01
Rules and groups
We agree learning objectives, participant numbers, roles, sites, exclusions, communication language and access to results. We review email, the identity platform, existing controls and current report handling.
Security Awareness Training
Security awareness training
We run recurring security awareness programmes: an initial assessment, short role-based training and further phishing simulations. We assess not only clicks but also reporting and IT response. After each cycle, we agree actions and topics for the next exercises.
Trusted by
Companies and institutions that need stable IT.
A programme built on each result
SAT combines learning with repeated assessment of responses. A one-off course provides knowledge, while a separate social engineering test examines selected scenarios; SAT uses successive findings to adjust content, communication and controls. We group participants by department, location and risk: management, finance, sales, IT, production, remote workers and those handling customer data. We consider payments, privileged accounts and any history of phishing, fraud or account takeover.
Services that support SAT
The programme connects with email, user directories and report handling. Related implementations and separate tests are agreed according to need, not included automatically in every cycle. We can agree an exchange of training completion status with an HR system or LMS after checking supported interfaces, the data scope and permissions.
Social engineering tests
Controlled assessment of selected channels and scenarios. These can complement SAT, with a separately agreed scope.Microsoft 365
Administration of email, users and policies. We agree how the environment connects with the SAT platform and suspicious-message reporting.Active Directory
Organising accounts and groups. Connections with AD or Entra ID can support module assignment by role and department.SOC report handling
Assessment of suspicious activity, escalation and recorded decisions. We agree how reports and programme events feed into SOC/SIEM handling.ISO 27001 · TÜV NORD Polska
Virtline's information security management system is certified by TÜV NORD Polska to PN-EN ISO/IEC 27001:2023-08. The published certificate states its scope and validity. The certificate covers Virtline's management system, not the compliance of SAT participants.
View Virtline's certificateHow the SAT programme runs
We agree the pace with the business owner, HR, IT and compliance. The four stages recur in later cycles, with updates to groups, content and actions.
02
Initial assessment
We prepare an agreed phishing scenario and communication rules. We measure clicks, reports and the support team's response, identifying groups needing help. Communication about the programme and its first campaign is agreed before launch.
03
Learning and simulations
We assign short modules according to roles and results. After a click in the simulation, we provide educational feedback; later exercises assess recognition, stopping an unsafe action, reporting and escalation. We adjust communication and exception handling.
04
Report and next cycle
We discuss results, trends and risks with management and responsible teams. We agree owners and priorities for training, technical and process actions. We plan repeat measurement and scenario updates instead of ending the programme at module completion.
Practical scope
What each cycle delivers
Acceptance covers the agreed scope, working reporting channels, a report and assigned actions. Sending a training link does not complete the cycle.
Click rate, report rate, number of reports, training participation and IT or SOC response time. Results are broken down by agreed roles, departments and scenarios. Comparisons account for changes in groups and scenario difficulty; improvement is the goal, not a guaranteed result.
We check the email report button or another agreed channel, routing to IT, SOC or the process owner, initial assessment and feedback to the user. The report identifies escalation problems and records decisions made after analysis.
Scope, cycle date, participants, scenarios, how attendance is confirmed, results and decisions. Short modules and educational feedback after a click reflect group needs. Management, team leaders, IT, HR and compliance receive agreed summaries and findings.
Priorities, action owners, risk remaining after the campaign and the next review date. We separate additional training and communication from changes to MFA, Microsoft 365, email protection, endpoint protection (EDR), backups and incident handling. New scenarios reflect earlier findings and further risks.
What participants learn
We practise recognising false invoices, bank-account changes, urgent transfers and impersonation of management or suppliers: business email compromise (BEC). Account protection covers passwords, fake logins, including Microsoft 365, repeated MFA approval prompts, suspicious application permissions (OAuth consent) and password resets. Ransomware scenarios address attachments, macros, archives and file links. For personal and customer data, we cover information classification, document sharing and wrong recipients. Remote-work topics include personal devices, Wi-Fi and messaging apps. Content reflects participants' responsibilities.
Questions about SAT
How often do you run SAT campaigns?
+
We can run quarterly or semi-annual cycles, or begin with a more intensive starter project. We agree frequency, dates and scenario numbers according to risk and team capacity. The plan covers measurement, learning, reporting and post-campaign actions. We do not impose the same schedule on every business or assume that repetition alone improves results.
How do you protect participants?
+
Before a campaign, we agree its learning objective, confidentiality of individual results, communication language, report access and exception escalation. Communication is agreed with the business owner, HR, IT and compliance. Managers receive group risks and recommendations, not rankings of individuals to punish. Feedback after a click supports learning. An agreed campaign can still affect day-to-day work; we do not promise zero disruption.
Which environments and integrations do you consider?
+
We review Microsoft 365, Google Workspace, the mail gateway, MFA, EDR and any existing reporting button. We agree synchronisation of users, departments, roles and groups with AD or Entra ID, and routing of phishing reports and training events to IT or SOC/SIEM. Integration and button availability are checked against the selected platform and existing licences. If a button is unavailable, we agree another channel. We do not promise to eliminate all manual handling of participant lists and reports.
Does a SAT report confirm compliance?
+
Not by itself. Scope, participation, dates, results, decisions and the next-cycle plan can support NIS2, DORA and ISO 27001 reviews, customer audits and cyber-insurance discussions. The usefulness of the records depends on the review requirements. The programme does not guarantee certification, insurance terms or detection of every phishing attempt. It helps assess behaviour and the reporting process, not just training completion.
Discuss groups, email and goals
Share participant numbers, email system, departments, sites, incident history and current training model. Identify audit requirements and who handles reports. We will use this to agree the initial assessment, learning programme and how the cycle will be reviewed.
Discuss your SAT programme