← Solutions
CyberPopular

Security awareness and phishing simulation

A year-long programme that changes behaviour, not just completion rates: role-based training, realistic phishing and deepfake simulations.

Typical timing
12-month programme
Engagement
Monthly retainer
Delivery framework
User researchDiscoveryAlphaBetaLive
Discuss this solutionCyber capability →

Objective

Reduce human-driven incidents by building habits people keep. Content is short and relevant to each role, simulations reflect current attacks — including AI-written phishing and voice deepfakes targeting finance teams — and results are measured by reporting rates, not click-through on a video.

You may need this if

  • Phishing and business email compromise incidents keep recurring
  • Training is an annual video with no measured effect
  • Finance and executive teams are targets for payment fraud
How it runs

Activities, step by step

The plan follows our delivery framework. Steps that do not apply to this kind of work are left out rather than padded.

  1. 01 · User research2 weeks

    Baseline behaviour

    • Baseline phishing simulation
    • Survey of security culture
    • High-risk roles identified
  2. 02 · Discovery1–2 weeks

    Programme design

    • Twelve-month calendar of topics and simulations
    • Role-based paths for finance, executives and developers
    • Easy reporting route for suspicious messages
  3. 05 · Live12 months

    Run and measure

    • Monthly micro-training and simulations
    • Deepfake and payment-fraud exercises for high-risk roles
    • Quarterly metrics report

Deliverables

What you keep at the end.

  • Baseline and quarterly behaviour reports
  • Role-based training content
  • Phishing and deepfake simulation programme
  • Reporting process and playbook

Outcomes

What it is built to change.

  • More staff reporting suspicious messages, and faster
  • Fewer successful phishing and fraud attempts
  • Evidence of training for insurers and auditors

Often combined with

Every engagement starts with a 45-minute working session with the SME who would own the work. No deck.

Discuss this solution