Cyber Essentials
User awareness supports the scheme and the questions insurers ask beside it.
Full details →Realistic phishing simulations and short, practical training for teams in Leicester and across the East Midlands.
Most damaging incidents we see start with a person: a copied password, a shared one-time code, or an invoice that looked familiar. Technology catches some of this. It does not catch all of it. Phishing simulation and awareness training give your staff safe practice at recognising and reporting the attacks that are aimed at them specifically.
Cyber Root designs the programme, runs the simulations and reviews the results with you. We use established simulation and training platforms, and we stay involved so the report is not just a click-rate you do not know what to do with. The work is sized for East Midlands SMEs that need to show staff awareness to insurers, customers or Cyber Essentials, without employing a training team.
Campaigns that resemble current lures, including invoice, IT-support and executive-style messages, not a generic test from five years ago.
Modules on phishing, passwords, multi-factor authentication, data handling and social engineering. Short enough that people finish them.
Who clicked, who reported, and whether that is improving. We interpret it with you rather than forwarding a spreadsheet.
People are told that simulations are part of the programme. Individual emails are not announced in advance, so the result means something, and nobody is named and shamed.
We help you launch, adjust difficulty and connect the lessons to your wider security work.
If simulations show a gap in reporting or account recovery, we connect that to incident readiness or managed defence.
We agree who is included, how often you will simulate, and what “good” looks like for your size.
A first campaign shows where you actually are, before any training.
Short modules, then further campaigns. Many organisations settle on monthly or quarterly.
You see the trend and decide what to change: the training, the process for reporting, or a technical control.
Any organisation whose staff use email. It is particularly useful if you are renewing cyber insurance, onboarding a larger customer, or preparing for certification and need evidence that people have been trained. Directors and finance teams are usually in scope, because they are the targets that cost the most when a lure works.
Most East Midlands clients combine more than one of these. Start with the gap that matters most.
User awareness supports the scheme and the questions insurers ask beside it.
Full details →What people should do in the ten minutes after they report a phish.
Full details →Detection for the messages and sign-ins that training does not stop.
Full details →They are told that simulations are part of the programme. They are not told when a particular campaign will arrive. That keeps the result honest and keeps the conversation constructive.
Monthly or quarterly works for most SMEs. A single annual test tells you very little. We recommend a steady cadence and a difficulty that rises only as reporting improves.
Yes. User awareness and reducing the chance of a successful phish support the posture the scheme expects. It is also one of the first things insurers and larger customers ask about. It is not, by itself, a certification.
Yes. We can handle setup, campaign design, the review of results and the adjustments, so your team gets the benefit without another admin console to learn.
That is useful information, handled privately. Senior mailboxes are high value. The response is better protection and a conversation, not a leaderboard.