The Cheapest Security Control You Are Not Running
Nearly every serious small-business incident starts the same way: a convincing email and one click. The technology layer - filtering, MFA, endpoint protection - catches most of it, but the attacks engineered to reach a human are precisely the ones built to slip past machines.
Awareness training has a deserved bad reputation: an annual hour of slides nobody remembers. What actually changes behaviour is the opposite - short, frequent, and real. Simulated phishing emails that look like the ones genuinely hitting Perth inboxes, a two-minute teachable moment for whoever clicks, and visible reporting so the business can watch its click rate fall quarter by quarter.
It is also increasingly a checkbox with money attached: cyber insurance questionnaires and client security schedules now routinely ask whether staff receive security training and whether phishing is simulated. This program lets you answer yes with evidence.
How the Program Works
Platform licensing at cost, our time to run it properly.
Find the starting point
- An unannounced simulation establishes your real click rate - usually a surprise
- Results by department, never used to shame individuals
- The before number that makes the after number meaningful
Ongoing phishing tests
- Regular campaigns using templates modelled on real Australian lures - invoices, delivery notices, Microsoft logins
- Difficulty scales as staff improve
- A one-click report button lands suspicious mail with us, not in the bin
Micro-training that sticks
- Minutes-long modules, not annual marathons
- Delivered at the teachable moment - right after a simulated click
- Plain English, zero jargon, relevant to the tools your staff actually use
Evidence in writing
- Click-rate and report-rate trends per quarter
- The artefact your insurer or client security questionnaire is asking for
- Honest numbers - the goal is falling risk, not a perfect scorecard
Awareness Training Questions, Answered
What owners ask before testing their own staff.
Is it fair to send fake phishing emails to staff?
Done properly, yes - and staff generally end up appreciating it. The rules that keep it fair: leadership knows the program exists, results are never used to punish or name individuals, the teachable moment is supportive rather than gotcha, and the difficulty is realistic for your industry. The alternative - letting a real attacker run the first test - is considerably less fair.
What does security awareness training cost?
Two parts, consistent with how we price everything: the platform licence is a published per-user amount paid at cost - we add no margin - and our time to set up, run campaigns and review results is at $180/hr ex GST, with most ongoing months taking well under the one-hour minimum. A program quote up front covers the year.
How often should phishing simulations run?
Monthly or at least quarterly. A single annual test measures nothing and trains nobody - the value comes from rhythm, escalating realism, and staff developing a reporting habit. Campaigns take minutes of staff time each, so frequency does not mean disruption.
Does this satisfy the training questions on cyber insurance forms?
It is exactly what those questions are probing: regular staff security training and simulated phishing with results. We keep the reporting so the evidence exists in writing at renewal time. As always, the control has to genuinely run - a licence purchased and never used satisfies nobody, least of all a claims assessor.
We are only a small team - is this overkill?
Small teams are targeted more, not less - attackers assume no IT department and no training. A five-person business where everyone can approve a payment has a bigger human attack surface per head than a corporate. The program scales down cleanly: same simulations, same training, minutes per month.
Related Services
The pieces that usually sit alongside this work.
Want to know your click rate?
The baseline simulation answers it inside two weeks. Most owners guess low.
Support Perth IT Pty Ltd · Perth, Western Australia · $180/hr ex GST, one-hour minimum, then 30-minute increments · No call-out fee in metro Perth.