Business
People are not the weakest link. Untrained people are.
Staff who have seen a convincing fake invoice, a "CEO" on WhatsApp asking for gift cards and a call from the "bank" in a safe setting recognise them when they are real. Annual slideshows do not do that; short, regular, realistic simulations with immediate feedback do. We run them, measure what changes, and feed the results back into the scenarios.
- Email, WhatsApp, SMS and voice simulations based on the scams current in India
- Two-minute training moments at the point of failure, and short sessions by role
- Reporting on click, report and response rates over time, by department, without naming and shaming
- Content for finance, HR, leadership, branch staff and new joiners
Priced per employee per year for the simulation programme; one-off sessions priced per session. Combine with our training programmes for role-specific content.
Typical engagement
- Baseline
- Campaigns and training
- Review
- Annual report
Who this is for
- Companies whose cyber insurance, auditor or regulator asks for awareness training evidence
- Finance, HR and admin teams that handle payments, personal data and credentials
- Organisations after a phishing incident or a near miss
- Hospitals, schools and NGOs with staff who were never trained on this
- Companies onboarding many new employees who need a baseline
- Leadership teams who want to know how their organisation would actually respond
What is included
Programme design
A twelve-month plan of simulation campaigns and training moments sized to your organisation, with scenarios drawn from current Indian scams and your own context, such as your vendors, tools and leadership names.
Phishing simulation
Email campaigns at agreed intervals with varying difficulty, landing pages that teach instead of trick, and safe credential-entry detection.
WhatsApp, SMS and voice simulations
Consent-based simulations of CEO impersonation on WhatsApp, fake delivery and KYC SMS, and vishing calls to finance and reception, because that is where attacks now arrive.
Training
Short modules delivered after each campaign, a live session for all staff, and role-specific sessions for finance, HR, IT, branch staff and leadership, in English and Hindi where needed.
Reporting culture
A one-click report button or a simple report address, a promise of no blame for reporting, and feedback to staff who report, which is the metric that matters most.
Measurement
Quarterly reports on click, report and time-to-report rates by department and over time, suitable for the board, auditors and insurers.
How we work
Baseline
An unannounced first campaign and a short survey establish where you start.
Campaigns and training
Monthly or quarterly simulations with training moments, and live sessions scheduled around your calendar.
Review
Quarterly review of results with HR and leadership, and scenario adjustments.
Annual report
A year-on-year comparison and the evidence file for audits and insurance.
What you walk away with
- Fewer clicks and far more reports, measured
- Staff who recognise the current scams, including the ones on WhatsApp and the phone
- Evidence of training for CERT-In, DPDP, ISO 27001, RBI and insurer requirements
- A reporting habit that gives your security team early warning
What we do not do
We would rather lose an enquiry than mislead you.
- We do not run simulations that humiliate staff or use cruel pretexts such as fake bonuses or layoffs
- Awareness reduces but does not eliminate successful phishing; it is one layer alongside technical controls
- We do not share individual results with management without an agreed policy that staff know about
Frequently asked questions
Will staff resent being tested?
Not if it is done openly. We tell staff that simulations will happen, that reporting is rewarded and that results are not used for discipline. Resentment comes from secret tests with punitive follow-up, which also do not work. Engagement improves when people see the real scams they are being prepared for.
How is this different from a video course?
Video courses measure completion. Simulations measure behaviour: whether someone clicks, enters a password, or reports. Short training delivered at the moment of a mistake is remembered; a forty-minute course in January is not. We use both, but the simulation data is what shows change.
Can you train our branch or field staff who do not use email much?
Yes. For branch, retail and field staff the risks are WhatsApp, SMS, phone calls and customers being defrauded in front of them. We use voice and messaging simulations and in-person or video sessions in the language they work in. Our bank and NBFC branch programme is built for this.
Does this satisfy the training requirement in our compliance frameworks?
ISO 27001, SOC 2, PCI DSS, the RBI and SEBI frameworks and cyber-insurance policies all expect periodic awareness training with evidence. The programme produces attendance records, campaign results and content summaries in a form auditors accept. We map the evidence to whichever framework you are working to.
Tell us about your people
Headcount, locations, how much of the workforce uses email, and whether a regulator, insurer or incident is driving this. We reply with a programme outline and price within two working days.