Cybersecurity awareness training for employees
The link most exploited in an attack is not technical, it is human. We teach your workforce to recognise the real traces attacks leave by email, phone and messaging — using the same examples we use in our audits.
Why generic awareness training does not change behaviour
The usual format —an annual video, a ten-question quiz and a certificate— ticks the box and changes no behaviour. It fails for three reasons: it uses generic examples nobody recognises as their own, it is delivered by someone who has never seen a real incident, and it concentrates into one session a year instead of repeating in short doses. Awareness training that works explains how an attacker really gets in —by email, by phone, by corporate messaging— with examples the team recognises, and repeats often enough that the habit doesn't fade.
What the session covers
- How an attacker gets in through email, the phone and corporate messaging, with real anonymised examples
- Warning signs any employee can recognise with no prior technical knowledge
- What to do and who to notify when something looks suspicious
- Basic digital hygiene: passwords, MFA, personal devices and use of corporate tools
- Readiness for the ENS (op.per.4) awareness requirement, with documentary evidence for the auditor
- Reusable onboarding material for new joiners
How we prepare the session
- Baseline assessment: We understand the workforce profile, the sector and which incidents or previous findings exist, so the talk isn't generic.
- Material adaptation: We build the examples on your reality: your tools, your workflows and, where available, the anonymised results of a previous phishing simulation.
- Delivery: A roughly 90-minute session, online or on-site, in groups small enough to allow questions.
- Evaluation: We measure comprehension at the close and, where appropriate, with a reinforcement weeks later. A pass rate is not a behaviour change.
- ENS documentation: We deliver attendance record, contents and evaluation in the format an ENS (op.per.4) auditor expects to find.
What the company receives
- A roughly 90-minute awareness session, online or on-site
- Attendance record and evaluation per participant
- Onboarding material for new joiners
- Documentary evidence for ENS or ISO 27001 audits
- Recording of the session, where agreed
When this session fits
- Companies required to evidence awareness training under the ENS, NIS2 or ISO 27001
- Organisations that have just suffered a phishing or social engineering incident and want to close that route
- Companies with high turnover where security onboarding is unresolved
- Companies that have run a phishing simulation and want to train the team on the results
Frequently asked questions about employee awareness training
How much does an awareness session cost?
A roughly 90-minute online session starts from a fixed price per group, with volume discount for several sessions across departments. We give a fixed price before starting, and the first scoping call is free.
Do you run phishing simulations as part of this training?
Phishing simulation is a separate service: it is an offensive exercise that measures real behaviour, not a class. The two complement each other well —the usual sequence is to simulate first to find where the problem is, then train on the results— but they are contracted separately. If what you want is to measure, start with phishing simulations.
Does this count as evidence for the ENS?
Yes. The ENS includes staff awareness and training among its measures (op.per.4), and it is one of the common reasons for contracting this session. We deliver attendance records, contents covered and evaluation in the format an auditor expects to find in the review.
Is the session on-site or online?
Both work well for awareness training; online allows larger groups and several short sessions instead of a single day. We are based in Valencia and travel across Spain if the project requires it.
Related resources
- Cybersecurity awareness training for employees
- Phishing simulations: measure before you train
- ENS compliance
- Training for leadership and boards
- Technical training for development and defence teams