Security Awareness Training
Training that changes behavior rather than satisfying a requirement. Locally relevant content, real measurement, and phishing campaigns that do not humiliate anyone.
- Who it is for
- Organizations that need to reduce human-factor risk, satisfy an annual training requirement, or fix an existing program.
- Typical duration
- Annual program · Quarterly campaigns
- Frameworks
- NIST SP 800-50r1SANS Security Awareness Maturity Model
Most awareness programs exist so somebody can tick a box in an audit. A platform with generic videos gets purchased, staff are required to watch them once a year, the attendance record is filed, and behavior does not change at all.
What we do differently
Content with local context. Examples use your systems, your approval workflows, and your actual vendors. A simulated email impersonating your real accounting provider teaches more than ten videos about “phishing in general.” Materials are written in Costa Rican Spanish, not the neutral Spanish that sounds like a dub.
No public humiliation. Anyone who falls for a simulation receives immediate training in the moment — which is when learning sticks — and privately. We never publish lists of who failed. A program that shames staff produces employees who hide their mistakes, which is the exact opposite of what you need during a real incident.
The right metric. Almost everyone measures click rate. We prioritize report rate: what percentage of staff reported the suspicious email through the correct channel. An organization where 40% report a phish within ten minutes is far better protected than one where nobody clicks but nobody says anything either.
Role differentiation. Finance needs training on wire fraud and fraudulent invoices. Engineering needs secrets handling and dependency risk. Senior management is the target of directed attacks and needs its own session. HR receives résumés with attachments all day. Treating them identically wastes everyone’s time.
On blaming the user
There is a common position in this industry that “the human is the weakest link.” We find that a convenient way to shift responsibility. If a single click by a receptionist compromises your entire domain, the architecture problem is more serious than the training problem.
Training reduces risk, which is why we offer it. But we sell it as what it is: a layer of control, not a substitute for technical controls. If the diagnosis shows your investment returns more in segmentation or in phishing-resistant multi-factor authentication, we will tell you.
How we run it
- 01
Baseline diagnosis
An initial phishing campaign and a knowledge assessment to establish where you stand. Without a baseline there is no way to demonstrate improvement.
- 02
Tailored content
Examples built on your systems, your processes, and your vendors. A generic video recorded in another country with another accent does not generate recognition.
- 03
Progressive campaigns
Simulations that start obvious and increase in difficulty as the team improves. The goal is to train people, not to score a high failure rate.
- 04
Continuous reinforcement
Short, frequent modules instead of one annual two-hour session that is forgotten within a week.
- 05
Behavioral measurement
We track report rate, not just click rate. An employee who reports the suspicious email is worth more than one who simply did not open it.
What you receive
- Annual program with content adapted to your operation's real risks
- Simulated phishing campaigns with progressive difficulty
- Role-differentiated training — finance and engineering do not need the same session
- Behavioral metrics, not just attendance records
- Materials in Costa Rican Spanish and in English