Annual training creates a record. This changes behaviour.
A once-a-year course produces a compliance tick and very little else. Continuous simulation with immediate, short remediation actually changes what people do, because the correction arrives while the mistake is still fresh. That is why this runs as an ongoing program rather than a course.
What you get
- Continuous phishing simulation — campaigns at varied difficulty, using templates matched to threats actually seen in your sector.
- Micro-training on click — anyone who clicks receives a short, specific module within minutes, not an hour-long course months later.
- Risk scoring by user and department — a maintained score so you can see where exposure concentrates.
- Onboarding and offboarding sync — new starters enrolled automatically, leavers removed, so the program does not drift out of date.
- Monthly board-ready report — one page a non-technical board can read, plus the underlying detail.
- Quarterly program review — what is improving, what is not, and what changes next quarter.
The metrics that matter
- Reporting rate — the share of simulated phish reported through the proper channel. This is the metric worth optimising: a workforce that reports is an early warning system.
- Time to first report — how fast the first person raises the alarm. Minutes matter in a real campaign.
- Repeat click rate — the people clicking more than once, where targeted support is worth spending.
- Click rate — useful, but the least useful of the four alone, and easily gamed by making lures easier.
Program cadence
- Month 1 — unannounced baseline simulation. No training assigned, no names published. This is measurement, not intervention.
- Months 2–3 — simulation cadence begins with immediate micro-training on click. Difficulty stays moderate.
- Months 4–6 — difficulty escalates; targeted and pretext-based lures introduced. Reporting rate becomes the headline metric.
- Ongoing — continuous mixed-difficulty campaigns, quarterly reviews, annual template refresh.
Decide this before launch
Agree with HR and leadership how results will be used. Programs framed as catching people out produce under-reporting; programs framed as reducing risk together produce reporting. That framing changes the outcome more than template quality does — so it is the first conversation at kickoff, not an afterthought.
What is not included
- Disciplinary process or HR action arising from results — that is yours.
- Technical email security controls. Simulation tests people; filtering protects systems. They are complementary, not substitutes.
- Compliance certification or attestation that training obligations are met.
- Custom video production or bespoke course authoring beyond the supplied library.
Billed monthly. No minimum term. Cancel any time before your next renewal date.