Managed Security Awareness & Phishing Simulation
Buying an awareness platform is easy; running it well every month is what nobody has time for. We run the whole program on the platform of your choice: monthly phishing simulations written against current lures, targeted training for repeat clickers, new-hire onboarding, and the metrics your auditor and insurer ask for — reviewed by a CISO, not just scheduled by a tool.
In scope
- Monthly phishing simulations based on current lures
- Role-based and remedial training assignments
- New-hire onboarding track
- Executive and finance-team spear-phishing scenarios
- Audit- and insurer-ready reporting
You receive
- Monthly campaign results and trend report
- Repeat-clicker remediation plan
- Annual training completion evidence
- Quarterly human-risk briefing
Tiers
Choose the depth.
Essential Awareness Program
$450 / mo
Up to 50 users: monthly simulations, annual training and compliance reporting
- Users
- 50
Advanced Awareness Program
$1,200 / mo
Up to 250 users: adds role-based training, repeat-clicker coaching and quarterly briefing
- Users
- 250
Enterprise Awareness Program
$2,800 / mo
Up to 1,000 users: adds executive spear-phishing, vishing scenarios, custom content and human-risk scoring
- Users
- 1000
Members: engagement coupons from the CISO Marketplace coupon book apply to services. There is no blanket discount.
What's inside this engagement
Phase by phase.
How a advisory & fractional leadership engagement runs, what happens in each phase and what you see. Exact scope, tier and timeline are fixed in your proposal and SOW.
01Onboarding & baseline
Current program, risks, commitments and stakeholders reviewed.
You see · Access to leadership and existing documents.
02Priorities & roadmap
A risk-ranked roadmap agreed with leadership.
You see · Decisions on priorities and budget.
03Ongoing cadence
Regular working sessions, decisions and deliverables to the agreed scope.
You see · A named advisor and a standing rhythm.
04Reporting to leadership
Board and executive reporting in business terms.
You see · Board-ready updates.
Commercials
From first call to final report.
- 01
Scoping call
A practitioner, not a salesperson, walks through targets, constraints and what a good outcome looks like for you.
- 02
Proposal & rules of engagement
A fixed-scope proposal with tier, price and deliverables. Rules of engagement, contacts and out-of-bounds systems are agreed in writing.
- 03
Sign, then start
MSA and SOW are signed electronically and the deposit is paid. Only then does testing begin.
- 04
Execution
Testing runs to the agreed plan. Critical findings are escalated as they are found; you don't wait for the report.
- 05
Report & debrief
An executive summary plus technical findings with evidence, reproduction steps and fixes, walked through with your team.
- 06
Retest
Where the tier includes it, we verify your fixes and reissue the report, so auditors and customers see the issues closed.
Timelines are set per engagement in the SOW.
Related
Non-Human & Machine Identity Security
Assess and govern non-human identities — secrets, API keys, service accounts, workload identities, and AI agent identities — covering issuance, rotation, least-privilege, and lifecycle.
Zero Trust Security Assessment
Comprehensive evaluation of your organization's zero trust architecture implementation, examining identity verification, network segmentation, and access controls. Our assessment identifies gaps in your zero trust strategy and provides a roadmap for enhancing security beyond traditional perimeter-based approaches.
CISO Comprehensive Security Assessment
Holistic evaluation of your organization's entire security program across all critical domains. This efficient, structured assessment provides CISOs and security leaders with a complete diagnostic of security capabilities, maturity gaps, and prioritized improvement opportunities. Our comprehensive approach delivers actionable insights across governance, technical controls, and operational security to inform strategic decision-making and resource allocation.
Research
Latest from the blog
operations · Aug 19, 2026
Build Your Own AI SOC: The Open-Source Stack for Teams That Cannot Afford a Managed One
A three-person security team can now run detection, triage, and response tooling that cost seven figures five years ago. The open-source SOC stack is mature, and frontier models — plus open-weight alternatives like GLM 5.2 and Kimi K2.7 that you can run yourself — close the Tier-1 analyst gap. Here is the architecture, the cost model, and the specific places where DIY is the wrong answer.
identity-security · Jul 12, 2026
Phishing-Resistant MFA Is a Program, Not a Purchase: The CISO's Rollout Math for Hardware Keys
Every framework now says "phishing-resistant MFA," every insurer asks what kind of MFA you run, and every AiTM phishing kit is a reminder that codes and push approvals are relay-able. Here's the program view — sequencing, recovery policy, fleet economics — and why the open-source Nitrokey is the key an auditable program should standardize on.
identity-security · Apr 25, 2026
AI Device Code Phishing: The Auth Flow That Survives MFA, Password Resets, and Your SOC
Microsoft's Defender Security Research team documented a new AI-enabled phishing campaign leveraging the OAuth device code flow to compromise organizational accounts at scale. The EvilTokens toolkit automates code generation, bypasses the standard 15-minute expiration window, and leaves tokens that survive both MFA and password resets. Here's the technical breakdown and what to do about it.
Start an engagement