thirty-minute session structured around three stories from your own trade — what the person saw, what the warning signs were, what they should have done. Fifteen slides in plain language. A one-page desk card with the four checks to make and the single action to take when unsure. And a written verification procedure for supplier bank detail changes that your finance team can follow, naming who may approve and what proof is required. Three to five days.
Set up the reporting route. The report-phishing button in Google Workspace or Microsoft 365, or a monitored address, plus agreement on who answers it and how quickly. Nothing is delivered before this exists, because teaching people to recognise something and giving them nowhere to send it produces hesitation rather than reports. One to two days.
Deliver, and put the same material into onboarding. Sessions run live where possible, attendance recorded, questions answered in the room. The identical content packaged so a new starter gets it in their first week rather than in eleven months. One to two days of delivery.
Keep it running. Twelve monthly reminders of under forty words each, and a quarterly or half-yearly measurement — reports received, time to report, and whether people are reporting their own mistakes. Ongoing, a small amount of time each month.

What moves the price

$500–$6,000 over 1–4 weeks, and three things decide where a programme sits in that range.

Headcount and the number of sessions. One session for a team that fits in a room is the bottom of the range. Several sessions across shifts, sites or time zones is more delivery time, and each one is its own hour.

Languages. Material delivered in more than one language is not a translation task bolted on; the stories, the desk card and the reminders all have to work naturally in each one, and each version needs its own review.

Whether compliance evidence and simulations are required. A session and a desk card is one thing. A year-long programme with an attendance record built for an auditor, a simulation platform configured and approved, and monthly reporting is a different scope, and it is what takes the engagement towards the top of the range.

What usually goes wrong

The simulation uses bait about money or job security. A fake email about a bonus, a payroll change or a redundancy consultation will get a very high click rate and it will cost more than it measures. Staff who fall for it feel deceived by their own employer rather than educated, and the resentment outlasts the report by years. Lures never touch pay, bonuses or employment status — that is written into the approval before any simulation runs.

Results are circulated with names attached. Sending a manager the list of who clicked converts the programme from a safety exercise into a performance issue, and the immediate consequence is that people stop reporting. The worst outcome in this whole field is the employee who clicked, realised it, and was too frightened to tell anyone for four days. Results go out as trends, and every session opens by saying plainly that reporting your own mistake is the behaviour being asked for.

There is training but no reporting route. People leave the session genuinely more alert, encounter something suspicious the following week, and have nowhere to send it except a colleague who also does not know. Within a month the alertness has decayed and nothing has been learned about what is actually arriving in the company's inboxes. The route is the part that turns awareness into information you can act on, which is why it is built before the first session rather than after it.

See where the site stands before you brief anyone.

If the site is already live, start from what it scores rather than from a guess. The audit reports what it checked, what it found, and — the part most tools leave out — what it could not check, and why.

See the website audit Talk about this work

Questions people ask before they commit.

Does this include simulated phishing emails to our staff?: Only where you give written approval, with HR sign-off and legal sign-off where your jurisdiction requires it, and only once a reporting route exists for people to use. The purpose of a simulation is to measure whether the programme is working, never to catch an individual, and results are reported as aggregate trends rather than as a list of names. A programme can be effective without simulations, and for very small teams it usually is.
Our insurer wants proof of annual training. Does this produce that?: Yes. Attendance is recorded per session with dates, the material is versioned, and the same content is packaged for onboarding so new starters are covered without waiting for the next annual session. That record is normally what an insurer or auditor is actually asking for, and it is worth checking their exact wording before deciding on the size of the programme.
How long do the sessions take, and what do staff have to do?: A main session of twenty to thirty minutes, built around three situations from your own industry rather than generic examples, plus a one-page desk card people keep. After that it is a short reminder each month, under a minute to read. The design goal is that nothing feels like an exam, because programmes that feel like exams produce people who hide their mistakes.
What is the single change that prevents the most loss?: A written verification procedure for changes to supplier bank details — any request to change payment details is verified by calling a phone number you already held before the request arrived, never a number in the email itself, and approved by a named second person. Invoice redirection fraud is the most expensive thing that happens to ordinary businesses and it is stopped by one phone call. That procedure is written for your finance team as part of this work.
We are a small team. Is this worth buying at all?: If you handle supplier payments, customer data or patient records, yes — and small companies are where a single session lands hardest, because everyone is in one room and the examples can be about your actual suppliers. What you probably do not need is a full year-long programme with a simulation platform. A session, a desk card, a reporting route and twelve reminders is the version that fits, and it sits at the lower end of the range.
What is the reporting route and why does it matter more than the training?: A single button in your mail client, or a single address, where anyone can send something that looks wrong and get an actual answer back. It matters more than the teaching because recognition without a route to report goes nowhere, and because the message that gets forwarded within two minutes is the one you can act on. Setting it up and making sure it is answered is part of the work, not an extra.

Often taken together.

Start with the brief, not the invoice.

Send what you are trying to achieve. You get a written scope, a price and a date — or an honest “this is not the right service for that”.

Talk about Security awareness training All Cybersecurity services