Security Awareness · Staff Training
Service group: CybersecurityTraining that helps staff spot and report the attacks aimed at them
We run an ongoing awareness programme of short lessons and realistic phishing simulations, built around the scams Canadian businesses actually receive, and we measure whether reporting habits are improving.
At a glance
- Service
- Recurring managed security awareness training with phishing simulations and reporting
- Best suited to
- Organizations of roughly 5 to 200 employees whose staff handle email, payments or client information
- Core inclusions
- Enrolment, scheduled micro-lessons, phishing simulations, a report-phishing button, new-hire training and quarterly progress reports
- Not included by default
- In-person classroom sessions, custom video production, HR disciplinary processes and role-specific technical training
- Pricing basis
- Per enrolled user per month; proposed figures are confirmed in a written quotation
- Delivery
- Online, self-paced lessons in English, with live remote briefings for leadership available by quotation
- How to start
- Order the Security Awareness Training subscription or book a consultation
What the training programme is
Security awareness training is an ongoing programme that teaches staff to recognize and report social engineering: phishing emails, fake login pages, invoice and payment fraud, executive impersonation, malicious attachments, text message scams and suspicious phone calls. It also covers everyday habits such as password managers, MFA prompts, safe file sharing and reporting lost devices.
We run the programme as a managed service. That means we enrol users, schedule short lessons, design phishing simulations that match current threats, handle the reporting button, train new hires as they join, and report results to leadership in a way that encourages reporting rather than shaming.
Training reduces risk but does not eliminate it. People will still occasionally click. The aim is for staff to report quickly, so that technical controls and a person can respond before damage spreads.
Problems training addresses
Invoice and payment fraud
Staff receive convincing requests to change supplier banking details or pay urgent invoices from someone posing as a leader.
Credential phishing
Fake Microsoft 365, courier or e-signature pages collect passwords and MFA approvals.
Silence after a mistake
People who click a bad link are embarrassed and say nothing, giving an attacker time.
One-time training that fades
An annual video is watched once, forgotten, and does not reflect new scams.
What the programme includes
Micro-lessons
Short lessons of a few minutes each, delivered on a schedule, covering phishing, payment fraud, passwords, MFA, mobile threats and data handling.
Phishing simulations
Realistic simulated emails at varied difficulty, based on lures seen in the wild, with instant feedback for anyone who clicks.
Report-phishing button
A one-click way to report suspicious messages in Outlook, with reports routed for review during agreed hours.
New-hire onboarding
Baseline training assigned automatically when new staff are added.
Targeted refreshers
Extra lessons for users who repeatedly click simulations, and focused content for finance and executive staff.
Leadership reporting
Quarterly summaries of completion, simulation click and report rates, and trends, without public naming of individuals.
Scope
Typically included
- User enrolment and directory synchronization for enrolled staff
- Scheduled micro-lessons throughout the year
- Phishing simulations at an agreed frequency
- Report-phishing button deployment in Outlook
- Review of user-reported messages during agreed hours
- Automatic new-hire training assignment
- Quarterly reports for leadership
Requires separate scope or quotation
- In-person classroom training sessions
- Custom-produced video or branded course content
- Employee discipline or HR policy decisions
- Phone-based or physical social engineering tests
Platforms
- Established security awareness training and phishing simulation platforms
- Microsoft Defender for Office 365 Attack Simulation Training where licensed
- Microsoft Outlook report message add-in
- Microsoft Entra ID synchronization for user enrolment
- Get Cyber Safe resources from the Government of Canada as supplementary material
Who it is for
Teams that move money
Businesses with staff who approve payments, change supplier details or manage payroll.
Client-data custodians
Accounting, legal, healthcare and real estate firms where one compromised mailbox exposes confidential information.
Organizations meeting insurer expectations
Businesses asked to show regular training and phishing testing for cyber insurance.
Benefits
- Staff who recognize common scams and pause before acting
- Faster reporting of suspicious messages and mistakes
- Evidence of ongoing training for insurers and clients
- Training that stays current without internal effort
- A culture where reporting is encouraged, not punished
How we run the programme
Kick-off
We agree enrolled users, simulation frequency, how results are shared and who receives reports.
Baseline simulation
An initial simulated phishing campaign shows starting behaviour before training begins.
Launch training
Staff receive an introduction and their first lessons, and the report button is deployed.
Ongoing cycle
Lessons and simulations continue on schedule, with refreshers for those who need them.
Quarterly review
We review trends with leadership and adjust topics to current threats.
Ways to buy
Prices are proposed and confirmed in a written quotation.
Security Awareness Training subscription
Per-user monthly enrolment with lessons, simulations and reporting.
Leadership briefing
A live remote session for owners and managers on fraud and incident reporting, quoted separately.
Part of managed cybersecurity
Include training alongside email security and identity controls in a single programme.
Frequently asked questions
Are phishing simulations used to punish staff?
No. Clicks lead to immediate, short training, and reports to leadership focus on trends. We encourage recognition of good reporting rather than naming individuals.
How much time does training take?
Lessons are typically a few minutes each and spread through the year, so the time commitment is small and does not disrupt work.
Is training available in French?
Some platforms offer French content. Language availability is confirmed during scoping before you commit.
Can training replace technical email security?
No. Training and technical controls work together. Email filtering blocks most malicious messages, and trained staff catch and report what gets through.
What should staff do if they think they clicked something malicious?
Report it straight away through the agreed channel, even if they are unsure. Early reports let us reset passwords, revoke sessions or isolate a device during agreed hours, and the training repeatedly reinforces that a quick report is always the right move.
Related services
Products and packages
Industries we support
Service areas
Help your team recognize the next scam
Enrol your staff or talk to us about simulation frequency and reporting before you commit.