SAT | Security Awareness Training

SAT (Security Awareness Training) — turn your employees into the first line of defence

According to the annual Verizon DBIR and ENISA reports, the human element is involved in the majority of cybersecurity incidents — from phishing and account takeovers to unintentional data leaks. The classic model of “once a year, a 30-slide presentation” does nothing to change that. Effective Security Awareness Training is a repeatable education programme: controlled phishing simulations, short training modules, practical exercises, and measured effectiveness over time — not a one-off compliance campaign.

Virtline designs and runs SAT programmes for manufacturing companies, financial institutions, healthcare, energy, and public administration. We use KnowBe4, Webroot Security Awareness Training, and the proprietary scenario-based game “Mission: Cybersecurity.” We integrate the training platform with Active Directory and Microsoft 365 (SCIM) to automatically assign modules by department and role, report progress to managers, and deliver audit reports required by NIS2 Article 21, ISO/IEC 27001 A.6.3, and DORA Article 13.

We run the programme in a quarterly cycle: a short phishing campaign, targeted microtraining for those who “clicked,” measurement of click-rate and report-rate (reported suspicious emails), and then programme adjustment for the next quarter. Results are measurable — after 3–6 months we typically observe a halving of click-rate and a clear increase in reporting of suspicious messages.

Benefits of the SAT programme

 Measurable reduction in simulated phishing click-rate — typically halved within 3–6 months relative to baseline.

 Increased suspicious message reporting — employees use the “Report phishing” button in Outlook, reducing response time to real campaigns.

 NIS2, ISO 27001, and DORA compliance — documented employee education programme, on-demand audit reports.

 Fewer BEC incidents — accounting staff identify fake payment instructions and account change requests faster.

 Stronger security culture — employees understand why MFA, password policies, and data classification matter and stop bypassing procedures.

 Lower cyber insurance premiums — cyber insurers increasingly require a documented SAT programme as a policy condition and premium reduction factor.

 Better incident preparedness — employees know how and to whom to report suspicious events, reducing MTTD and MTTR.

How we run the SAT programme — 4 stages

We run the programme in a quarterly cycle, with a baseline assessment at the start and repeatable measurements throughout. Each stage has a clearly defined outcome — from the baseline report to an executive risk dashboard.

1. Baseline and risk analysis — unannounced phishing campaign, identification of most vulnerable departments and roles, mapping training needs to NIS2/ISO 27001/DORA requirements, setting programme objectives and KPIs.

2. Platform deployment and onboarding — integration with Active Directory/Azure AD (SCIM), user import, module configuration per user group, communication preparation for management, launch campaign.

3. Training and simulation cycle — regular phishing campaigns, just-in-time microtraining for those who “clicked,” themed modules (BEC, ransomware, personal data protection, OT/SCADA), “Mission: Cybersecurity” game for selected groups.

4. Measurement and optimization — quarterly report on click-rate, report-rate, frequency-rate trends, industry comparative benchmarking, programme adjustment for the next quarter, results presentation to management and audit committee.

SAT platform integrations we deploy

The training platform must live within the corporate identity and email ecosystem — otherwise it requires manual maintenance. Our standard integrations include:

• Active Directory / Azure AD / Entra ID — automatic user, role, and department synchronization via SCIM and SSO login via SAML 2.0 or OIDC
• Microsoft 365 — “Report phishing” button in Outlook, integration with Defender for Office 365, simulation click reporting
• Google Workspace — Gmail and directory integration, suspicious message report tracking
• Email Security Gateway — coordination with the mail gateway (e.g. WatchGuard, GFI MailEssentials, PhishTitan, ClearSwift) to ensure simulations reach inboxes
• SIEM — export of events (clicks, reports, training completions) to SIEM/SOC, correlation with other signals
• HR and LMS — completion status exchange with HR systems (Workday, SAP SuccessFactors) and corporate LMS if in use

SAT and NIS2, ISO 27001, DORA — requirement mapping

Staff awareness and training are explicitly required by current cybersecurity regulations. Auditors most commonly cite the following references:

• NIS2 Directive (Article 21(2)(g)) — among minimum cybersecurity risk management measures, requires “basic cyber hygiene practices and cybersecurity training.” Applies to essential and important entities and their management.
• ISO/IEC 27001:2022 — Annex A — control A.6.3 Information security awareness, education and training (awareness and training programme for all employees and contractors) and A.6.5 Responsibilities after termination or change of employment.
• DORA Regulation (Article 13) — requires an ICT learning and training programme for all staff, including management, and key ICT service providers of the financial entity.
• GDPR (Recital 39, Article 39(1)(b)) — training of staff involved in personal data processing operations as an element of accountability and one of the DPO’s obligations.