Your People. Your First Line of Defence.
Cyber awareness and training that changes what people do, not just what they have been told.
Your people are your first line of defence
Your people are your first line of defence, whether they realise it or not.
They are also the way in. Every employee has access to something an attacker wants: an email account, files, approvals, payment authority, or a login that leads somewhere else. It is cheaper and faster for an attacker to persuade a person than to defeat a well-defended system, so people are targeted first. This is rarely about carelessness.
It is usually a plausible request landing on a busy person at the wrong moment.
The human element is involved in around 60% of breaches (Verizon DBIR 2025), and stolen or misused credentials are among the most common ways in.
What actually shapes your exposure
What your employees click, how they interact with AI tools, what they post on social media, whether they share passwords, and how casually they handle confidential information all shape your actual risk exposure. Each of these deserves a closer look:
- What they click. Phishing emails and fake login pages remain the most common route to stolen credentials, and they now arrive by text message, QR code and messaging apps as well. Prompts to approve a login can be spammed until someone taps “yes” just to make them stop.
- How they use AI tools. Confidential information pasted into unapproved tools, AI output trusted without checking, and documents or web pages carrying hidden instructions that an AI assistant then acts on.
- What they post on social media. Job titles, reporting lines, projects, travel and photos of badges or screens give attackers everything they need to write a convincing, targeted message or impersonate a colleague.
- Whether they share passwords. Shared accounts, reused passwords and passwords written down make one stolen credential open many doors, and they remove any way of knowing who did what.
- How casually they handle confidential information. Misdirected emails, files sent to personal accounts, unlocked screens, conversations in public places, and unencrypted USB drives. Under POPIA and GDPR, personal information handled carelessly is your responsibility.
Threats are getting harder to spot
Threats are getting harder to spot, and human behaviour remains one of the biggest variables in whether an attack succeeds.
The old advice to look for spelling mistakes and awkward wording no longer works. AI writes fluent, personalised messages at scale. Cloned voices and deepfake video are used to impersonate executives and suppliers and to push through urgent payments. Attacks now combine channels, with an email followed by a text and then a phone call, each reinforcing the last. Real-time phishing kits can capture the code from a second-factor login as it is typed.
People cannot be expected to spot everything. What they need is a small number of dependable habits: pause when something is urgent or unusual, verify through a separate channel, and report quickly when in doubt.
Why the annual tick-box course does not work
Most organisations do have training. It usually fails in the same ways:
- It happens once a year. People forget most of it within weeks, long before the next attack arrives.
- It is generic. The same content goes to the finance team, the executive assistant, the developer and the receptionist, though their risks differ, and it uses examples from other companies.
- It measures completion, not behaviour. A 100% completion rate says nothing about whether anyone would spot a fake invoice or report a suspicious call.
- It relies on blame. If people fear being embarrassed for making a mistake, they stay quiet, and the business learns about the problem last.
Human resilience is different. It means people who can recognise a threat, resist it, report it quickly, and recover when something gets through. It is built through short, regular, relevant practice, in a culture where reporting is welcomed.
How We Can Help
We help turn your people into your human firewall — through practical, ongoing awareness and training built around how your team actually works, not a generic annual tick-box course. Here is how that works and what you receive at each stage.
1. Understand how your people really work
We start with your business, not a course catalogue. We look at who has access to what, how money and information really move, and where your people are most likely to be targeted. We’ll provide a baseline of current awareness and behaviour, review your existing training and reporting process, and short list the behaviours that matter most in your business.
2. Design a programme around your team
The programme is tailored to your tools, your processes and your calendar. It uses your own examples, such as how supplier invoices are approved, how new starters get access and which systems staff use every day. We’ll provide a 12-month awareness plan with themes and activities through the year, with role-based learning paths for the groups identified in Stage 1 above. We prefer to use scenarios from your own environment. In addition you’ll receive a new-joiner induction module, so your people are covered from their first week.
| Example rhythm | Example Theme | Typical activities |
| Quarter 1 | Phishing and impersonation | Short module, baseline simulation, one-page guide on how to report |
| Quarter 2 | Passwords, MFA and accounts | Module for all staff, password manager guidance, executive briefing |
| Quarter 3 | AI tools and confidential information | Module aligned to your AI policy, data-handling scenarios, manager talking points |
| Quarter 4 | Payment fraud and year-end pressure | Finance workshop, deepfake and voice-clone awareness, verification drill |
This is an example only. The final calendar is set around your business cycles, your specific risks and your appetite for change.
3. Cover the threats people now face
We make sure content keeps pace with the way attacks actually work today – the ’emerging threats’ – not how they worked five years ago.
4. Practise, not just read
People learn most from realistic practice. We run simulations and exercises that are proportionate, well prepared and never designed to embarrass anyone. Our tone of presentation is supportive, not authoritative.
We can provide tabletop exercises for executives, for example deepfake payment requests or compromised email accounts, and many more.
Results are reported by group, not by named individual, unless you decide otherwise.
5. Make reporting easy and build the culture
The most valuable behaviour is fast reporting. A report within minutes can turn a serious incident into a minor one, provided people are confident that reporting is welcome. A simple “report it” process, and a one-page guide that tells staff exactly what to do and who to tell. A no-blame reporting message, agreed with leadership, and guidance for managers on how to respond when someone reports a mistake.
6. Measure behaviour and keep improving
We measure what changes, not who finished a course. The results guide what we focus on next and give you evidence for those who ask.
7. Choose how it is delivered
You can run the programme yourselves using our design and coaching, or have us run it for you.
You receive
- If you run it: the complete programme pack, a handover session and periodic reviews with us
- If we run it: scheduling, delivery, simulations, reporting and regular check-ins, with a named contact
- Either way: live sessions and workshops for executives, finance and new joiners, as needed
Curious how your people would handle a real attempt today?
Start with a no obligation conversation. We’ll show you where your human exposure is greatest and what would make the biggest difference first.