Companies with checkbox training
You run an annual course and collect completions, but phishing clicks and fraud attempts keep coming. You want a program aimed at behavior, not attendance.
Risk & security programs
Security awareness program
Your auditors want training records, your insurer asks about phishing simulation, and your finance team just received a convincing voice message from someone who sounded exactly like your CEO. A security awareness program built for your organization gives you training that fits each role, defenses against the fraud aimed at you, and evidence that behavior is changing — not just that a video was played.
Formal outcome from
No certificate — the result is a program your people actually use
Who asks for it
PCI DSS, SOC 2 and ISO 27001 auditors · CMMC assessors and defense primes
Our role
Readiness — we help you build it and prove it
Your organization — readiness viewEvery requirement, an owner and its evidence
Readiness- SCOPEScope and system boundaryReady
- RISKRisk assessment and registerReady
- ACCESSAccess reviews, with evidenceGap · owner set
- CHANGEChange managementClosing
- VENDORVendor managementGap · owner set
- TESTPenetration test evidenceReport in hand
Handed to the assessor you choose — the opinion is theirs
Gaps found before the audit
Who it’s for
Why Security awareness lands on your desk.
Most incidents start with a person: a reply to a convincing email, a password typed into a fake login page, a payment sent to changed bank details, a help-desk reset for a caller who wasn’t who they claimed to be. A security awareness program is how your organization prepares people for those moments. NIST SP 800-50 Rev 1, published in 2024 as Building a Cybersecurity and Privacy Learning Program, frames this as an ongoing learning program: awareness for everyone, role-based training for people with specific responsibilities, and measurement that feeds back into the program.
Nearly every framework requires it. PCI DSS requirement 12.6 calls for a formal awareness program that covers phishing and related social engineering. The HIPAA Security Rule requires security awareness and training for the whole workforce. ISO/IEC 27001 requires awareness under clause 7.3 and Annex A control 6.3, SOC 2 auditors look for training under the control environment and communication criteria, and CMMC and NIST SP 800-171 include an Awareness and Training family that covers role-based training and insider-threat awareness. The FTC Safeguards Rule and NYDFS Part 500 add training requirements for financial institutions.
Compliance only asks whether training happened. What protects you is whether people recognize and report the attacks aimed at them — business email compromise, invoice and payroll fraud, MFA fatigue, help-desk impersonation, and now voice and video deepfakes of your own executives. A good program targets the roles attackers target, gives people a simple way to report, and measures reporting and risky actions rather than completion alone.
Who asks for it
PCI DSS, SOC 2 and ISO 27001 auditorsCMMC assessors and defense primesCyber insurersHIPAA covered entities and business associatesBoards asking about fraud and phishing exposure
Finance, payroll and executive teams
You are the people attackers impersonate and the people they try to fool: wire transfers, vendor bank-detail changes, gift-card requests and deepfake voice calls. You need training and verification procedures built for exactly those lures.
IT help desks and administrators
Attackers call the help desk posing as employees to reset passwords and enroll new MFA devices. Your staff need identity-verification procedures that hold up against a confident, well-prepared caller.
Organizations facing an audit
PCI DSS, HIPAA, ISO 27001, SOC 2 or CMMC requires documented training, and your current records won’t satisfy an assessor. You need a program with the content, cadence and evidence the framework expects.
Who certifies
No certificate exists. The proof is yours to build.
Formal outcome from
No certificate — the result is a program your people actually use
What they produce
Your own awareness program, training content, simulation results and training records, which auditors and assessors review as evidence
Where readiness fits
Training records and phishing results are evidence inside other audits — PCI DSS, SOC 2, ISO 27001, HIPAA, CMMC — rather than a credential of their own. Readiness gives you a program that produces that evidence and also reduces the risk it exists to address.
NIST SP 800-50 Rev 1 — Building a Cybersecurity and Privacy Learning Program PCI DSS v4.0.1 — Requirement 12.6 HIPAA Security Rule — 45 CFR 164.308(a)(5), security awareness and training ISO/IEC 27001:2022 — Clause 7.3 and Annex A control 6.3 AICPA Trust Services Criteria — CC1.4 and CC2.2 NIST SP 800-171 and CMMC Level 2 — Awareness and Training (AT) family FTC Safeguards Rule — 16 CFR 314.4(e) NYDFS 23 NYCRR Part 500 — Section 500.14
What it covers
What Security awareness readiness covers.
- Awareness program charter, ownership and policy aligned to NIST SP 800-50 Rev 1
- Training needs analysis by role and by risk
- Onboarding security training for new hires and contractors
- Role-based training for developers, administrators, help desk, HR and privileged users
- Executive and finance training on wire fraud, business email compromise and deepfake voice and video lures
- Payment and bank-detail change verification procedures, including callbacks to known numbers
- Help-desk identity verification for password resets and MFA enrollment
- Phishing simulation program design, with reporting and follow-up training
- A simple, consistent way for staff to report suspicious messages and calls
- Acceptable use and policy acknowledgement tracking
- Insider-threat awareness as CMMC and NIST SP 800-171 require
- Behavior metrics: reporting rates, repeat clickers, speed of first report and risky actions
- Training records and evidence organized for auditors and assessors
- Culture: leadership messaging and recognition for people who report
What you receive
What you have in hand when readiness is done.
Awareness program plan
The program’s goals, audiences, topics, cadence, owners and measures, written to satisfy the frameworks you answer to and to address the threats you actually face.
Role-based training matrix
Which roles get which training and why, and how completion and understanding are recorded, from general staff to administrators, developers and executives.
Executive and finance fraud briefing
Training for leaders and finance staff on wire fraud, vendor impersonation and deepfake voice lures, paired with the verification procedures that stop them.
Fraud-resistant procedures
Written procedures for payment changes, urgent transfer requests and help-desk resets that rely on verification through a known channel rather than on someone spotting a fake.
Phishing simulation program
Campaign design and themes tied to the lures your industry sees, a reporting workflow, and follow-up training for people who need it — without public shaming.
Metrics and board reporting
A small set of measures that show behavior change, such as reporting and repeat-click trends, presented in a form leadership and the board can follow.
Policy acknowledgement and training evidence
Records structured the way PCI DSS, HIPAA, ISO 27001, SOC 2 and CMMC assessors expect to see them, so evidence requests are answered from one place.
Common gaps
What a Security awareness readiness review tends to surface.
Better found now, by people on your side, than by your assessor.
Training that is the same for everyone, so the finance team never hears about payment fraud
No defined way to report a suspicious email, so people delete it or forward it to a colleague
Phishing simulations that run but are never followed by targeted training
Payment-change requests approved on the strength of an email or a familiar voice
Help-desk resets authorized with information an attacker can find online
Completion rates reported to the board as if they measured risk
Contractors and new hires who start work before any security training
No role-based training for administrators and privileged users, which CMMC and NIST SP 800-171 require
Where testing fits
The tests Security awareness calls for, from the same team.
Social engineering
Phishing, vishing and pretexting campaigns run by an independent tester show how your people respond to realistic lures and give your awareness program a baseline to measure progress against.
What the test coversPhysical pentest
Physical testing checks whether staff challenge tailgaters, verify visitors and protect their badges — behaviors awareness training teaches but rarely measures.
What the test covers Questions
What buyers ask about Security awareness.
Is annual compliance training enough?
It satisfies the minimum in many frameworks, but it rarely changes behavior. Attackers target specific roles with specific lures, so effective programs add short, frequent, role-relevant content, phishing simulation with follow-up, and procedures that make fraud hard no matter how convincing the lure is.
What should we measure instead of completion?
Measures that reflect behavior: how many people report a simulated phish, how quickly the first report arrives, how many repeat clickers there are and whether that number falls, and whether real suspicious messages get reported. Completion still matters as audit evidence, but reporting is the measure that predicts whether a real attack gets caught early.
How do we protect against deepfake voice and video fraud?
Training helps people know these lures exist, but the real defense is procedural: payment changes and urgent transfers are verified by calling back on a number already on file, by a second approver, or with a pre-agreed phrase — never by trusting the voice or face on the call. Those procedures protect you even when the fake is flawless.
Do phishing simulations damage employee trust?
They can if they are used to catch and shame people. Programs that work treat a click as a teaching moment, praise reporting, avoid lures about bonuses or layoffs that feel like a betrayal, and are announced as part of the program. HR and leadership should agree on the approach before the first campaign goes out.
Which frameworks require security awareness training?
PCI DSS requirement 12.6, the HIPAA Security Rule, ISO/IEC 27001, SOC 2, CMMC and NIST SP 800-171, the FTC Safeguards Rule and NYDFS Part 500 all require it in some form, and cyber insurers ask about it on applications. A single well-designed program can produce the evidence all of them need.
Can we keep the training platform we already have?
Usually, yes. Most programs fall short on design, targeting and measurement rather than on tooling. Readiness work makes better use of the platform you already license and identifies anything it genuinely can’t do, such as role-based tracks or the simulation reporting your auditors need.
Is Security awareness on your desk?
One conversation with someone who does this work. You leave knowing where you likely stand and what readiness would involve for you.