Reduce human risk with practical cybersecurity awareness training and phishing simulations

Cybersecurity awareness assessment

Assess current training, policies, reporting behaviour and employee risk.

Human-risk baseline

Establish an initial view of knowledge, behaviour and phishing susceptibility.

Awareness programme strategy

Define audiences, topics, frequency, objectives and success measures.

Annual training programme

Deliver scheduled awareness activities throughout the year.

Employee cybersecurity induction

Train new employees on essential security responsibilities.

General employee awareness training

Cover common threats and safe working practices.

Executive cybersecurity awareness

Provide senior leadership with targeted risk and decision-making guidance.

Board cybersecurity briefing

Explain cyber risk, accountability, incident readiness and governance.

Privileged-user awareness

Train administrators and users with elevated access.

Finance-team fraud awareness

Address invoice fraud, payment diversion and business email compromise.

HR security awareness

Cover personal information, recruitment scams and employee-data handling.

Sales-team security awareness

Address customer data, public communication and mobile working risks.

IT-team security awareness

Reinforce privileged access, change control and incident reporting.

Remote-worker security training

Cover home networks, personal devices, VPNs and secure collaboration.

Contractor security awareness

Provide targeted training for temporary and third-party users.

Phishing awareness training

Teach employees to identify suspicious messages, links and attachments.

Spear-phishing awareness

Explain targeted phishing using personal or organisational context.

Business email compromise training

Cover impersonation, payment fraud and mailbox compromise indicators.

Smishing awareness

Teach employees to identify malicious SMS messages.

Vishing awareness

Teach employees to recognise fraudulent voice calls.

QR-code phishing awareness

Explain malicious QR codes and unsafe scanning behaviour.

Social engineering awareness

Cover manipulation, urgency, authority and trust abuse.

Password security training

Promote strong, unique passwords and password-manager use.

Multi-factor authentication training

Explain MFA benefits, approval fatigue and secure usage.

Credential theft awareness

Teach users how fake login pages and token theft work.

Data protection awareness

Cover safe handling of confidential and personal information.

POPIA awareness training

Explain employee responsibilities relating to personal information.

Email security awareness

Cover suspicious senders, attachments, links and spoofing.

Safe web-browsing training

Teach users to identify unsafe websites and downloads.

Malware awareness

Explain malicious files, fake updates and unsafe software.

Ransomware awareness

Teach employees how ransomware commonly enters organisations.

USB and removable-media awareness

Address unknown devices and unauthorised storage.

Mobile-device security training

Cover screen locks, apps, updates, backups and device loss.

Public Wi-Fi awareness

Explain safe connectivity and VPN use.

Cloud collaboration security

Cover secure sharing in Microsoft 365 and other cloud services.

Microsoft Teams security awareness

Teach safe meeting, file-sharing and external-chat practices.

SharePoint security awareness

Cover permissions, external sharing and confidential data.

OneDrive security awareness

Explain secure file storage, sync and sharing.

Microsoft 365 security awareness

Address identity, mailbox, sharing and collaboration risks.

Safe use of AI tools

Explain confidential-data, account and prompt-security risks.

Generative AI awareness

Teach employees how to use AI tools without exposing sensitive information.

Secure social media use

Address oversharing, impersonation and organisational information leakage.

Physical security awareness

Cover tailgating, unattended devices and visitor control.

Clean-desk awareness

Promote secure handling of documents and visible information.

Secure printing awareness

Reduce exposure of confidential printed information.

Incident reporting awareness

Teach users how and when to report suspicious activity.

Lost-device reporting

Explain immediate steps after device loss or theft.

Data-breach reporting

Help employees recognise and escalate possible data exposure.

Policy awareness sessions

Explain selected organisational security policies.

Acceptable-use training

Clarify permitted and prohibited use of company systems.

BYOD security awareness

Explain employee responsibilities when using personal devices.

Secure remote-access awareness

Cover VPN, MFA and safe access to business systems.

Phishing simulation planning

Define campaign objectives, target groups and approved scenarios.

Baseline phishing simulation

Measure initial employee susceptibility.

Email phishing simulations

Send controlled simulated phishing messages.

Credential-harvest simulations

Measure response to approved fake login scenarios without collecting real passwords.

Attachment-based simulations

Test response to approved simulated malicious attachments.

Link-click simulations

Measure interaction with suspicious links.

Business email compromise simulations

Test payment and authority-based fraud scenarios.

Executive impersonation simulations

Assess response to approved leadership-impersonation scenarios.

Supplier impersonation simulations

Test response to vendor and invoice-change fraud.

HR-themed simulations

Use approved recruitment, payroll or policy scenarios.

IT-support simulations

Test response to password-reset and account-warning messages.

Seasonal phishing simulations

Use approved tax, holiday, delivery or event themes.

Targeted phishing simulations

Run controlled campaigns for selected high-risk groups.

Smishing simulations

Test approved SMS-based awareness scenarios where supported.

Vishing simulations

Test approved voice-based social engineering scenarios where supported.

QR phishing simulations

Use controlled QR-code scenarios.

Phishing landing pages

Use safe educational pages for simulation outcomes.

Just-in-time training

Provide immediate learning after risky simulation behaviour.

Positive reinforcement

Acknowledge employees who correctly report simulated threats.

Repeat-offender coaching

Provide targeted follow-up for employees requiring additional support.

High-risk-user training

Provide focused training to users with repeated risky behaviour.

Department-level analysis

Compare results across approved organisational groups.

Role-based risk analysis

Assess simulation results by job function.

Click-rate reporting

Measure interaction with simulated phishing links.

Credential-submission reporting

Measure approved simulated credential-entry behaviour.

Reporting-rate measurement

Track how many employees report suspicious simulations.

Time-to-report measurement

Measure how quickly simulations are reported.

Repeat-risk measurement

Identify recurring risky behaviour over time.

Human-risk scoring

Develop selected employee or group risk indicators.

Security culture surveys

Measure employee confidence, attitudes and reporting behaviour.

Knowledge assessments

Use quizzes and checks to measure learning.

Pre-training assessment

Measure baseline awareness before training.

Post-training assessment

Measure improvement after training.

Monthly awareness report

Provide management with results, trends and recommendations.

Quarterly executive report

Summarise human-risk trends and programme performance.

Board reporting support

Provide concise awareness and phishing metrics for governance reporting.

Compliance evidence reporting

Provide selected attendance, assessment and campaign records.

Training attendance tracking

Track participation and completion.

Training completion certificates

Provide selected proof of completion.

Learning reminders

Send approved reminders to incomplete participants.

Awareness newsletters

Provide short security updates and practical guidance.

Security tip campaigns

Deliver recurring bite-sized awareness messages.

Security awareness posters

Provide workplace and digital awareness materials.

Monthly cyber themes

Run focused campaigns around selected security topics.

Cybersecurity awareness month programme

Deliver an enhanced awareness campaign during October.

Microlearning modules

Provide short, focused learning content.

Live virtual training

Deliver instructor-led online awareness sessions.

On-site training

Deliver instructor-led sessions at approved locations.

Recorded training modules

Provide reusable training content where included.

Interactive workshops

Use practical examples and discussion-based learning.

Executive tabletop exercise

Test leadership response to a simulated cyber incident.

Phishing response exercise

Test reporting, triage and escalation procedures.

Business email compromise exercise

Test finance, management and IT response to fraud.

Ransomware awareness exercise

Test employee and management understanding of ransomware response.

Incident communication exercise

Test internal communication during a cyber event.

Awareness policy development

Develop or update cybersecurity awareness policies.

Training standard development

Define minimum learning requirements by role.

Phishing simulation policy

Document rules, privacy, governance and campaign approval.

Awareness calendar development

Plan annual themes, simulations and training activities.

Programme governance

Define ownership, approvals, reporting and improvement processes.

Managed awareness programme

Operate training, campaigns, reporting and follow-up on behalf of the organisation.

Continuous improvement

Refine content and targeting based on results and emerging risks.