Security awareness training
Security awareness training that helps your team spot and report attacks
ACS Cyber provides security awareness training and phishing simulations for small and midsize organizations. We teach staff to recognize phishing, business email compromise and executive impersonation, make reporting suspicious messages easy, and show leadership how behavior changes over time.
- Phishing simulations
- Role-based training
- Business email compromise
- Executive impersonation
- Suspicious-message reporting
- Progress reporting
Already clicked a link or sent a payment? If someone entered a password on a suspicious page, call our 24/7 incident line at 1-650-300-7557. If money went to an unexpected account, call your bank’s fraud line first, then call us. See phishing and hacked accounts or business email compromise and wire fraud.
At a glance
Security awareness training, in brief
What it is: Security awareness training teaches employees to recognize and report attacks that target people rather than systems, such as phishing emails, fraudulent payment requests and impersonation of executives or vendors. Effective programs combine short lessons, realistic simulations and ongoing reinforcement.
Who it is for: Small and midsize organizations whose staff handle email, payments, client records or patient information, and any organization whose insurer, customers or framework asks for documented training.
What ACS Cyber does: ACS Cyber is the managed security services provider (MSSP) and cybersecurity division of Atlantic Computer Systems, with an in-house 24/7 SOC. We run the program for you: role-based training, phishing simulations, business email compromise and impersonation scenarios, simple reporting and regular progress reports for leadership.
How to start: Book a free 30-minute consultation or call 1-650-300-7557. We will talk through your roles, current training and recent close calls, then propose a program.
What the program works toward
- Staff know what a modern phishing or fraud attempt looks like
- Unusual payment and banking requests are verified by phone
- Suspicious messages are reported, not quietly deleted
- Leadership can see whether behavior is improving
Is this you?
When organizations invest in awareness training
Programs often start after a close call, a questionnaire or a hard look at how money moves.
A phishing email nearly worked
Someone clicked a link, entered a password or almost paid a fake invoice, and leadership wants to lower the chance of a repeat.
Your insurer or a client asks about training
A cyber-insurance application, customer questionnaire or framework asks whether staff receive security training and phishing simulations.
Payments and banking changes arrive by email
Invoices, wire transfers, payroll changes and vendor banking updates move through email, which is exactly where business email compromise happens.
Training is a once-a-year video
Staff click through an annual module, but nobody knows whether behavior has changed or whether people report suspicious messages.
What’s included
A complete awareness program, run for you
Each program is scoped to your roles, risks and requirements.
Security awareness education
Short, plain-language lessons on phishing, MFA prompts, passwords, safe data handling and fraud, delivered through the year.
Phishing simulations
Realistic, harmless test emails based on current techniques. Anyone who clicks sees a brief explanation of the warning signs, not a reprimand.
Role-based training
Added depth for the roles attackers often target: finance, HR and payroll, executives and their assistants, IT administrators and front-desk staff.
Business email compromise training
How to spot payment-redirection requests, lookalike domains, compromised vendor accounts and urgent banking changes, and how to verify them.
Impersonation scenarios
Scenario-based training on emails, texts and calls that appear to come from an owner, executive or partner, including calls that use a voice cloned or altered with AI.
Reporting suspicious messages
A simple way to report a suspicious email from the inbox, and clear guidance on what happens next, so reporting becomes a habit.
Ongoing reinforcement
Brief follow-up lessons, timely advisories when a new scam is circulating, and extra coaching for people who need more practice.
Improvement reporting
Regular reports on simulation results, reporting behavior and training completion by department, written for leadership.
The attacks that target trust
Business email compromise and executive impersonation
Business email compromise (BEC) is fraud in which an attacker uses a compromised or lookalike email account to trick staff into sending money or sensitive information. It often involves no malware at all, so filters may not catch it. Trained people and clear verification steps often can.
Executive impersonation follows the same pattern across other channels. An attacker poses as an owner, partner or executive by email, text or phone, sometimes with a voice that has been cloned or altered using AI, and asks for an urgent payment, gift cards or a payroll change.
Our training builds one habit above all: verify unusual requests through a separate, known channel before acting, however convincing the request looks. We also help leadership set simple rules, such as call-back verification for any change to banking details.
If a fraudulent payment has already been sent, call your bank’s fraud line right away to ask about a recall, then call our 24/7 incident line and report the fraud to the FBI’s Internet Crime Complaint Center (IC3). See business email compromise and wire fraud response.
Warning signs we train people to notice
- Urgency, secrecy or pressure to skip normal approvals
- A new or changed bank account for a familiar vendor
- A sender or reply-to address that is almost, but not quite, right
- Requests for gift cards, payroll changes or tax forms
- A familiar voice asking for something unusual on a call or voicemail
- Unexpected MFA prompts or sign-in pages asking for a password
Reporting suspicious messages
What we teach staff to do when something looks wrong
Reporting is one of the most valuable habits training can build. One quick report can warn colleagues, let IT pull a message from other inboxes and give responders an early start.
People report more when they know they will not be blamed. We encourage a no-blame approach, because the most damaging mistake is the one nobody mentions.
01
Pause
Treat urgency, secrecy and unusual requests as reasons to slow down, not speed up.
02
Verify
Confirm requests for money, credentials or data through a known phone number or in person, never by replying to the message.
03
Report
Use the report option in the inbox or tell IT, even if the message seems harmless.
04
Speak up if you clicked
Anyone who entered a password or approved an unexpected prompt should report it immediately. See phishing and compromised accounts.
How the program works
From baseline to lasting habits
The program runs continuously and adjusts as your people improve and attackers change tactics.
01
Baseline
We learn your roles, current training and recent close calls, and run an initial simulation to see where you are starting from.
02
Plan
We agree on topics, role-based tracks, schedule and how simulation results will be shared and used.
03
Train
Staff complete short lessons, with added modules for finance, HR, executives and IT administrators.
04
Simulate
We send phishing and impersonation simulations at varied times and difficulty levels, modeled on real techniques.
05
Reinforce
Follow-up lessons, scam advisories and coaching close the gaps that simulations reveal.
06
Report and adjust
We review trends with leadership and adjust topics, difficulty and process recommendations.
Measurable improvement
How we show that training is working
Training is only worth the time if behavior changes. We report the trends that show whether it has: how often people click simulated phishing, how often and how soon they report suspicious messages, progress among repeat clickers and training completion.
Reports are organized by department and role, so leadership can see where coaching or a process change would help. We agree in advance how individual results are handled, and the focus stays on patterns, not on embarrassing anyone.
The same records document your program for insurers, customers and frameworks that ask about workforce training.
What leadership sees
- Simulation results over time, by department
- Reporting trends, including how soon the first report arrives
- Training completion status
- Where additional coaching would help
- Recommended process changes, such as payment verification rules
Framework alignment
How training supports your obligations
Workforce security training is a common expectation in frameworks, contracts and insurance applications.
| Framework or requirement | Relevant expectation | How this service supports it |
|---|---|---|
| HIPAA Security Rule | A security awareness and training program for all workforce members | Training records, simulation results and security reminders that document your program |
| PCI DSS | A security awareness program for personnel, including phishing and social engineering | Phishing and social engineering training with completion records for your assessment |
| NIST CSF 2.0 | Awareness and training so people can perform their cybersecurity-related tasks | Role-based training and progress reporting |
| CIS Controls | A security awareness and skills training program | Ongoing education, simulations and role-specific modules |
| GLBA and FTC Safeguards Rule | Security awareness training for staff of covered financial institutions | Training content and records for tax, lending and accounting teams |
| Cyber-insurance applications | Questions about phishing training and simulations | Current records that support accurate answers |
Supporting a requirement is not the same as meeting it. Your auditor, assessor or carrier makes that determination. See risk and compliance readiness.
Training backed by technical controls
When training reveals a gap, we fix it in the IT
Training is strongest when technical controls make attacks harder to land: email authentication, multifactor authentication, Conditional Access and a report button in every inbox. Atlantic Computer Systems, our parent company, covers email authentication and MFA in its cybersecurity guides for businesses.
ACS Cyber is the cybersecurity division of Atlantic Computer Systems, which provides managed IT, including helpdesk and Microsoft 365 administration. When a simulation or a real report exposes a gap, such as weak email settings or a missing approval step, the fix is carried through in the underlying IT.
Controls that back up training
- Email authentication with SPF, DKIM and DMARC
- Multifactor authentication and Conditional Access
- A report-message button in Microsoft 365 or Google Workspace
- Payment-verification procedures for finance teams
- 24/7 monitoring by our in-house SOC through managed detection and response
Ready to see where your team stands?
In a free 30-minute consultation, we will talk through your roles, recent close calls and requirements, and suggest how to begin.
Related services
Protection for when an attack gets through
Managed detection and response
24/7 monitoring and human-led investigation by our in-house SOC, for the attacks that get past people and filters.
Incident response
In-house investigation and containment when a phishing email or fraud attempt succeeds.
Vulnerability management
In-house penetration testing, including social engineering tests of how staff respond.
FAQ
Security awareness training questions
Security awareness training is an ongoing program that teaches employees to recognize and report threats that target people, such as phishing, business email compromise and impersonation. Good programs combine short lessons, realistic simulations, easy reporting and progress measurement.
ACS Cyber, the cybersecurity division of Atlantic Computer Systems, provides security awareness training and phishing simulations for small and midsize organizations. We provide nationwide support, headquartered in San Jose, California, with an office hub in Boston.
We send realistic but harmless test emails to staff on a varied schedule. If someone clicks, they see a short explanation of the warning signs they missed. Results are tracked over time to measure improvement and target coaching.
Not as part of our program. We treat clicks as coaching opportunities and recommend a no-blame approach, because people who fear blame are less likely to report a real mistake. How results are used is your decision, agreed in advance.
Teach finance, HR and executive staff to recognize payment-redirection and banking-change requests, and require call-back verification through a known phone number before any payment or banking change. We combine role-based training, simulations and help writing that procedure.
Yes, by teaching verification rather than detection. A cloned or altered voice can be convincing, so we train people to confirm unusual requests through a separate, known channel, however familiar the caller sounds.
We track trends rather than single results: simulated phishing clicks, how often and how soon people report suspicious messages, progress among repeat clickers and training completion, reported to leadership by department.
Report it right away to IT or security, even if nothing seemed to happen. If they entered a password or approved an unexpected sign-in prompt, treat the account as possibly compromised and call our 24/7 incident line at 1-650-300-7557. See phishing and compromised accounts.
Training supports those requirements but does not satisfy them on its own. The HIPAA Security Rule, PCI DSS and many insurance applications expect workforce training, and our records help document it. Your auditor, assessor or carrier makes the determination. For HIPAA-specific guidance, see the HIPAA compliance resources from Atlantic Computer Systems, our parent company.
Next step
Make your people part of your defense
Talk with ACS Cyber about training, simulations and reporting sized to your organization. If a phishing email or fraud attempt has already succeeded, call our 24/7 incident line or see Have you been compromised?