Organizations of every size
Training is in place and there is no evidence it has changed what people do.
Home/Services/Human Risk and Security Awareness
Human Risk and Security Awareness
Reduce the decisions that cause incidents
Most incidents still involve a human decision: a credential entered on a convincing page, a payment approved on a spoofed request, an attachment opened at the wrong moment. We design awareness programs around the behaviors that reduce incidents, test them with realistic simulation, and measure behavior rather than course completion.
Who it is for
Three situations this practice answers
Finance and executive teams
The people with authority to move money or grant access are targeted by name.
Organizations with an evidence obligation
An auditor, a customer, or a regulator asks for awareness evidence that means something.
What it solves
The problems clients bring to this practice
- Course completion is reported as the result, and susceptibility has not changed.
- Simulation is used to catch people out rather than to teach them.
- Executives and finance staff are named targets with no additional protection.
- A fraudulent payment request was approved because the authorization control depended on recognizing a sender.
- Awareness content is identical for engineers, finance, and the board.
What you receive
Named deliverables, not a summary of findings
Every engagement in this practice produces artifacts somebody outside your organization can read and rely on.
- An awareness program built on role-based content and the behaviors that actually reduce incidents.
- Phishing, voice, and text simulation calibrated to real attacker tradecraft, with trend reporting and follow-up that educates rather than punishes.
- Measurement of reporting rate, time to report, and repeat susceptibility, read alongside incident data.
- Footprint reduction, account security, payment authorization controls, and impersonation defense for executives, finance staff, and administrators.
How an engagement works
The sequence, and what each step produces
Described as a sequence rather than a schedule. Duration depends on scope, and is agreed in the statement of work.
01
Target
Identify the decisions that cause incidents in your environment and who makes them.
02
Teach
Deliver role-based content aimed at those decisions rather than at general awareness.
03
Test
Simulate the tradecraft actually used against organizations like yours.
04
Measure
Report reporting rate, time to report, and repeat susceptibility, and adjust the program to them.
Services
3 services in this practice
Each has its own page setting out what it covers, who it is for, and what you receive.
- Security Awareness Program DevelopmentAwareness programs built on the behaviors that reduce incidents, with role-based content and measurement of real behavior rather than completion rates.Human risk
- Phishing and Social Engineering SimulationPhishing, voice, and text simulation calibrated to real attacker tradecraft, with trend reporting and follow-up that educates rather than punishes.Human risk
- Executive and High-Risk Individual ProtectionReduce the exposure of executives, finance staff, and administrators through footprint reduction, account security, payment controls, and impersonation defense.Human risk
Questions
Frequently asked questions
How do you measure awareness effectiveness?
We measure behavior rather than course completion: reporting rates, time to report, repeat susceptibility, and trends across simulation campaigns, alongside incident data showing whether behavior change is reducing real events.
What is executive digital protection?
Executive digital protection reduces the personal digital exposure of executives and other high-risk individuals, including public footprint, personal account security, and impersonation risk, and strengthens the authorization controls that stop fraudulent payment and data requests made in their name.
Related
Practices most often engaged alongside
Product and Application Security
Find what an attacker would find in your product, your APIs, and your cloud, before a customer's security review does.
View practiceCyber Risk and Maturity
Measure maturity against NIST CSF or CIS, quantify exposure in dollars, and know what to fix first.
View practicevCISO and Fractional Leadership
Senior security leadership at the commitment level you need, without a full-time executive hire.
View practiceStart with a confidential conversation
Thirty minutes on where your program stands against this standard, and what would have to be true for the answer to hold up.