Foundation
Everyday security for every employee: spotting phishing, passwords and multi-factor authentication, safe browsing, handling data, remote work, devices, social engineering and using generative AI at work. Short self-paced modules.
Training & awareness
Cybersecurity training for employees: people who know what to do.
Six programmes, from everyday security habits for every employee to leadership briefings and incident exercises, mapped to the rules that apply to you. With the records customers, insurers and auditors ask for.
Is this for you?
When companies start a training programme.
- Someone almost paid a fake invoiceOr shared data they should not have, and you want it not to happen again.
- A customer or your insurer asks for proofThey want to see that your staff are trained, with records.
- A law or a standard requires itNIS2, DORA, ISO 27001 and PCI DSS all expect documented staff training.
- Your management has new security dutiesNIS2 and DORA expect leaders to be trained and to oversee security.
- You want to rehearse a cyber incidentBefore a real one tests your team, your suppliers and your customers.
- Your team now uses AI toolsAnd needs to know what it may share, and how to check the answers.
What we deliver
Six programmes, from everyday habits to board briefings.
Role-based
Targeted paths for the people attackers single out: finance (fake payment requests), executives (deepfakes and impersonation), HR (personal data), IT administrators, developers (secure coding) and data handlers.
Regulatory
The training your rules expect. NIS2, GDPR, ISO 27001 and card-payment basics online; DORA resilience awareness and EU AI Act AI literacy delivered live by your consultant, with signed attendance.
Simulation
Realistic phishing tests by email, fake websites and QR codes, with a short lesson the moment someone falls for one.
Leadership
Live 60–90 minute briefings for management and the board on their security responsibilities, with a signed attestation for each attendee.
Incident
Two-hour tabletop exercises on realistic scenarios: ransomware, fake payment requests, a personal data breach, an IT failure, a supplier outage. Live, with a signed attestation for each attendee.
What you get
What changes for your business.
01.
Proof for customers and auditors
Completion records, signed attendance and test results, mapped to each rule that asks for them.
02.
Leaders ready for their role
Management that knows its security duties and has rehearsed a crisis.
03.
Safe everyday habits
Staff who handle data, passwords, devices and AI tools safely, and understand why.
04.
Fewer successful scams
A measurable drop in clicks on phishing tests, tracked over time and by department.
05.
Faster reporting and response
More staff flag suspicious emails and calls, and teams that have practised respond faster.
06.
Better insurance terms
Insurers increasingly look for an active training programme when they set premiums and cover.
Who does what
We lead the programme. You keep your people on board.
What we lead
- Design the programme around your people, your risks and your rules
- Assign role-based paths and run the phishing tests
- Deliver leadership briefings, live regulatory sessions and tabletop exercises
- Report results and assemble the year-end evidence pack
What stays with your IT provider
- Tell staff that training and tests are coming
- Let our test emails through your email filters
- Collect staff acknowledgement of your own security policy
- Follow up with people who need extra help
A click in a test is a lesson, never a sanction.
For your IT manager, DPO or CFO
The attacks your team faces every day.
Phishing & spear-phishing
Deceptive emails crafted to steal passwords, trigger payments or install malware, increasingly written with AI to mimic real colleagues, customers or suppliers.
Social engineering
Manipulation by phone, email or in person, impersonating IT support, suppliers or managers to get information or an action.
Fake payment instructions
Fraudulent payment requests sent from spoofed or hijacked executive accounts: direct financial loss, often large and rarely recovered.
Ransomware delivery
Ransomware often gets in through a phishing attachment or a malicious link someone clicks.
Password theft
Reused or weak passwords and fake login pages let attackers in without any technical hacking.
Unintentional leaks
Data exposed through careless handling, wrong sharing settings or personal devices used for work.
How a phishing test programme works.
- i.
Baseline
An unannounced campaign measures your current click rate and reporting behaviour: the honest starting point.
- ii.
Short lesson after a click
Anyone who clicks sees a short explanation of what they missed, while the lesson is fresh.
- iii.
Harder over time
Tests get more convincing over time, drawn from current attacker techniques.
- iv.
Reports and trends
Click rates, reporting rates and department trends, campaign after campaign.
- v.
Audit evidence
All campaign data can be exported as evidence for NIS2, GDPR, ISO 27001, DORA and PCI DSS audits.
Several rules expect documented staff training.
RegulationTraining requirementStatus
NIS2Cybersecurity awareness for all staff, dedicated training for management, documented records.Where NIS2 applies
DORAICT security awareness and digital operational resilience training for all staff and senior management (Article 13(6)).Financial entities
EU GDPRData protection awareness for staff handling personal data: data subject rights, breach notification, lawful processing.Supports accountability
ISO 27001Clauses 7.2 and 7.3 require documented competence and awareness for everyone working under your organisation's control.Certification
PCI DSSRequirement 12.6 requires a formal awareness programme: training at least once a year plus acknowledgement of the security policy.Card payments
FAQ
What owners and HR managers ask us about training.
How often should training be delivered?
A yearly session is the regulatory minimum and rarely enough on its own. We recommend a foundation module each year, regular phishing tests and short quarterly updates on current threats: enough to keep security in mind without training fatigue.
How long do sessions take? Will it disrupt work?
Foundation modules take 10–15 minutes, at each person’s own pace. Phishing tests run in the background. Role-based workshops last 60–90 minutes; leadership briefings and tabletop exercises 2–3 hours. Everything is remote-first and planned around your busy periods.
What evidence do we get for audits and regulators?
Individual completion records with dates, scores, phishing test results by person and department, workshop attendance and programme summary reports, usable for ISO 27001, NIS2, GDPR, DORA and PCI DSS audits, plus a year-end evidence pack.
Is phishing simulation fair to employees?
It is standard practice. We recommend telling staff in advance that tests will run during the year, without giving dates: it is transparent and keeps people alert. A click always leads to a short lesson, never a sanction.
Can training be tailored to our industry?
Yes, and it matters. We adapt scenarios and simulations to your sector, using current threat information, so your team practises against the attacks that actually target companies like yours.
Can training be delivered in French?
Yes. We deliver in English and French. For mixed teams, we recommend that each person trains in their main working language.
Do you cover AI literacy under Article 4 of the EU AI Act?
Yes. Article 4 of the EU AI Act, as amended in 2026, requires deployers and providers of AI systems to take measures to support their staff's AI literacy, taking account of their role and the context the AI is used in. It does not require any specific level to be guaranteed. We can deliver your Article 4 literacy programme on this service, standalone or alongside our AI governance engagement, with completion tracked for audit evidence.
How is the programme priced?
Per employee, as an annual programme covering the six pillars you choose. Leadership briefings, tabletop exercises and live regulatory sessions are scoped to your needs. The figures are in the proposal after the free call. No hourly billing.