Establish a baseline
Run an agreed simulation and record how employees recognise, verify and report it.
Vambrace
Managed phishing and security awareness
Help people spot and report phishing.
We run phishing simulations and security awareness training for your organisation. Your people practise spotting and reporting suspicious requests, and your team sees where further training will help.
Plan a managed phishing programme →Illustrative phishing simulation
Would a payment change get a second check?
Practise a request your finance team might actually receive. The exercise tests whether someone pauses, verifies the change independently and uses the agreed internal reporting route.
Choose the requests your people handle
Finance might verify a supplier’s payment details. Service desk staff might challenge an urgent password reset. We agree which groups and workflows to exercise, and how each group should report a suspicious request.
How the programme works
Agree the staff groups, campaign frequency, authorised channels and exclusions before the first exercise.
Coach the behaviour
Use the results to practise the decision staff found difficult, such as verifying a payment change through a known contact.
Repeat and review
Compare reporting rates and time to first report across similar exercises. Review where staff need clearer instructions or further coaching.
What happens after someone reports a message?
A report gives the security team a starting point. For a simulation, we can help the employee recognise the clues. For a real message, follow the incident process agreed with your team.
Where mailbox triage is included and authorised, responders can investigate related messages and coordinate removal with the system owner. Confirm the permitted actions before the programme starts.
What Vambrace manages
We select suitable technology platforms, tailor the exercises and manage delivery and reporting. You receive findings that show where the reporting process works and where a team needs support.
Read how phishing influences decisions ↗Managed phishing questions
Who should take part?
Agree the groups in scope with your HR, IT and security teams. Role-specific exercises can reflect the different requests handled by finance, senior leaders, service desks and other staff.
How do we measure improvement?
Compare reporting rates and time to first report across similar exercises. Review the results with the people involved to understand whether the issue was the message, the reporting route or a gap in training.
What happens if someone clicks?
Provide constructive feedback and a short exercise focused on the missed cues. If the message is genuine rather than simulated, encourage immediate reporting so the security team can investigate.
Can we use this work as audit evidence?
Campaign records and follow-up training can help demonstrate that awareness work took place. Your control owner or assessor decides which evidence is needed for the applicable requirements.
Training or a scoped test?
Choose managed phishing for recurring simulations and coaching. If you want an authorised test of staff procedures or a particular business process, explore social engineering testing.