Your people are the perimeter now
In a remote company there’s no office network to filter what reaches people. Every inbox, phone and chat app is a way in. Attackers know it: it’s far easier to trick someone into handing over a password than to break encryption. That makes your team’s judgment one of your most important security controls, and judgment can be trained.
What the program includes
- Automated phishing simulations. Realistic test emails sent on a schedule, varied by difficulty and theme: fake invoices, shared documents, password resets, delivery notices.
- Just-in-time lessons. Anyone who clicks gets a two-minute lesson immediately, while it’s memorable.
- Short training modules. Five to ten minutes each, covering phishing, payment fraud, safe remote work, passwords and MFA, and safe use of AI tools.
- A report button. One click in the mail client sends suspicious messages to the security team, and reporting is tracked as a positive result.
- Plain-English reporting. Click rates, report rates and trends by team, so you can see risk going down.
The threats we train for
Phishing and credential theft
Fake login pages for Microsoft 365, Google Workspace and other apps your team uses daily. Training focuses on checking where a link really goes and using the password manager as a safety check.
Payment and invoice fraud
Business email compromise: a vendor or executive “changing bank details.” People learn to verify payment changes through a known phone number, never the email itself.
AI-powered social engineering
AI-written emails without spelling mistakes, cloned voices on voicemail, and deepfake video calls. The lesson is the same as for any request: verify through a second channel before acting.
Safe use of AI tools
What can and can’t go into chatbots and AI assistants, tied to your AI acceptable use rules. This is the human side of controlling shadow AI.
How it works
Baseline test
An unannounced first simulation shows where you stand today.
Training plan
Short modules assigned by role, with extra focus for teams that handle payments or client data.
Monthly simulations
Varied tests that build the habit of slowing down and checking.
Quarterly review
Results and trends reviewed with you, and the plan adjusted to where risk remains.
Training works best with technical backstops
People will occasionally click; everyone does. That’s why training sits alongside password and MFA management, which makes stolen passwords far less useful, and managed detection and response, which catches what happens if someone does slip.