People & Culture
Training & Awareness
Your staff are either your strongest control or your weakest. Programmes that change behaviour and produce a number you can report, not an annual video nobody remembers.
What we deliver
6 services in this practice area, scoped on their own or combined.
-
Role-Based Cyber Awareness Training
Separate tracks for general staff, technical teams, finance and leadership. A payments clerk and a systems administrator face different attacks and should not sit through the same session.
-
Phishing & Social Engineering Tests
Simulated phishing, vishing and pretext campaigns run against agreed rules, measuring click rate, credential submission and. The number that actually matters, reporting rate.
-
Executive & Board Briefings
Concise, non-technical sessions that give directors what they need to discharge their oversight duty: the real threat picture, your actual posture, and the decisions that are theirs to make.
-
Security Culture Programmes
Multi-month behaviour change built on measurement rather than posters, targeted interventions where the data shows risk, and a metric you can put on a board slide each quarter.
-
Tabletop Exercises
Facilitated scenario walkthroughs that test your incident response plan against a realistic event, usually revealing that the plan assumes people and systems that will not be available.
-
Policy & Procedure Workshops
Collaborative sessions to write, review and socialise security policy that people will actually follow, mapped to the framework you are certifying against.
- NIST NICE
- ISO 27001 A.6
- SANS Security Awareness Maturity Model
- MITRE ATT&CK
What starts a programme
Awareness work rarely begins in the abstract. It usually begins with one of these.
-
Finance nearly paid a fraudulent invoice and nobody caught it early.
-
The same awareness video has run for three years and nothing has changed.
-
A customer wants proof staff are trained. You can show attendance and nothing else.
-
You have an incident response plan. Nobody named in it has met in a room.
-
The board needs to understand cyber risk without a technical briefing.
-
Your people know not to click. They still click.