- Creators of The SECUR IT Success Framework
More than 80% of reported cyber incidents in the UK started with phishing. Criminals send emails that look like they're from Microsoft, your bank, your CEO, or a delivery company. One click is all it takes.
Email filters block most phishing emails, but not all of them. The ones that get through are often the most convincing – carefully crafted to look legitimate. Your team needs to recognise them.
Cyber Essentials, ISO 27001, GDPR, FCA, SRA, and NHS DSPT all require or recommend regular staff cybersecurity training. It's not optional if you operate in a regulated sector.
Annual training that ticks a box but doesn't change behaviour is a waste of time. Effective training is ongoing – regular, short, relevant, and reinforced with simulated phishing attacks that test real-world awareness.
We send realistic simulated phishing emails to your team:
Emails that mimic real attacks – fake invoices, delivery notifications, password resets, CEO fraud
Emails that mimic real attacks – fake invoices, delivery notifications, password resets, CEO fraud
Customised to your industry and business
Monthly campaigns (or more frequent on request)
Track who clicks, who reports, and who enters credentials
Instant coaching for anyone who clicks – teachable moment, not punishment
Reporting dashboard showing improvement over time
How to spot phishing emails (subject lines, sender addresses, urgency tactics)
Business email compromise (BEC) and invoice fraud
Password security and multi-factor authentication
Safe browsing and social engineering
Remote working security
Removable media and physical security
Data handling and GDPR basics
Reporting suspicious activity
Monthly phishing simulations with varying difficulty
Quarterly training modules on different topics
Topical alerts when new threats emerge (e.g. new phishing campaigns, current events)
Annual refresher training for compliance evidence
Dashboard showing phishing click rates, training completion, and risk scores
Trend reporting showing improvement over time
Compliance evidence Compliance evidence
Individual risk scoring to identify staff who need additional support
Board-ready reports Board-ready reports
Every new employee receives baseline security awareness training during their first week. This covers phishing, password security, data handling, and your policies. No gaps when new people join.
We run a baseline phishing simulation before any training. This shows your current click rate – the starting point.
Your team completes their first training module. Short, interactive, and relevant to your industry.
Monthly phishing simulations. Quarterly training modules. Instant coaching for anyone who clicks. Reporting shows improvement.
Regular reporting. Quarterly reviews with you. Adjustments based on results. New topics as threats change.
| Metric | Before Training | After 6 Months | After 12 Months |
|---|---|---|---|
| Phishing click rate | 25–35% (industry average) | 10–15% | Under 5% |
| Report rate (staff reporting suspicious emails) | Under 5% | 30–40% | 50%+ |
| Training completion | 0% | 95%+ | 50%+ |
| Compliance evidence | None | Full audit trail | Continuous |
Book a consultation to discuss your security awareness training needs. We’ll assess your current risk and provide a programme that reduces your phishing click rate to under 5%.
✓ Real phishing simulations · ✓ Monthly campaigns · ✓ Compliance reporting · ✓ CISSP certified
