Security awareness & phishing simulations | Newblend
Newblend Book an introduction
Behaviour

Security awareness

Most incidents start with an employee clicking something, forwarding something or reusing a password. That is where most can be gained, and awareness is explicitly part of the duty of care.

In short
  • Periodic training in short modules people actually finish.
  • Realistic phishing simulations, tailored to your sector and house style.
  • Reporting per department: who is improving, where extra attention is needed.
  • A password manager in every workplace, so passwords are not reused.
  • Included in the Protect and Assure blends; tailored training through Spike Academy.
Last updated: 5 August 2026
Diagram · awareness cycle
01 Baseline
Where the team stands today
02 Training per role
Examples from their own work
03 Simulation
Announced that testing happens, not when
04 Feedback
Per department, not per person
05 Repeat
Every quarter, with new examples
What we measure
Clicks
Who opened the link
Entering credentials
The most serious step
Reporting
The number that should rise
In a real attack, reporting speed decides whether you block one account or fifty. So we report at department level, without holding individuals to account.

Awareness is a cycle, not a one-off training. Reporting speed is the number we want to see rise.

Approach

How we approach it

Short modules

Periodic training in blocks of a few minutes, instead of one session a year nobody remembers. Made relevant per role.

Phishing simulations

Realistic test emails, tailored to your sector and your own house style. Anyone who clicks gets an explanation straight away instead of a telling-off.

Rapportage

Progress per department and over time. You see where extra attention is needed and can demonstrate you work on it structurally.

Reporting culture

We also measure whether people report suspicious mail. That figure often says more about your resilience than the number of clicks.

Password manager

Included in every onze blends. Without a good manager people keep reusing passwords, however much training you give.

Tailored training

Want to go beyond awareness? Our colleagues at Spike Academy specialise in training courses and e-learnings.

To spike.academy
Tone

A simulation is not a reckoning

If a phishing simulation feels like a trap, people start covering themselves. They report less, they ask less, and the measure works against you. So we communicate in advance that testing happens, and report results at department level instead of per person.

The question is not who fell for it. The question is whether someone reported it, how fast that happened and whether the organisation responded faster afterwards. That is what counts in a real attack.

Required when using AI

Since February 2025 the AI Act requires staff working with AI to be sufficiently AI literate. That fits the same training approach. Read more about AI adoption and training.

Frequently asked questions

How much time does this cost our staff?

A few minutes a month. That works better than an annual hour-long session, and it sticks longer.

May we see who fell for it?

Technically possible, but we do not advise it as a starting point. Department-level reporting produces more behavioural change than a list of names.

Can we suggest our own scenarios?

Please do. A simulation resembling mail you really receive, for example from a supplier or about an invoice, teaches the most.

Is this in our package?

Awareness training and phishing simulations are in the Protect and Assure blends. With Prevent alone they can be added separately.

Read on

Want to talk it over?

Book a half-hour introduction. We are happy to think along, even if you are not sure yet what you are looking for.