Turn employees into a stronger line of defense

Not on the feature list — every serious platform has templates, videos and a dashboard, and anyone who tells you otherwise is selling. The difference is that this is run rather than rented. It is a twelve-month programme on a fixed plan: month one is an unannounced baseline simulation using content written for your company, and each of the eleven months after it pairs one topic with one simulation, with anyone who clicks routed automatically into the matching short video. The expert time is in the fee rather than billed against a project. If your last three pitches were demonstrations of a console, this is the part that comes after somebody has bought the console.

You do, and you are right to ask how wide it is. The correct mechanism is Microsoft’s advanced delivery policy for phishing simulations: it names our sending domains, our sending addresses and our simulation URLs, applies only to simulation traffic, and leaves those messages visible in your own reporting rather than hiding them. Wider options exist — tenant-wide safe-sender entries and spoof-intelligence exceptions — and they are quicker to configure, which is exactly why we would rather work through this with your mail team than send them a list to paste. If your team pushes back on a blanket exception, they are doing their job, and the narrow configuration is the one we would propose anyway.

Results are recorded against the named person — that is what makes the programme measurable, and it is also the thing to put in front of your works council before you start rather than after. Each person carries a score across simulations, training and reporting, with the trend over time, and results can be broken out by team and department. The data is yours: we process it on your instructions under the agreement, and how it is used inside your organisation is your decision and your policy to write. What we will say from running these programmes is that the ones used punitively stop working within two cycles — people quietly stop reporting, and the reporting rate is the number actually worth having.

All three, and the Hungarian is ours. The platform’s own catalogue runs to nine languages, German among them, and Hungarian is not one of them — so we translated the same video content ourselves and integrated it into the platform, because our clients need it. A Hungarian employee gets the same course as a German one, in their own language, rather than an English video with subtitles or a machine translation.

Running the programme is ours: the plan, the simulations, the content scheduling and the reporting come from us, with expert hours included in the fee rather than metered against a project. Yours is the setup — the mail-filter configuration above, the directory connection, and deploying the report button — and after that, reading the monthly report and deciding what to do about what it shows. We do not have an honest hours-per-month figure for your side of it, and would rather scope that with you than quote a number we made up.

Entra ID, synchronised automatically every day, so joiners and leavers look after themselves — you pick the groups or organisational units and the platform keeps them current. Manual entry, CSV import and LDAP are available as well. Google Workspace is supported for the report button but not for directory synchronisation, so a Google organisation keeps its user list current another way. Worth knowing before your security team asks: the Entra integration is an app registration with admin consent, and the permissions it requests include tenant-wide mailbox read and write, which is what allows a reported phishing email to be pulled out of everyone’s inbox.

Two different documents, and the platform produces both. The board gets a management report — short, shaped by you, covering what was sent, how many people were caught and how training completion is going, with the trend behind it. The auditor gets the export: named person, named training, date sent, date completed, quiz result against a pass threshold, and policy-acceptance records, as CSV or Excel. For NIS2 or ISO 27001 it is the second one that counts, because it evidences that a specific person completed specific training on a specific date rather than that a programme exists.

We can tell you exactly how it is measured, and we will not overclaim the result. Month one is an unannounced simulation before any training has been delivered, which sets your baseline; the eleven months after it measure the same population the same way, so the comparison is against your own starting point rather than against an industry figure nobody can check. Each person is scored across clicking, training and reporting, and the trend is visible across campaigns. What we will not do is show you a before-and-after percentage from a vendor deck — the ones in circulation have no baseline value, no sample size and no definition of what was measured.

If it was one of our simulations, they are credited for it and it raises their reporting score — which is the behaviour the whole programme is trying to produce. If it was a real email, it goes into the investigation platform: rule-based checks first, then the links and attachments against a set of reputation sources, then the headers — SPF, DKIM, DMARC, the Received chain — and the reputation of the sending domain and mail server. A person makes the final call, and the resulting action is applied across every mailbox that received it: find, delete, quarantine, or move. The person who reported it is told what happened, in their own language.

Headcount and term. It is priced per employee for a twelve-month period, with a block of expert hours included in the fee and further consulting available separately if you want it. The term renews unless you give notice, and next year’s rates are published to you before the notice window closes — so a renewal is never something you find out about afterwards.