How often do phishing simulations run and will staff know they are being tested?

Simulations run on a randomised schedule, typically two to four times per month per staff member, with timing and template varied so no pattern is predictable. We recommend communicating that the company runs a phishing program. Knowing simulations happen is itself part of the training. Knowing exactly when they will arrive is not.

What happens when a staff member clicks a simulated phishing email?

They land on a branded training page that explains the attack technique, what the warning signs were, and how to handle the real version if they see it again. The click is logged for reporting. The experience is educational, not punitive. Managers see aggregate data, not a real-time list of who clicked what.

How long do the training modules take and will staff resist completing them?

Each module takes three to five minutes. They are scenario-based and built for non-technical staff, not lecture-style compliance videos. Completion is tracked and reminders go out automatically to staff who have not finished. Most organisations see above 90 percent completion within the first quarter.

Is Security Awareness Training enough security on its own or does it need other tools?

Security Awareness Training is the human layer of a complete security stack. It works best alongside technical controls: endpoint protection, email filtering, multi-factor authentication, and application control through ThreatLocker. No single tool is sufficient. Security Awareness Training closes the gap that technical tools cannot, which is a trained staff member making a better decision before they click.

How often do the phishing simulations run?

Simulations run on a randomized schedule, typically two to four times a month per staff member, with the timing and template varied so no pattern is predictable. Anyone who clicks gets a short, targeted lesson rather than a lecture.

Managed IT

Security Awareness Training

Security Awareness Training is bdManagedIT's training program for North Georgia businesses, using realistic phishing simulations and structured ongoing education to train every staff member to recognize and report social engineering before it becomes a breach.

Book your first appointment Get a price estimate

Technical security controls stop a lot, but they do not stop a staff member who clicks a convincing phishing email and enters their credentials on a fake login page. Human error is the entry point in the majority of breaches. Security Awareness Training addresses the human layer directly: we run phishing simulations against your staff using real-world techniques, measure who clicks and who reports, deliver targeted training to those who need it, and track improvement over time, all running continuously in the background.

What's included

Realistic phishing simulations

We send simulated phishing emails using the same techniques real attackers use: fake invoice alerts, IT password reset requests, document-share impersonations, and urgent executive wire transfer requests. Simulations run on a randomised schedule so staff do not know when to expect them.

Automated training for staff who click

When a staff member clicks a simulated phishing link, they receive immediate targeted training explaining what they missed and how to identify the attack type in future. Training is delivered in the moment of failure, which is when it is most effective.

Ongoing education modules

Beyond simulations, Security Awareness Training delivers short monthly training modules covering password hygiene, multi-factor authentication, physical security, social engineering, and safe browsing. Modules are brief, scenario-based, and built for non-technical staff.

Reporting and progress tracking

We provide regular reports showing click rates, report rates, training completion, and improvement trends across your organisation. Over time, the data shows which staff and departments remain higher risk so attention goes where it is needed most.

What you get

Fewer credentials handed to attackers

Trained staff catch phishing emails before they click. Every staff member who correctly identifies and reports a phishing attempt is a breach that did not happen. Security Awareness Training measurably reduces click rates within the first three to six months of the program.

Compliance requirements met

HIPAA Security Rule, PCI-DSS, and CJIS all require documented security awareness training for staff who handle regulated data. Security Awareness Training produces the training completion records and program documentation needed to satisfy auditors and cyber liability insurers.

Lower cyber insurance premiums

Insurers increasingly require documented security awareness training as a condition of coverage and use the presence of a program as a rating factor. Running Security Awareness Training gives your insurance broker evidence of a structured human-layer security control.

A security culture that persists

One-off annual training fades within weeks. Security Awareness Training runs continuously, with simulations and short modules keeping security habits active year-round. Staff in the program for twelve months behave measurably differently from those who completed a single annual seminar.