Consulting Services
Our consulting service supports your organization with tailored solutions, based on the Human Risk Management approach. We measure how people actually behave, define the strategy, run the campaigns and report the results.
Talk to a consultant Download the brochure
The PDF covers the three plans and what each one includes. We will also send it to your inbox.
62%
of security breaches involve the human factor, according to the Verizon 2026 Data Breach Investigations Report
The figure rose from the 60% reported in the previous edition. Almost every organization already has the tools to train its people. What is usually missing is someone to keep the program running for twelve months.
Deciding who each campaign reaches, what gets measured, what happens with what is measured and what comes next is continuous work, and it rarely has a clear owner inside the organization. That is the work this consulting service takes on.
Coverage of the cybersecurity regulations and regulatory frameworks that apply to your organization.
Measurable reduction of the risk of cyberattacks caused by the human factor, with the baseline as the point of comparison.
Sustained behavior change in people, holding between one campaign and the next.
Progressive construction of a security culture across the whole organization.
We design and run your awareness program with a structured process that goes from the first measurement through to the correction of the plan.
We establish the initial baseline. We measure how people behave today through simulations and surveys. That first measurement is the objective starting point of the program and makes it possible to compare the progress over time.
We analyze the context, the maturity and the specific risks of your organization. From the baseline and the reality of the business, we define the strategy, the priorities and the action plan.
We run the program with simulations, learning modules, reinforcement campaigns and activities segmented by profile. We create and maintain the gallery of simulation and awareness content that is relevant to your organization.
We plan the campaigns, measure their results and report on them. We evaluate the risk level of the organization, the groups and the people throughout the project, and we adjust the strategy according to what the results show.
Every plan includes an annual pool of consulting hours that your organization uses flexibly according to its needs: campaign reviews, analysis of results, executive reporting, definition of the next steps, adoption support and strategic recommendations.
around 22 h a year
For organizations that need to comply with cybersecurity regulations or regulatory requirements.
around 50 h a year
For organizations that want to generate a real and sustained change in the behavior of their users.
around 90 h a year
For organizations that aim to integrate cybersecurity as part of their culture, with a program of lasting impact.
The hours are there to size the support and do not work as a cap that cuts the service once it is used up. If your organization needs more dedication during the year, we talk it through and adjust the service.
Every plan includes concrete consulting support. These are the deliverables you can expect.
An awareness plan adapted to the context and the goals of your organization.
Management and execution of the simulation and awareness campaigns.
Results, risk metrics and progress of the program, at the frequency the plan sets.
Strategic recommendations and adjustment of the program according to what the results show.
Support in the adoption of security best practices across the whole organization.
We maintain a complete gallery of simulation and awareness content that is relevant to your organization, split across three functions.
Assessment
Awareness
Reinforcement
Every format has its own page under awareness tools, and the ready-made annual plans are in awareness programs.
The content is adjusted by topic and, when it is needed, written from scratch.
Content for notable dates that captures the interest of the people.
Topics specific to each company, such as internal news, events or birthdays.
Content focused on Human Resources, Finance, IT or Sales.
Additional catalogs of advanced and industrial cybersecurity content.
Development of complete content catalogs tailored to your needs.
We generate reports adapted to the different profiles within your organization.
The detail of what comes out of the platform is in reports, and the aggregate industry data in the Human Risk Report.
The platform is the tool the program runs on: content, simulations, audience assignment and reports. The consulting service decides what that tool does during the year and operates it. It establishes the baseline, defines the strategy from the real risk of the organization, schedules and runs the campaigns, interprets the results and adjusts the plan. An organization with someone dedicated to the program can work with the platform alone. The consulting service exists for the ones that have nobody to assign that work to for twelve months. If you are still evaluating the platform, the seven questions worth asking any vendor are in compare security awareness platforms.
The hours in each plan, around 22 a year in Compliance, around 50 in Awareness and around 90 in Culture, are there to size the support and do not work as a limit that cuts the service once they are used up. If the organization needs more dedication during the year, we talk it through and adjust the service accordingly.
The baseline is the first measurement of how the people in the organization actually behave, obtained through simulations and surveys before any training starts. It works as an objective starting point, because without it any later result has no reference to be compared against. With it, the progress of the risk across the program can be read against a number that belongs to the organization rather than against a market average.
The consulting service produces the evidence an audit usually asks for on training and awareness: the initial diagnosis, the annual induction program for all users, the record of the simulations and the campaigns delivered, and the reporting of results and risk metrics. The Compliance plan is sized precisely for that goal. The one who rules on compliance is the auditor, and what the service contributes is the material that ruling rests on.
The three plans are cumulative. Awareness includes everything in Compliance and Culture includes everything in Awareness, so moving from one to the next adds frequency, activities and depth of analysis on top of the same program, without rebuilding it from scratch. The baseline and the campaign history are kept, which is what makes it possible to keep comparing the progress.
Tell us where your organization stands and we will propose the plan that fits.