Security Awareness Training

Delivery is a mix rather than one long course. Short modules go to your learning platform for people to take around their work, live sessions and workshops run for the teams carrying the most risk, and the executive team gets its own briefing pitched at decisions rather than mechanics. The mix, the running order and the length of each element are agreed during the needs assessment, because a support shift and a development team cannot absorb the same format. What we will not do is ship one long annual video for the whole company to click through, which records completion and teaches nothing. Two limits are worth naming up front: publishing modules assumes you have a learning platform we can load content into, and live sessions need protected calendar time from the teams involved. Where neither is available, delivery reduces to workshops on the dates you can actually hold.

Staff are grouped into audiences by the risk their role carries, and each audience gets content built for it. During the needs assessment we sort people by what they can cause or prevent: finance approves payments and changes bank details, developers write and deploy code, executives are the targets of the most researched lures, and front-line staff handle customer data and inbound contact. Each group gets modules written for its own work, with scenarios drawn from incidents in your sector rather than a generic library. New joiners matter as much as anyone, so onboarding content is refreshed as part of the reinforcement phase instead of being left to drift. You supply the headcount, the team structure and someone who can say which roles touch sensitive data; we do not read that out of your HR system. Audiences carrying less risk get a shorter path, not a longer one.

Relevance comes from your own incident history and your own regulatory obligations. The needs assessment reads your past incidents and near misses for recurring themes, and the curriculum is built from scenarios in your sector rather than imported examples that mean little to an Indian finance or support team. Training needs are mapped to the compliance obligations you actually carry, which for most Indian organisations now includes the DPDP Act, so the data handling content reflects duties your staff really have rather than a foreign statute. Language is reviewed with a non-technical reader before release. The reinforcement phase then sends short reminders tied to threats current at the time, so the material does not quietly age into last year's lures. Our offices are in Kanpur and Greater Noida West, so sessions run in your working hours. What we cannot do is refresh content for a change you have not told us about.

Retention is measured on three levels, and completion is the weakest of them. Knowledge is assessed before and after each module, so the report shows movement rather than a bare score with nothing to compare it against. Behaviour is read from your phishing reporting data, comparing report rates against who completed which module, which is the closest honest proxy for whether a lesson survived contact with a real inbox. Feedback is collected on what people found useful, because content that everyone passes and nobody rates is usually content that was too easy. Those three go into the Awareness Measurement Report, packaged in the form auditors ask for, so the same evidence serves your training obligation and your audit. The limit is data: behaviour measurement needs simulation or reporting figures to sit beside completion records. Without them we can show understanding, but not behaviour change.

The two measure each other. Awareness training supplies the teaching, and phishing simulations supply the evidence that it took. Simulations produce click and report rates by team, and the measurement phase of this engagement sets those rates against training completion, which is what turns a completion percentage into a statement about behaviour. It works in the other direction too: when a simulation shows one audience falling for a particular pretext, that pretext becomes curriculum content and a refresher for that group rather than a general reminder to everybody. Phishing Simulations is a separate service in the same practice area, with its own scope and its own fixed price, so either can run alone. Training by itself still measures understanding, and simulations by themselves still show behaviour. A 30 to 45 minute scoping call covers both, and the written scope comes back with a timeline and a price.