Security awareness & human risk

Turn your people into your strongest control.

Engaging training, realistic attack simulations and a live human risk score, built into the same platform that runs your policies, risks, controls and audits. Watch one company's risk fall as the program runs.

Northwind Foods · 200 employeesBaseline
Human risk score
64
High riskImprovingResilient

Firewalls stop machines. People stop the attacks that get past them: the convincing email, the urgent payment request, the call that sounds exactly like your CEO.

The program

Five steps that repeat all year

Security awareness is not a once-a-year video. It is a loop: measure, teach, test, measure again and close the gap.

01Baseline

Find out where you really stand

A short knowledge check and an unannounced phishing test on day one give every person and team a starting score. No guesswork about who needs what.

  • Knowledge check across six competencies
  • A baseline simulation at normal difficulty
  • A starting human risk score for every person
02Train

Teach what each person actually needs

Role-based tracks assign short lessons by department and by result. Finance learns invoice fraud; engineers learn secret handling; everyone learns to report.

  • Four-minute lessons on 14 core topics
  • Auto-assigned on day one for new hires
  • Reminders in the app and in Slack
03Simulate

Practise against realistic attacks

Campaigns across email, SMS, voice, QR codes and MFA prompts, sent at random times and at rising difficulty, test whether the lesson stuck.

  • 12 attack types and 5 difficulty levels
  • A teachable moment the second someone clicks
  • One-click reporting from the inbox
04Measure

See risk by person, team and attack type

Every lesson, quiz answer, click and report feeds one human risk score. See which teams are resilient to which attacks, and which are not yet.

  • Click rate, report rate and time to report
  • Knowledge map by department
  • Trends you can take to the board
05Reinforce

Close the gap automatically

People who click or score low get short, targeted follow-up. Knowledge that fades gets a refresher before it becomes an incident.

  • Targeted lessons after a failed simulation
  • Spaced refreshers when scores decay
  • Results feed risks, objectives and management review
Why it lives in CompliLens

Built into your compliance program, not bolted on

Awareness training only proves something when its results reach your risks, controls and audits. Here they arrive automatically.

A standalone awareness toolCompliLens
Training recordsExported to a spreadsheet when the auditor asksFiled as evidence against ISO 27001 A.6.3 and SOC 2 CC2.2 automatically
Simulation resultsA dashboard in another toolFeed the risk register, objectives and management review
A real phish is reportedForwarded to a shared inboxOpens an incident with CERT-In and GDPR clocks running
New hiresSomeone has to remember to enrol themAssigned by department on their first day
Policy acknowledgementA separate tool, or none at allTimed reading and version-aware sign-off in the same console
Board reportingScreenshots pasted into slidesHuman risk is part of the management review snapshot
Audit-ready by default

The evidence pack builds itself

Every completion, quiz score, simulation result and acknowledgement is timestamped, tied to a person and a version, and filed against the controls that require it. When the auditor asks how you train staff, you send one link.

  • ISO/IEC 27001:2022 clause 7.2, 7.3 and Annex A 6.3
  • SOC 2 CC1.4 and CC2.2
  • GDPR Article 39 awareness duties
  • RBI, SEBI and IRDAI user-awareness requirements
app / training / evidence-pack · Q3 2026
Course completions188 / 20094%
Simulation campaigns34% clicked
Policy acknowledgements1,240Timed
Certificates issued188Verified
Overdue, with reminders sent12Chasing
ISO 27001 A.6.3SOC 2 CC2.2GDPR Art. 39
Export PDF
For employees

Training people actually finish

Lessons take about four minutes, run on any phone or laptop and use real scenarios from your industry. Employees see only what is theirs: their courses, their policies and their certificates.

  • Short lessons with a quick check at the end
  • Progress saved, so a lesson can be finished later
  • Certificates the moment a course is passed
  • Learning paths that unlock step by step
Lesson 3 of 5 · 4 minSpot the look-alike domain
From: payroll@n0rthwind-foods.com0 instead of o
Next
Quick checkA supplier emails new bank details. What do you do?Pay the invoice as usualCall the supplier on a known numberReply to confirm
CorrectAlways verify payment changes out of band.
+20
Knowledge score 78 → 82
Course completePayment Fraud EssentialsCertificate CERT-0188Filed as evidence for ISO 27001 A.6.3
Questions

Security training, answered

How is this different from a standalone awareness platform?

The training, simulations and scores live in the same place as your policies, risks, controls and audits. Results become audit evidence, feed your risk register and appear in management review without exports.

Can we use our own content?

Yes. Upload your own videos, documents and quizzes, edit any built-in lesson, and brand everything with your colours.

How long does it take to launch?

Most teams run a baseline assessment and their first simulation in the first week. Departments drive automatic assignment from then on.

Do employees see each other's scores?

No. Employees see their own progress and coaching. Individual risk scores are visible only to the administrators you choose.

Which attacks can we simulate?

Twelve types across email, SMS, voice, QR codes, MFA prompts and physical media, each at five difficulty levels.

Keep exploring

The rest of security training

Curriculum

Fourteen core topics in short, scenario-based lessons, with tracks for each role.

Explore

Knowledge assessment

Adaptive tests show what each person really knows, topic by topic.

Explore

Attack simulation

Realistic phishing, smishing, vishing, QR, MFA-fatigue and deepfake tests.

Explore