People are the attack surface
Phishing, CEO fraud, fake invoices, vishing. Technology filters most of it, and whatever gets through is handled by an employee. Most successful attacks start with a click, not a breach.
Employee training
all year round.
An information security awareness program that connects a platform, phishing simulations and live workshops. INC leads, your team oversees.
12 months of continuous programPlatform under your brandQuarterly evidence package
WHY A PROGRAMSix problems that
Six problems that
organizations carry today.
None of them is technical. Each is human, organizational or regulatory.
Every location is an entry point
The same exposure at headquarters and at the smallest branch or plant, while training rarely reaches beyond headquarters.
Internal misuse and fraud
The costliest incidents often don't come from outside. They are found late, because colleagues don't recognize the signs or don't trust that a report will be protected.
Regulations demand proof, not attendance
The law, NIS2, ISO 27001 and data protection, and behind them audit, the Agency, customers and the parent company. An annual training with an attendance list no longer passes.
The security team has no time
Campaigns, training and reports take hours that regular work doesn't leave, so everyone gets the same treatment and the riskier people get nothing extra.
Progress is invisible
Annual training without measurement: nobody knows whether behavior has changed until an incident happens. Management receives proof of attendance, not proof of effect.
WHAT THE PROGRAM SOLVESSix outcomes,
Six outcomes,
in the same order as the problems.
Awareness at a higher level
Not "I know what phishing is" but "I recognize it, I don't click and I report". Continuously throughout the year, with an understanding of why we are susceptible to manipulation, from outside and inside.
All employees, all locations
The platform reaches every account, at headquarters and at every location. Live workshops at your premises, for the functions with the highest risk.
Lower risk of fraud, external and internal
Simulations without consequences instead of real incidents, and colleagues who recognize the signs of internal misuse (unusual transactions, bypassing controls) and have a safe channel to report them.
Relieved compliance and audit
An evidence package mapped to the Law, NIS2, ISO 27001 and data protection, ready before anyone asks for it, in a format that doesn't need repackaging.
A relieved security team, focused where it matters
Campaigns, analyses and reports are run by INC. The dashboard shows riskier individuals and departments, and they get extra training and attention, the thing the team never had time for.
Measurable progress
A quarterly trend per organizational unit, not an annual impression. Management sees three numbers, and the auditor sees the full record behind them.
WHAT THE PROGRAM COVERSPlatform and
Platform and
live workshops.
A program that reaches
every employee.
A dedicated instance under your organization's brand, with campaigns for all employees and role-based content.
- Phishing simulations in our language
- Dedicated instance: your logo and your domain, data is shared with no one
- Users are updated from your HR list (joiner, leaver, transfer)
- Employees found in confirmed data leaks are enrolled in training automatically
- Harder simulation scenarios from quarter to quarter
- Risk dashboard by employee, department and location
- Monitoring of exposure in data leaks
- Policy acknowledgment and evidence export
- Optional: AD/Entra synchronization and a report button in Outlook and Teams
The e-learning module library is in English. Simulations, workshops and reports are in our language.
Workshops tailored
to job roles.
Hands-on work at the client's premises, in groups of 15 to 17 participants. The content follows participants' responsibilities and exposure.
- Core workshop for all employees
- Management, C-level and managers
- Finance, HR, IT and administrators
- Security ambassadors
- Tabletop exercise for the crisis team
DIVISION OF WORKINC leads.
INC leads.
Your team oversees.
- The initial assessment
- Program planning
- Campaigns and workshops
- Monitoring and reporting
- Program oversight
- Escalation decisions
- One meeting a quarter
PHASE 0 / BEFORE THE FIRST TRAININGFirst we understand
First we understand
your organization.
The initial assessment requires no installation, costs nothing and carries no obligation. The findings become the plan for the next 12 months.
- Review of existing documentation
- GAP questionnaire
- Interviews with HR/L&D, security and the compliance team
- Program plan and priorities
An initial phishing simulation runs as soon as the platform is live, before the first training.
FROM LAUNCH TO CONTINUITYFive weeks to
Five weeks to
the first campaign.
Preparation
In parallel we set up the platform and carry out the initial assessment. We load users and define the plan.
First campaign
Baseline measurement before the first training and the launch of the campaign for your employees.
Continuous program
Campaigns, workshops and increasingly demanding scenarios. Quarterly reports, final measurements and a plan for the following year.
- Baseline phishing simulation
- First campaigns
- Briefing for management and executives
- Workshops for risky functions
- First quarterly report
- Second simulation, harder scenarios
- Targeted campaigns for riskier units
- Final measurements and annual report
- Program review and plan for the next year
Every month: a short training module for everyone, a phishing simulation quarterly per organizational unit, user updates from the HR list, risk tracking by individual and department with extra training for the riskier ones, and one meeting a quarter with your team.
WHAT TO EXPECT3, 6, 9 and
3, 6, 9 and
12 months.
Milestones that the program sponsor can verify and show to management. Months are counted from the platform launch, and targets are agreed after the baseline measurement, not before.
- Click rate and report rate known (baseline)
- 100% of users on the platform, all locations
- Management and executives have completed workshops
- First campaign and core workshop under way
- First quarterly evidence package
- Click rate measurably below baseline
- Report rate rising: they report, they don't ignore
- Riskier people identified, extra training under way
- Risky roles trained live
- Evidence ready for the half-year audit
- Stable trend across locations and departments
- Targeted campaigns for weaker units
- Harder scenarios: vishing, deepfake, QR
- Crisis team has completed a tabletop exercise
- Records for the Law and ISO 27001 complete
- Annual report for management and the regulator
- Goal: click rate below the European average
- 100% completion of mandatory modules
- Program reviewed against trends
- Plan for the following year adopted
More than click counts.
Three numbers management tracks: click rate ↓ · report rate ↑ · completion of mandatory training 100%.
Report rate
How many people recognize and report suspicious messages.
Time to report
How quickly the first report of a suspicious message arrives.
Click rate
Reactions to phishing simulations compared with the baseline.
Training completion
Overview by employee, department and location.
Risk by role
Insight into individuals and departments that need extra support.
Exposure in leaks
Monitoring of employee data exposure.
QUARTERLY EVIDENCE PACKAGE
What the package contains.
- A summary for management: one page, three numbers and the trend
- Metrics per organizational unit
- Completion records per employee
- Workshop attendance lists and certificates
- Policy acknowledgments
- Mapping to the Law, NIS2, ISO 27001 and data protection
- Recommendations and a plan for the next quarter
A format that the auditor, the Agency, customers and the parent company accept without repackaging.
WHAT CHANGESWhat your teams
What your teams
no longer do alone.
The program doesn't add work for internal teams, it removes it and gives back time for what matters most.
Security team
Today. Planning and sending campaigns, reminders and chasing unfinished ones, designing and analyzing simulations. The same treatment for everyone, no time for the riskier ones.
With the program. A quarterly report and escalation decisions. Risk per individual on the dashboard, and riskier people receive extra training led by INC. The hours go back to defending the system.
Compliance
Today. Collecting evidence for every request, the same evidence in the format of every regulation, proving that training exists.
With the program. An evidence package ready before the request. One mapping to the Law, NIS2, ISO and data protection, and the trend proves that training works.
Internal and external audit
Today. Checking whether training exists and who attended, searching for records by location. Finding: program insufficiently documented.
With the program. Effectiveness checked through trend, not attendance. Records per employee and location, exported in one click. The finding is closed before it opens.
REGULATION AND EVIDENCEDocumentation for
Documentation for
audit and supervision.
An overview of the documentation the program provides for different checks and frameworks.
Information Security Law
What it requires. Montenegro, 2024, key and important entities. Training and employee awareness as a mandatory measure; ISO 27001 certification of key entities by mid-2027. The Agency's first supervision (July 2026) singled out employee awareness and the definition of responsibilities as the most pronounced weaknesses.
Evidence the program provides. A documented program, training records per employee, quarterly reports and records ready for the Agency's supervision, as a contribution to ISO 27001 certification.
NIS2
What it requires. Directive (EU) 2022/2555, Articles 20 and 21. Management bodies must attend training and regularly make it available to employees; basic cyber hygiene and training are a mandatory risk-management measure.
Evidence the program provides. A recorded briefing for management and executives, campaigns for all employees and a completion report per employee.
ISO/IEC 27001
What it requires. Clause 7.3 and control A.6.3 (ISO/IEC 27001:2022). Information security awareness, education and training, with a check of effectiveness, not only attendance.
Evidence the program provides. A training plan, records and effectiveness measurement (click rate, report rate). Ready for a certification and supervisory check.
Personal data protection
What it requires. Training and awareness of employees who process personal data, as part of organizational protection measures.
Evidence the program provides. A dedicated campaign for functions that work with data, records per employee and acknowledgment of the rules.
Internal and external audit
What it requires. Customers, the parent company, tenders. Proof that the program exists, that all employees are covered and that effectiveness is measured, each in its own format and its own timeframe.
Evidence the program provides. One quarterly evidence package, export per employee and location, a trend instead of an attendance list.
INITIAL ASSESSMENTWhat does your
Book a conversation What does your
team need?
Let's start with a 30-minute conversation.
The initial assessment is free and non-binding.