What IT Security Awareness Training Involves
Every firewall, every penetration test, every compliance certificate can be undone by one employee clicking the wrong link in a convincing M-PESA phishing email or WhatsApp scam message. Human error remains the single leading cause of cyber breaches worldwide, and Kenyan and East African organisations are a particularly active target for social engineering precisely because of how central mobile money and messaging apps are to daily business life. Technology alone cannot fix this — it requires people who recognise the threat and know exactly what to do about it.
Our security awareness training moves beyond the once-a-year compliance video that nobody remembers. We run realistic simulated phishing campaigns tailored to local scam patterns — fake M-PESA confirmations, courier delivery scams, business email compromise attempts impersonating a CEO — deliver short interactive training modules staff actually engage with, and help build security champions programmes that embed security-minded people within each department.
What makes an awareness programme work is measurement, not good intentions. Every campaign tracks click rates, reporting rates and time-to-report, giving leadership a genuine, evolving picture of organisational risk rather than a one-time snapshot. Departments and individuals who need additional support are identified through data, not guesswork, and training content is refined continuously based on what the simulations reveal about real behaviour.
The result is a measurable shift in behaviour — fewer clicked phishing links, faster reporting of suspicious activity, and a workforce that treats security as part of the job rather than an IT department's problem to solve alone. For organisations pursuing ISO 27001 or facing regulator scrutiny, the programme also produces the documented evidence of staff training and improvement that a compliance audit specifically requires.
The Problems Behind the Request
Organisations rarely come to us asking for a technology by name — they come with a business problem. Here is what typically drives demand for it security awareness training.
Staff Falling for Localised Phishing Scams
M-PESA impersonation, fake delivery notifications, and WhatsApp-based social engineering exploit employees far more reliably than any technical vulnerability.
A Forgettable, Once-a-Year Compliance Video
Annual training satisfies an audit checkbox but produces no measurable change in staff behaviour between sessions.
No Visibility Into Actual Risk Level
Leadership has no data on which departments or individuals are most likely to click a malicious link, so training spend is not targeted where it matters.
Suspicious Activity Going Unreported
Staff who do notice something suspicious often do not know how, or feel too unsure, to report it before damage is done.
Compliance Frameworks Requiring Evidence
ISO 27001 and other frameworks require documented staff training and measurable awareness — a generic slide deck does not satisfy this.
High Staff Turnover Diluting Awareness
Fast-growing organisations onboard new staff continuously, and security awareness quietly erodes without a consistent onboarding programme.
How It Fits Into Your Environment
A reference architecture showing how this service integrates with your existing systems, data, and infrastructure to produce a measurable business outcome.
What We Deliver
Localised Phishing Simulations
Campaigns built around real Kenyan and regional scam patterns — M-PESA fraud, WhatsApp scams, courier and business email compromise attempts.
✓ Training that mirrors what staff actually faceInteractive Micro-Learning
Short, role-specific training modules covering passwords, social engineering and safe device use, designed to be remembered.
✓ Engagement instead of a skipped compliance videoSecurity Champions Programme
Trained advocates embedded across departments who keep awareness alive between formal campaigns and training sessions.
✓ Security culture that persists day to dayBehavioural Measurement
Click rates, reporting rates and time-to-report tracked continuously, at organisational and department level.
✓ Data-driven view of real organisational riskExecutive & Board Briefings
Clear, board-ready reporting on social engineering risk and organisational exposure, in language non-technical leaders understand.
✓ Security investment decisions backed by evidenceNew-Hire Security Onboarding
Consistent, customised security training built into your onboarding process so awareness does not erode as you grow.
✓ Culture survives staff turnover and rapid growthCapability-by-Capability Breakdown
| Capability | Description | Business Value | Technologies | Deliverable |
|---|---|---|---|---|
| Baseline Assessment | An initial simulated phishing test establishes your organisation's current susceptibility level before any training. | A real starting point, not an assumption | GoPhish-style simulation platform | Baseline risk assessment report |
| Programme Design | Training content, campaign cadence, and champions programme structure tailored to your teams and risk areas. | Relevant training staff actually engage with | Moodle, custom content design | Tailored awareness programme plan |
| Phishing Simulation Delivery | Ongoing simulated phishing campaigns using scenarios relevant to Kenyan and regional scam trends. | Real-world tested reflexes, not theory | GoPhish-style tooling, WhatsApp-pattern scenarios | Monthly simulation campaign results |
| Interactive Training Delivery | Short, role-specific modules and live sessions covering passwords, social engineering and safe device use. | Knowledge retained, not forgotten by next week | Moodle, Zoom, video micro-learning | Completed training records per employee |
| Security Champions Network | Identifying, training and supporting security-minded advocates embedded in each department. | Awareness sustained between formal campaigns | Champions playbook & activity calendar | Active champions network with documented role |
| Measurement & Reporting | Ongoing tracking of click rates, reporting rates, and improvement trends, with board-ready summaries. | Evidence-based, auditable improvement | Power BI dashboards | Quarterly progress dashboard & report |
Built for Your Sector's Realities
Healthcare
Training clinical and administrative staff to protect patient data from social engineering attacks.
Government
Awareness programmes for civil servants handling sensitive citizen and national data.
Banking & Finance
Training staff with direct access to customer funds against targeted financial social engineering.
Agriculture
Awareness training for cooperative staff handling farmer payment and data systems.
Manufacturing
Protecting procurement and finance teams from business email compromise and invoice fraud.
Education
Training faculty and administrative staff handling sensitive student and research data.
Retail & E-commerce
Awareness training for staff handling payment systems and customer data during peak periods.
Insurance
Training staff handling policyholder data against social engineering and claims fraud tactics.
NGOs & Development
Awareness training protecting donor funds and beneficiary data from targeted scams.
Tools & Platforms We Use
Moodle LMS
Zoom
WhatsApp
YouTube
VimeoA Structured Approach, A Guaranteed Outcome
Deliverables
Everything Handed Over at Project Close
- Baseline phishing susceptibility assessment to measure your organisation's current risk level
- Ongoing simulated phishing campaigns using scenarios relevant to Kenyan and regional scam trends
- Interactive, role-specific training modules covering passwords, social engineering, and safe device use
- A security champions programme that embeds trained advocates across departments
- Executive and board-level briefings on social engineering risk and organisational exposure
- Progress dashboards showing click rates, reporting rates, and improvement over time
- Customised onboarding security training for new employees
- Documented training records suitable for ISO 27001 and regulatory compliance evidence
- A recognition and incentive framework to sustain staff engagement with the programme
Real Results, Real Impact
Cutting Phishing Click Rates at a Regional SACCO
The SACCO went from repeated near-miss incidents to a workforce that consistently identified and reported simulated phishing attempts, with the improvement documented for its ISO 27001 audit.
Stopping Business Email Compromise at a Manufacturing Firm
Finance staff now consistently apply a verification protocol before processing unusual payment requests, closing the exact gap that nearly resulted in a significant fraud loss.
Building a Security Culture at a Growing University
Security awareness now persists despite regular staff turnover, with new hires trained from day one and champions sustaining culture between formal campaigns.
What Clients Typically See
An Enterprise-Grade Delivery Partner
Genuinely Localised Scam Patterns
Phishing simulations built around real Kenyan scam patterns — M-PESA fraud, WhatsApp scams, and local business email compromise tactics.
Engaging, Memorable Content
Interactive content designed to be remembered, not another ignored annual compliance checkbox nobody watches.
Champions Model That Sustains Culture
A security champions network that keeps awareness alive between formal training sessions, not just during campaign weeks.
Clear, Board-Ready Reporting
Data-driven reporting that shows measurable improvement over time, in language leadership can act on immediately.
Compliance-Grade Documentation
Training records and evidence structured to satisfy ISO 27001 and regulatory staff-training requirements.
A Programme, Not a One-Off Event
Ongoing campaigns and refinement based on real behavioural data, not a single training day and no follow-up.
Common Questions From Buyers
Because human error remains the leading cause of breaches worldwide — a single employee clicking a convincing phishing link can bypass firewalls, antivirus, and every other technical control you have in place.
Our programme uses localised, ongoing simulated phishing and short interactive modules measured continuously, rather than a single long annual video that produces no measurable behaviour change and is quickly forgotten.
No. The programme is designed around coaching, not punishment — staff who click a simulation receive immediate, supportive micro-training explaining what to look for next time, building awareness rather than fear.
Most organisations see a measurable reduction in click rates and increase in reporting behaviour within 90 days of programme launch, with continued improvement as campaigns and champions activity continue.
A network of trained, security-minded volunteers embedded in each department who reinforce awareness day to day, answer basic questions, and model good security behaviour between formal training sessions.
Yes. Finance teams receive business-email-compromise-focused content, IT staff receive more technical scenarios, and general staff receive broader social engineering awareness — content is matched to actual role risk.
Yes, training content and phishing scenarios can be adapted to include Swahili and other locally relevant language elements where that better reflects how staff are actually targeted.
Monthly is typical for most organisations — frequent enough to build a consistent reflex without training fatigue, though cadence is adjusted based on your risk profile and baseline results.
Yes. Documented training records, completion tracking, and measurable improvement evidence are structured to support ISO 27001 Annex A staff awareness requirements, though certification decisions rest with your certifying body.
Yes. Training is delivered through a mix of online modules, video content and live sessions accessible to remote, field, and multi-branch staff, not only head-office employees.
Quarterly board-ready reports showing click rates, reporting rates, department-level trends, and year-over-year improvement, translated into plain-language risk terms rather than raw statistics.
Repeat clickers receive additional targeted coaching and, where a role carries elevated risk, we work with you on appropriate additional safeguards — the goal is always improvement, not disciplinary escalation as a first response.
Yes. New-hire security training is designed to plug directly into your existing onboarding workflow so awareness is built in from day one rather than added later.
Pricing is based on staff headcount, programme scope, and campaign frequency, confirmed after an initial scoping discussion — typically offered as an ongoing annual programme rather than a one-off engagement.
We provide fully developed, ready-to-deploy interactive training content and phishing scenarios, customised to your organisation and sector — you are not required to build anything yourselves.
You May Also Need
Experts for IT Security Awareness Training
Meet DollarEdge-verified consultants and strategic partners with hands-on expertise in this practice area.
Ready to Build IT Security Awareness Training?
Book a discovery call with our consultants and get a tailored proposal, timeline and cost estimate for your organisation.