Cyber Security
Many attacks still need a person to click, pay or share a password. We train your staff to pause, check and report, and show you the numbers improving.
In short
Security awareness training teaches your staff to recognise and report phishing, scams and risky behaviour, using short lessons and realistic simulated attacks. Catharsis runs the program for you, with simulations designed by a Sydney team that also carries out real penetration tests, from a baseline phishing test to ongoing training and reports that show where risk is falling.
01Who it's for
A well-crafted phishing email or a convincing call from someone posing as a supplier can still get past your filters. When it does, a staff member who pauses, checks and reports is your most useful control.
02What's included
Phishing simulations
A realistic simulated phishing campaign before any training starts, so you know how many staff click, enter credentials or report the email. It gives you a starting point to measure progress against.
Regular simulated attacks that vary in style and difficulty, based on real techniques such as fake invoices, delivery notices and Microsoft 365 sign-in pages. Anyone who clicks gets a short lesson straight away.
Training content
Lessons of a few minutes each on phishing, passwords and multi-factor authentication (MFA), safe use of devices and data, and reporting incidents. Staff can fit them around their work, and completion is tracked automatically.
Extra training for higher-risk roles: payment verification for finance staff, executive impersonation for leaders, and safe administration for IT staff. New starters get core training during onboarding.
Content on newer scams, such as convincing AI-written phishing, voice cloning and deepfake video calls asking for urgent payments. Staff learn the verification habits that stop them.
Report & measure
A report button in Outlook or Gmail so staff can flag suspicious emails in one step. Reporting real threats quickly is the behaviour that protects you most, so we measure it and report it.
Reports by team showing training completion, click and report rates, and how each is changing. You can see which groups need more support and show evidence to auditors and insurers.
Cyber Security
Training works when reporting is quick and nobody is blamed for asking. We help you set up a simple way to report, and a habit of acknowledging reports, so staff keep raising concerns early.
03In detail
Simulations measure behaviour, not just knowledge. Over time, the trend matters more than any single result. We look for falling click rates and, just as important, rising report rates.
A team that reports suspicious emails quickly gives you time to remove a real phishing email from other mailboxes before more people see it. That is why the program pairs well with layered email security, which filters many attacks before staff ever see them, and why our reports focus on teams rather than naming individuals.
For example, a baseline might show several staff entering their details on a fake Microsoft 365 sign-in page. Short, targeted training then follows, and later simulations track whether clicks fall and reporting rises.
Attackers now use AI tools to write convincing phishing in fluent English, clone voices and create fake video calls. The old advice to look for spelling mistakes is no longer enough.
Our training focuses on habits that work regardless of how real a message looks: verify urgent payment or data requests through a known phone number, and never act on pressure alone. ASD’s Small business cyber security handbook lists the same habit among its key actions: train staff to spot scams and phishing, and verify payment requests through a trusted channel. If your organisation is adopting AI tools, our AI security and governance service covers the policies and controls that go with them.
Training reduces the chance that a person is the way in. It is most effective when the reports staff make are acted on, and when the same team can see what got past the filters. If you want training, email security and alert response run by one team, the program can sit inside managed security. It also produces the training records an ISO 27001 ISMS needs.
04The process
We run a paid baseline phishing simulation to measure how your staff respond today, before you commit to training.
We agree training topics, simulation frequency and reporting with you, including any role-specific content.
We set up users, add the report button and send a short introduction so staff know what to expect.
Staff complete short modules and receive regular simulations, with instant lessons for anyone who clicks.
Regular reports and review meetings show progress and adjust the program where risk remains.
05Frameworks
Useful for your auditor, board or procurement team. The mapping shows where this service supports each framework. It doesn't replace a formal assessment.
| Control | ASD Essentials | ISO/IEC 27001 | NIST CSF |
|---|---|---|---|
| Security awareness training | Governance and culture | A.6.3 | Protect (PR.AT-01) |
| Role-based training | Governance and culture | A.6.3 | Protect (PR.AT-02) |
| Phishing simulations | Governance and culture | A.6.3 | Protect (PR.AT-01) |
| One-click reporting | Visibility and response | A.6.8 | Detect |
06Pricing
Pricing
Quoted for your environment
What changes the price
Final price depends on the number of users, how often simulations run, how much reporting you need, and whether you want role-specific, custom-branded or policy content.
07FAQ
Can't see your question? Ask a specialist and get a straight answer.
Ask a specialistIt works when it is short, regular and measured. A single long presentation rarely changes behaviour, but brief lessons combined with realistic phishing simulations build habits over time. The clearest sign of success is not only fewer clicks, but more staff reporting suspicious emails quickly, which gives your IT team time to act before damage is done.
A phishing simulation is a harmless fake phishing email sent to your staff to see how they respond. It looks like a real attack, such as a fake invoice or sign-in page, but clicking it only leads to a short lesson. Results show who clicked, who entered details and who reported it, so training can focus where it is needed.
Not if the program is introduced well. We recommend telling staff that simulations will happen, without saying when, and making clear the goal is learning, not blame. Anyone who clicks sees a short, friendly lesson rather than a warning. Reports focus on teams and trends, and we encourage praising people who report suspicious emails.
Short training and simulations work well spread through the year rather than in one long session. A regular rhythm of a few minutes of training and a simulation, plus extra content for new starters and high-risk roles, keeps habits fresh. We help you set a frequency that keeps security front of mind without overloading staff, and adjust it as results improve.
Yes. ISO/IEC 27001:2022 requires staff awareness (Clause 7.3), and Annex A control A.6.3 covers awareness, education and training, so auditors expect records. Many cyber insurers also ask whether staff receive training and phishing testing. Our reports give you completion records, simulation results and trends that you can show an auditor, an insurer or a customer questionnaire.
The phishing simulation sends a realistic test campaign to your staff and reports how many clicked, entered credentials or reported it. The baseline simulation is a paid engagement, quoted once the number of staff and the scenario are agreed. We then walk you through the results and recommend a training plan that fits your organisation.
Talk to our team
No obligation. You talk to the people who do the work.
