What staff learn
Training focuses on the scams your team will actually see:
- Phishing emails that impersonate vendors, banks and coworkers.
- Fake login pages that steal Microsoft 365 passwords.
- Payment and invoice fraud, including changed bank details and urgent wire requests.
- Passwords and MFA: why they matter and how to use them without friction.
- Reporting: what to do the moment something feels wrong.
Lessons are short, plain and practical. Nobody needs a technical background to follow them.
Phishing practice
Realistic practice emails arrive in staff inboxes from time to time, built around the same tricks criminals use. When someone clicks, they see a short explanation of the signs they missed. Over months, click rates drop and reporting rates rise, which is exactly the habit you want.
Training for regulated offices
Medical and dental practices need documented HIPAA compliance training for staff. We provide it, track completion and keep the records ready for your compliance files. Accounting firms and defense suppliers get training that maps to the FTC Safeguards Rule and CMMC expectations.
Reporting that helps
You get clear reports: who completed training, who needs a refresher and how the team is trending. Reports are written for owners and office managers, not security specialists, and we walk through them at business reviews.
Part of managed IT
Training is delivered as part of managed IT, alongside the email filtering and monitoring that catch what people miss. Read about our wider cybersecurity services.
What a training program looks like over a year
Good training is a habit, not an annual event. New staff complete a short introduction in their first week, covering passwords, MFA prompts, phishing and how to report something odd. After that, everyone gets a brief lesson each month, often only a few minutes long, on a topic that matches what attackers are doing now: fake invoices, QR code phishing, text message scams, fake login pages or callback scams that ask people to phone a “support” number.
Simulated phishing emails go out on an irregular schedule so people cannot guess when the next one is coming. Results feed back into the lessons, so a team that keeps clicking on fake shipping notices gets more practice on exactly that.
Phishing tests done fairly
The point of a simulation is to build instinct, not to embarrass anyone. When someone clicks, they see a short explanation of the clues they missed, right at the moment it is most useful. Managers see trends, not a wall of shame. We avoid tests that would damage trust, such as fake bonus or layoff announcements, and we design the difficulty to rise gradually as the team improves.
Records for insurers and auditors
Cyber insurers, HIPAA, the FTC Safeguards Rule and CMMC all expect security training, and they increasingly ask for proof. Each lesson and simulation is recorded, so you can show who completed what and when, along with click and report rates over time. Those records answer the training questions on an insurance application and give an auditor something concrete to review. See our guide to cyber insurance security requirements.
Building a culture where people report
The best outcome of training is a team that reports suspicious messages quickly, including the ones they clicked. We make reporting a single button in Outlook, thank people who use it and treat a report as a win, even after a click. A fast report lets us contain a real attack before it spreads.
Topics that matter right now
Attacks change, so lessons do too. Current topics include MFA fatigue, where an attacker floods someone with sign-in prompts hoping they approve one; QR codes in emails and on posters that lead to fake login pages; text message and voice scams that follow up on a phishing email; and AI-generated voice or video that imitates an executive asking for an urgent payment. Each lesson ends with one simple habit people can use, such as hanging up and calling back on a known number.
Getting started
We start with a baseline phishing test so you can see where the team stands, then enroll everyone in the program. Managers get a short briefing on how the program works and what they will see, and your first report shows progress against that baseline. Over the following months the reports show whether clicks are falling and reports are rising, and the training records start building from the very first lesson.
Where we work
We train teams in 20 major US cities and other US cities. Everything runs online, so remote and hybrid staff get the same program.
Sources