Turn employees into a stronger line of defense

Not on the feature list — every serious platform has templates, videos and a dashboard, and anyone who tells you otherwise is selling. The difference is that this is run rather than rented. It is a twelve-month program on a fixed plan: month one is an unannounced baseline simulation using content written for your company, and each of the eleven months after it pairs one topic with one simulation, with anyone who clicks routed automatically into the matching short video. The expert time is in the fee rather than billed against a project. If your last three pitches were demonstrations of a console, this is the part that comes after somebody has bought the console.

That describes the Managed option. If you would rather run the console yourself, the Platform option gives you the same tool with our training, our support and our content behind it.

You do, and you are right to ask how wide it is. The correct mechanism is Microsoft’s advanced delivery policy for phishing simulations: it names our sending domains, our sending addresses and our simulation URLs, applies only to simulation traffic, and leaves those messages visible in your own reporting rather than hiding them. Wider options exist — tenant-wide safe-sender entries and spoof-intelligence exceptions — and they are quicker to configure, which is exactly why we would rather work through this with your mail team than send them a list to paste. If your team pushes back on a blanket exception, they are doing their job, and the narrow configuration is the one we would propose anyway.

Results are recorded against the named person — that is what makes the program measurable, and it is also the thing to put in front of your works council before you start rather than after. Each person carries a score across simulations, training and reporting, with the trend over time, and results can be broken out by team and department. The data is yours: we process it on your instructions under the agreement, and how it is used inside your organization is your decision and your policy to write. What we will say from running these programs is that the ones used punitively stop working within two cycles — people quietly stop reporting, and the reporting rate is the number actually worth having.

English, German and Hungarian are the three we deliver as standard in this region, and the catalog goes well beyond them — Spanish, French, Arabic and more — so a workforce spread across several countries can be covered from one platform.

Each person receives campaigns and assigned training in their own preferred language automatically, and the quizzes and certificates follow the same language. A Hungarian employee gets the same course as a German or a Spanish one, in their own language, rather than an English video with subtitles.

Running the program is ours: the plan, the simulations, the content scheduling and the reporting come from us, with expert hours included in the fee rather than metered against a project. Yours is the setup — the mail-filter configuration above, the directory connection, and deploying the report button — and after that, reading the monthly report and deciding what to do about what it shows. We do not have an honest hours-per-month figure for your side of it, and would rather scope that with you than quote a number we made up.

Entra ID, synchronized automatically every day, so joiners and leavers look after themselves — you pick the groups or organizational units and the platform keeps them current. Manual entry, CSV import and LDAP are available as well. Google Workspace is supported for the report button but not for directory synchronization, so a Google organization keeps its user list current another way. Worth knowing before your security team asks: the Entra integration is an app registration with admin consent, and the permissions it requests include tenant-wide mailbox read and write, which is what allows a reported phishing email to be pulled out of everyone’s inbox.

Two different documents, and the platform produces both. The board gets a management report — short, shaped by you, covering what was sent, how many people were caught and how training completion is going, with the trend behind it. The auditor gets the export: named person, named training, date sent, date completed, quiz result against a pass threshold, and policy-acceptance records, as CSV or Excel. For NIS2 or ISO 27001 it is the second one that counts, because it evidences that a specific person completed specific training on a specific date rather than that a program exists.

We can tell you exactly how it is measured, and we will not overclaim the result. Month one is an unannounced simulation before any training has been delivered, which sets your baseline; the eleven months after it measure the same population the same way, so the comparison is against your own starting point rather than against an industry figure nobody can check. Each person is scored across clicking, training and reporting, and the trend is visible across campaigns. What we will not do is show you a before-and-after percentage from a vendor deck — the ones in circulation have no baseline value, no sample size and no definition of what was measured.

It depends on one thing: whether anybody in your organization will own the program week to week. If you have a security or IT person who wants to choose the scenarios, schedule the campaigns and read the results, the Platform option gives them the full tool, training on how to use it, our support, and new content as we produce it.

If nobody has that time — and in most mid-sized companies nobody does — the Managed option puts the planning, the campaigns and the monthly reporting with us. You can start on one and move to the other at renewal, so this is not a decision you have to get right now.

Yes. Besides email, the platform runs SMS (smishing), phone (vishing), automated voice-response (IVR) and USB-drop simulations.

Voice and SMS campaigns are set up and run by our team for each engagement rather than self-service, because the call scripts and the sender numbers have to be agreed with you — and, where you have one, with your works council — before anything goes out. They are scoped and priced separately from the per-employee fee.

Headcount and term. It is priced per employee for a twelve-month period, with a block of expert hours included in the fee and further consulting available separately if you want it. The term renews unless you give notice, and next year’s rates are published to you before the notice window closes — so a renewal is never something you find out about afterwards.