A 60‑person firm builds its first security awareness program: a baseline phishing test, monthly micro-training and a report button
An engineering and design firm of about 60 staff in one office with a few remote workers, a leader in its segment.
- Scale
- ~60 staff, 1 Microsoft 365 tenant, 1 report button, 6 monthly simulations, 3 role groups
- Engagement
- 6 months, with a baseline test in week 2 and a short lesson and simulation every month
The challenge
The firm had never trained its staff on phishing. It had a spam filter and multi-factor sign-in, but a project manager had already approved a fake invoice from a supplier whose mailbox had been taken over, and the firm's cyber insurance renewal asked about security training. The owners had no idea whether the staff would spot a bad message, and nobody knew who to tell when one arrived.
What our team delivered
- A baseline phishing simulation in week 2, sent to everyone without warning and without a lesson first, so the firm had a true starting click rate and report rate. The simulation used a common theme, a shared-document notice, and the results were shown to leadership as numbers, not names
- A one-click report button added to Outlook on every device through the Microsoft 365 admin center, routed to a shared mailbox that the IT team watches, with a promise that every report gets a human answer the same day, including when the message turns out to be harmless
- Monthly micro-training of about five minutes: one attack per month, such as invoice fraud, a fake MFA prompt, a QR code in an email, a text from the CEO or a shared-file link from a known contact, each with one thing to do next time
- Monthly simulations that follow the lesson and rotate the theme, with an immediate short explanation shown to anyone who clicks. Staff who click twice get a short conversation, not a penalty; a no-blame rule was announced by the owners before the first test
- Three role groups: finance and project managers received extra lessons on bank-detail changes and a callback rule, the front desk on delivery and visitor scams, and everyone else on the common patterns
- A one-page reporting guide, a monthly results note to all staff and a quarterly summary for the owners that the firm can hand to its insurer
Result
In this modeled program the click rate on simulated phishing fell from about 31 percent at the baseline to about 9 percent after six months, and the report rate rose from about 6 percent to about 47 percent. Two real suspicious messages were reported within minutes in the last two months. The figures are illustrative, not a guarantee; results depend on how steadily the simulations and coaching continue, and a simulation click rate is not the same as the real-world risk.
Get this for your company
Related services with fixed prices and a written scope.
Insurance-ready bundle
The three things cyber insurers and clients ask for most: an external assessment, a phishing simulation for 25 users and a disaster recovery plan.
Assessment report in 5 business days; plan draft in 15 business days
$5,400 per bundle, phishing simulation for 25 users
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Show 5 more
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Phishing simulation
A realistic, authorized phishing campaign with short training for anyone who clicks. Priced per person.
Campaign launches within 5 business days of approval
$12 per user, per campaign
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Email security with AI detection and DLP
Inbound and outbound protection: phishing, malware and impersonation caught by AI detection, with data loss prevention for what leaves.
Live within 7 business days
$7 per mailbox, per month
Compromised-mailbox monitoring and alerts
We watch each mailbox for signs of takeover, such as odd logins, forwarding rules and mass sending, and alert you fast.
Live within 5 business days
$4 per mailbox, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Five million events, three escalations
What a managed SOC does to a day of log volume for a 250‑seat organisation. Collection produces millions of events; correlation rules turn them into a thousand or so alerts; triage merges and dismisses most of those into dozens of incidents; only a few need a human on the customer side. Bar length is the logarithm of the count, so each step is orders of magnitude. Illustrative figures.
Mail that keeps flowing
Incoming mail is authenticated and scanned before it reaches anyone, mailboxes are copied across three regions so a server failure goes unnoticed, and outgoing mail leaves signed and encrypted.
Payment-change callback flow
A request to change bank details is never acted on from the request itself. Someone rings the number already on file, a second person approves, the outcome is written down, and only then is the payment released or held. If any step fails, the old details stay in use.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.