Advisory service

Awareness & Training.

Behaviour change, not box-ticking. Phishing simulations, role-based modules, executive briefings, and the measurement framework to show whether any of it is working.

Annual compliance training that nobody remembers the next day is a tax, not a control. We build awareness programmes that measure behaviour change and adjust based on what is actually working in your environment.

What this includes

  • Baseline behaviour assessment via phishing and other simulations
  • Role-based modules for engineering, finance, HR, legal, leadership
  • Executive briefings tailored to board and senior management
  • Just-in-time training tied to high-risk moments (e.g. M&A, layoffs)
  • Measurement framework with leading indicators

How we run it

01

Baseline

Run the first phishing simulation cold. Measure where people are today, not where they think they are.

02

Design

Build role-based modules using the baseline data. Generic training is the failure mode.

03

Roll out

Quarterly campaigns. Different topics, different formats. Avoid burnout.

04

Measure

Quarterly behaviour metrics. Adjust the programme based on data, not vendor opinions.

What you get

  • Phishing simulation baseline and quarterly campaigns
  • Role-based training modules (six to ten roles)
  • Executive briefing pack
  • Just-in-time training playbook for high-risk events
  • Quarterly behaviour scorecard

Why this matters

Eighty percent of breaches involve a human action. The traditional training market sells content. The measurable behaviour change market sells outcomes. The difference is in the measurement framework.

Questions we get

How quickly does behaviour change show up?

First measurable change typically within three to six months for targeted populations. Sustained change at the organisation level takes 12 to 18 months. Anyone promising faster is selling content.

Should phishing simulations include leadership?

Yes. Excluding leadership creates a culture problem. The simulations need to be calibrated for the population, but no group should be exempt.

What is the right cadence?

Monthly phishing simulations, quarterly themed campaigns, annual mandatory refresher for everyone, just-in-time training for high-risk moments. Anything more frequent burns out attention; anything less loses momentum.

Next step.

A 30-minute scoping call clarifies whether your situation fits this engagement.

Request a briefing