The human is the firewall.
Train them like one.
Phishing simulations, security awareness training, and AI-aware modules. Deepfake CEO calls, AI-generated phishing, ChatGPT data leakage. Delivered as a per-user subscription. The reporting cyber-insurance carriers now ask for. The artifacts auditors expect. Not a one-time annual video.
Pairs with Cybersecurity (the technical controls) and Compliance (the framework attestation). Security awareness training is the third leg of a credible posture, and the one most SMBs treat as a checkbox.
The annual training video is dead. Auditors and carriers killed it.
Four 2024–2026 shifts that turned security awareness training from “nice to have” into a hard requirement for cyber insurance, regulator exams, and enterprise B2B contracts.
Cyber-insurance carriers now demand evidence
Beazley, Coalition, Travelers, Chubb. Every renewal questionnaire now asks “documented quarterly security awareness training program with phishing simulation results.” Self-attesting “yes” without artifacts is how claims get denied later. We produce the documentation that survives a claim investigation.
AI changed the attack surface
Deepfake CEO voice calls. AI-generated phishing emails with perfect grammar and personalized hooks. ChatGPT leaks where employees paste client data into public AIs. The old “watch for typos” training is laughably obsolete. Our modules teach 2026 attacker tactics, not 2018 ones.
Regulators expect documented programs
HIPAA Security Rule requires ongoing security awareness training. PCI-DSS 4.0 mandates documented annual training plus phishing testing. SOC 2 auditors sample-pull training completion records. CMMC Level 2 requires evidence of role-based security training. We produce the evidence in the format each framework wants.
Enterprise customers won’t sign without it
Selling to a Fortune 500 prospect? Their vendor risk team will ask for your training program documentation, phishing simulation results from the last 12 months, and your incident-reporting process. “We tell people to be careful” is not an answer. Real programs unlock real contracts.
Four training disciplines, one human-layer program
Every tier includes all four disciplines. The difference between tiers is frequency, depth, and how much of the program management we run for you.
Phishing simulations
Monthly or quarterly simulated phishing campaigns. Industry-tailored templates (bank lookalikes, M365 alerts, vendor invoices, CEO impersonation). Click-rate tracking by user, by department. Failure → immediate just-in-time micro-training, not punishment.
Security awareness training modules
Short (8–12 min) computer-based training modules. Password hygiene, MFA, social engineering, physical security, mobile device safety, work-from-home rules. New-hire onboarding sequence plus annual refreshers. Tracked completion records ready for audit pulls.
AI-aware modules
Deepfake voice/video attacks (CEO impersonation, vendor wire fraud). AI-generated phishing (perfect grammar, personalized context). ChatGPT & LLM data leakage rules. Prompt-injection awareness for client-facing teams. The modules most SMB training programs don’t have yet.
Carrier + auditor reporting
Monthly executive reports: click-rate trend, training completion percentage, departments needing attention, year-over-year improvement. Audit-ready evidence packs aligned to HIPAA, PCI, SOC 2, NIST CSF, CMMC. Cyber-insurance renewal evidence pre-formatted for Beazley, Coalition, Travelers, Chubb.
We train the humans. We do not replace the technical controls.
Security training is one leg of a three-legged stool. The other two. Technical controls and incident response. Live in other products. Training alone won’t pass an audit or stop a breach. Pair with Cybersecurity + Compliance for the full posture.
- • Email security tooling (Avanan, Proofpoint)
- • Endpoint detection & response (EDR)
- • MFA / Conditional Access implementation
- • DLP / data loss prevention
- • SOC monitoring
- • When phishing succeeds (account compromise)
- • Ransomware response
- • Forensics or breach investigation
- • Insurance claim assistance
- • Legal/regulatory breach notification
- • vCISO-level cyber strategy
- • Risk register maintenance
- • Board-level cyber reporting
- • Policy authoring (beyond training scope)
- • Vendor security assessments
- • SOC 2 / HIPAA / PCI audit (we are not auditors)
- • Compliance program implementation
- • Penetration testing
- • Red-team exercises
- • Tabletop exercise facilitation
Training is the "people" layer. Cybersecurity service is the "controls" layer. Compliance is the "documentation" layer. vCISO is the "strategy" layer. Most clients need at least two; many need all four.
Three tiers. Per user, per month. Same scope, different cadence.
All tiers include every discipline (phishing sims, awareness modules, AI-aware modules, reporting). The difference is how often, how deep, and how much of the program management we run.
- Quarterly phishing simulations (4/year)
- Annual security awareness training (8–12 min modules)
- 1 AI-aware module per year
- Quarterly executive report (PDF)
- Tracked completion records for audit pulls
- Client portal access to all reports
- Monthly phishing simulations (12/year, industry-tailored)
- Quarterly awareness training modules (4/year)
- 4 AI-aware modules per year (deepfake, AI phishing, LLM leakage, prompt injection)
- Monthly executive report + year-over-year trends
- Cyber-insurance attestation evidence pack pre-formatted
- Just-in-time micro-training on phishing failure (immediate, not punishment)
- Everything in Training Pro
- We run the program. You don’t pick templates or schedule campaigns
- Quarterly leadership briefing (executive readout)
- Departmental remediation plans for high-click-rate teams
- Integration with cyber-insurance renewal cycle (we file the evidence)
- Custom modules for your line-of-business apps if needed
- Named program manager assigned to your account
All tiers month-to-month with 30 days’ notice. 1-year and 3-year terms available with locked-in pricing. Existing Cybersecurity service clients on Plan 6 or higher get 25% off the first 6 months of any Training tier. Inventive Prime clients get Training Lite included free; Pro and Managed available at 15% off.
Industry-tailored templates, not generic Outlook spam tests
Phishing simulations and AI-aware modules are designed around the apps and attack patterns your industry actually faces.
Straight answers, no compliance-checkbox theater
What platform do you use? KnowBe4, Hoxhunt, Proofpoint?
KnowBe4 for the foundation (industry-leading library, strong phishing platform, audit-ready reporting). We layer custom AI-aware modules on top because the off-the-shelf platforms haven’t caught up to 2026 attack patterns yet. The Managed tier includes additional custom modules built for your specific line-of-business apps.
How do you handle the “punishment vs. learning” tension?
Failure triggers immediate just-in-time micro-training (60-second video on what they should have spotted), not punishment. Repeat failures get flagged for a 1:1 conversation with their manager and additional training. Termination decisions are yours. We never recommend firing for a phishing failure. The goal is behavior change, not blame.
How is this different from Cybersecurity or Compliance?
Cybersecurity is the technical controls (EDR, SOC, email filtering. The tools that catch what training misses). Compliance is the framework documentation (HIPAA, PCI, SOC 2. The audit posture). AI Security Training is the human layer (phishing sims, awareness modules. The people defense). Most clients need at least two of three; many need all three. We bundle pricing when you do.
Will our employees hate us for this?
They’ll hate it the first month and forget about it by month three. The framing matters: this is “we’re protecting you from getting yelled at for clicking a phishing email,” not “we don’t trust you.” The just-in-time micro-training instead of punishment helps a lot. After 3–6 months, click rates drop 60–80% and most employees become proud of catching phishing attempts.
How long until we see results in the click-rate?
Baseline click rate for an untrained organization is typically 25–35%. After 3 months of monthly simulations + training, expect 12–18%. After 6 months, 5–10%. After 12 months on the Pro or Managed tier, sustained 3–7%. Industry benchmarks: anything under 10% is good; under 5% is excellent. The reports document this trend month-over-month.
Will the AI-aware modules age out as the AI landscape changes?
Yes, and we update them quarterly. Deepfake quality is improving, AI-generated phishing tactics are evolving, new LLM data-leakage scenarios are emerging. Pro and Managed tiers automatically get the new modules as they release. Lite gets the annual refresh.
Can you customize phishing templates with our actual vendor/customer logos?
Yes, with permission. We never simulate attacks impersonating named third parties without your written authorization. For industry-tailored sims, we use lookalike templates (e.g., “Wells Fargo lookalike” for a banking client, not the actual Wells Fargo logo). Managed-tier clients get custom templates for their actual line-of-business apps.
What does the contract look like?
Month-to-month default. 1-year and 3-year agreements available with locked-in pricing. User adds/removes with 30 days’ notice. Off-boarding includes a full export of training records, phishing simulation history, and your custom modules. Your data is always yours.
Show us your last cyber-insurance questionnaire. We’ll show you the gap.
Free 30-minute demo. Bring your most recent cyber-insurance renewal questionnaire (or just describe what they’re asking for). We’ll show you which questions our training program answers in writing, which gaps you have today, and which tier fits your size. No commitment. Even if you don’t hire us, you’ll know what to fix.
Phoenix-based · Cyber-insurance + audit-ready reporting · AI-aware modules updated quarterly · Month-to-month default · Client portal included