Cybersecurity awareness training for employees
The link most exploited in an attack is not technical, it is human. We teach your workforce to recognize the real traces attacks leave by email, phone and messaging — using the same examples we use in our audits.
Last updated:
Scope your project · Request an awareness session
Rather talk it through? Call us at +34 960 730 013
Why generic awareness training does not change behavior
The usual format — an annual video, a ten-question quiz and a certificate — ticks the box and changes no behavior. It fails for three reasons: it uses generic examples nobody recognizes as their own, it is delivered by someone who has never seen a real incident, and it is crammed into a single session a year instead of being repeated in short doses. Awareness training that works explains how an attacker really gets in — by email, by phone, by corporate messaging — with examples the team recognizes, and repeats often enough that the habit doesn't fade.
What the session covers
- How an attacker gets in through email, the phone and corporate messaging, with real anonymized examples
- Warning signs any employee can recognize with no prior technical knowledge
- What to do and who to notify when something looks suspicious
- Basic digital hygiene: passwords, MFA, personal devices and use of corporate tools
- Readiness for the ENS awareness and training measures (mp.per.3 and mp.per.4), with documentary evidence for the auditor
- Reusable onboarding material for new hires
How we prepare the session
- Baseline assessment: We understand the workforce profile, the sector and which incidents or previous findings exist, so the talk isn't generic.
- Material adaptation: We build the examples on your reality: your tools, your workflows and, where available, the anonymized results of a previous phishing simulation.
- Delivery: A roughly 90-minute session, online or on-site, in groups small enough to allow questions.
- Evaluation: We measure comprehension at the close and, where appropriate, with a reinforcement weeks later. A pass rate is not a behavior change.
- ENS documentation: We deliver attendance records, contents and evaluation in the format an ENS (mp.per.3 and mp.per.4) auditor expects to find.
What the company receives
- A roughly 90-minute awareness session, online or on-site
- Attendance record and evaluation per participant
- Onboarding material for new hires
- Documentary evidence for ENS or ISO 27001 audits
- Recording of the session, where agreed
When this session fits
- Companies required to demonstrate awareness training under the ENS, NIS2 or ISO 27001
- Organizations that have just suffered a phishing or social engineering incident and want to make sure it does not happen again
- Companies with high turnover where security onboarding is unresolved
- Companies that have run a phishing simulation and want to train the team on the results
Frequently asked questions about employee awareness training
How much does an awareness session cost?
A roughly 90-minute online session starts from a fixed price per group, with a volume discount for several sessions across departments. We give a fixed price before starting, and the first scoping call is free.
Do you run phishing simulations as part of this training?
Not within the session: simulation is a separate service. Our phishing simulation platform runs automated campaigns all year from Office 365, enrolls new hires on its own and assigns micro-courses to anyone who clicks; this session is live training. They work well together: the session explains the warning signs and the platform practises them throughout the year. They are booked separately.
Does this count as evidence for the ENS?
Yes. The ENS includes staff awareness (mp.per.3) and training (mp.per.4) among its measures, and it is one of the most common reasons companies book this session. We deliver attendance records, contents covered and evaluation in the format an auditor expects to find in the review.
Is the session on-site or online?
Both work well for awareness training; online allows larger groups and several short sessions instead of a single day. We are based in Valencia and travel across Spain if the project requires it.
Related resources
- Cybersecurity awareness training for employees
- What to do if an employee falls for phishing
- Quishing: phishing with QR codes
- Vishing and voice deepfakes
- Phishing simulations: measure before you train
- ENS compliance
- Training for leadership and boards
- Technical training for development and defense teams
Sources
Ready to protect your business?
Answer the scoping form at your own pace and we'll use it to prepare your proposal. If you'd rather talk first, book a free 30-minute call.