The costly click is not a technical one
Phishing, a reused password, an attachment opened too quickly: most security incidents do not start with a badly configured firewall, but with a decision taken in a few seconds by someone who had no reason to be suspicious. The session builds that reflex of doubt, simply and without blame.
Recognising phishing and social engineering attempts.
Good practice for passwords and authentication.
What to do with suspicious emails, links and attachments.
Security of the workstation, remote working and mobile devices.
Who is it for?
Every employee, whatever their technical level.
Directors and managers who want to build a security culture.
Organisations that have suffered an incident or want to prevent one.
A session built around situations your staff actually meet
Generic awareness training is quickly forgotten when it does not match the participants' tools and habits. The preparation therefore selects examples that fit your sector, your email practices, remote working, document sharing and the unusual requests your teams may receive.
The session favours situations everyone can follow: spotting a message that deserves a check, knowing how to stop an action when in doubt, and knowing which person or internal channel to alert. The aim is not to turn staff into security specialists, but to give them shared landmarks and a simple way to react.
Management can ask to focus on a specific context, such as CEO fraud, fake suppliers, file sharing or the use of personal devices. The examples stay educational: no credentials are collected and no one is singled out in the standard format.
Pricing and format
The price is based on the number of participants, with preparation and tailoring to your sector always included. The starting price shown above is for a full-day session with up to 8 participants; each additional participant, up to 15, is added per person. A half-day format is also available.
A team of fewer than 8 is welcome and simply pays the minimum price, since the preparation represents the same work. Beyond 15 participants, discussion and role play lose their value: the group is split and priced by number of sessions, as for several sites.
For teams outside France, sessions are run remotely by video call, in English or French. An on-site session is possible on quote.
How it works
Diagnosis: a questionnaire or preparatory call to adapt the content to your context.
Programme: content adapted to your sector and your specific risks.
Workshop: an interactive session with real examples and role play.
Assessment: a validation quiz and a debrief of the results.
Deliverables
Awareness material tailored to your organisation.
An everyday cybersecurity good practice guide.
Quiz results with areas for improvement.
A certificate of attendance for each participant.
A debrief of the quiz results and one round of post-session clarification, within the agreed scope.
Further reading
This training is also part of the Security Audit package, combined with an Active Directory audit.
Frequently asked questions
Is this technical training? No, it is awareness training open to everyone. No technical knowledge is required. The goal is to build the right everyday reflexes.
How many participants per session? Up to 15, to keep room for discussion and role play. The price is calculated per participant with a minimum corresponding to 8 people, so a smaller team can be trained at the minimum price. Beyond 15, the group is split into several sessions.
On site or remote? Both are possible. Remote sessions run by video call, which suits teams outside France. On-site sessions allow more immersive exercises, such as educational phishing recognition drills, and are quoted with travel. Large-scale simulated phishing campaigns, with real emails sent to staff, require a separate study and quote.
Can the session be delivered in English? Yes. Sessions are delivered in English or French, and the material and good practice guide are provided in the language of the session.
Does this training replace an audit or ongoing support? No. It does not include certified training or certification of participants, any guarantee of fewer incidents or of compliance with NIS2, ISO 27001 or another framework, a full security audit or penetration test, large-scale simulated phishing (unless quoted separately), the collection of passwords or credentials, individual ranking of staff, or ongoing security support, incident handling and on-call duty.