Completion rates mistaken for awareness: The standard annual e-learning produces a number that satisfies an audit and very little behaviour change. People learn enough to pass and retain little that survives a convincing email six months later.

Training that does not sound like your firm: A branch colleague, a treasury team and a mortgage underwriter face different attacks. Generic content asks people to translate the lesson themselves, and most will not.

Awareness that lags the change programme: New processes and systems go live with training on how to use them and nothing on how they will be abused. The gap between a new capability and the awareness to protect it is where losses happen.

A culture that punishes reporting: If clicking a simulated link causes embarrassment, people hide the real one. Speed of reporting matters far more than click rate, and blame destroys it.

No measure that means anything: Completion tells you nothing. Reporting rate, time to report and repeat susceptibility tell you a great deal, and most programmes do not track them.

We build content around your firm and your change agenda: Programmes designed around the threats your people actually face, in the roles they hold, using the processes and systems they are being asked to adopt this year.

We target the high exposure roles: Payments, treasury, finance, executive assistants and the executive team face a different threat from everyone else. They get their own material.

We take the board seriously: Directors need enough understanding to challenge properly, and they are a primary target for impersonation. Sessions built for that audience rather than a shortened staff module.

We run simulations that teach rather than catch: Phishing and social engineering exercises designed to show where attention is needed, with a follow up that supports people rather than shames them.

We support the moments of change: Merger periods, new payment processes, system go lives and AI rollouts each get targeted awareness at the point the exposure is created.

We measure what changes: Reporting rate, time to report, repeat susceptibility and behaviour under simulation, tracked over time so the board sees a trend rather than a percentage.

We know this audience: Branch networks, contact centres and small head office functions where one person holds three roles. We have delivered awareness work at scale in financial services, including a risk culture programme for around 160 people at a major insurer, and we design for the people in the room rather than the org chart.

Behaviour is the outcome: We design against a behavioural goal and measure against it. A programme that does not change what people do has not worked, whatever the completion rate says.

A capability, not an event: Awareness decays and your firm keeps changing. We build a programme that is refreshed against both, rather than delivered once each November.