Business Email Compromise
Attackers impersonate executives or suppliers, often using urgency to manipulate employees into transferring funds or sharing sensitive information.
The Reality
Cybercriminals are targeting people first.
Attackers no longer rely solely on malware or technical exploits. They use trust, urgency, authority and routine business processes to manipulate employees into revealing credentials, approving payments or opening malicious links. AI-generated phishing has made these attacks more convincing than ever — and traditional filters can't catch all of them.
82
%
of breaches involve a human element
3
x
more convincing phishing emails written with AI
1
in3
employees click on a phishing link without training
5
x
improvement in awareness with continuous training
What Your Team Is Up Against
The human-focused attacks your people face every day
These are the modern social engineering techniques designed specifically to bypass technology and exploit human trust.
Training prepares your team to spot them in the moment.
Training prepares your team to spot them in the moment.
Credential Harvesting
Employees are directed to highly convincing fake login pages that mirror Microsoft 365, Google or banking portals to capture usernames and passwords.
QR Code Phishing (Quishing)
Emails use QR codes rather than traditional links to bypass email filtering and direct users to malicious destinations on their personal mobile devices.
Supplier & Vendor Impersonation
Attackers compromise trusted business relationships and continue real email conversations with fraudulent invoice or payment-detail change requests.
AI-Generated Social Engineering
AI tools eliminate the traditional red flags: no spelling errors, no awkward phrasing, making phishing messages indistinguishable from genuine correspondence.
Targeted Spear Phishing
Highly personalised messages built from publicly available information (LinkedIn profiles, conference attendance, recent company news) to feel authentic and earn trust.
The Missing Layer
Your people are the layer technology can't replace.
Email filters, endpoint protection and identity controls stop most attacks — but the ones designed to bypass technology need a human to see through them. That's not a weakness. It's an opportunity.
Email Security
Filters known threats & malware
Endpoint Protection
Detects malicious activity
Identity Security
MFA & access controls
Aware People
Spot what technology misses
Technology stops the predictable. People stop what technology can't see. Together they form layered defence — and the people layer is the one most organisations leave underdeveloped.
How It Works
Continuous, realistic, supportive
not annual and punitive.
not annual and punitive.
Four capabilities working together to build a security-conscious workforce — and the evidence to prove it.
Realistic Phishing Simulations
Safe, controlled phishing emails mirror current real-world techniques, including BEC, AI-generated messages, QR phishing and supplier impersonation, to test responses in context.
In-the-Moment Learning
When someone interacts with a simulation, they get immediate, supportive educational feedback, turning the moment into a memorable lesson, not a reprimand.
Measurable Risk Visibility
Track phishing susceptibility, reporting rates and department-level risk over time. Identify high-risk groups and target additional support exactly where it's needed.
Continuous Improvement
Scenarios and content evolve with the threat landscape: new AI-generated phishing techniques, emerging social engineering patterns, current attack trends.
The Improvement Journey
What real behavioural change looks like.
Awareness doesn't change overnight — and it shouldn't.
Sustainable culture change happens in stages, with measurable progress at every step.
Sustainable culture change happens in stages, with measurable progress at every step.
Month
01
Baseline Established
First simulation reveals current awareness levels and identifies high-risk groups.
01
Month
2-3
Initial Awareness
Click rates drop as employees recognise common phishing patterns. Reporting starts to rise.
2-3
Month
3-4
Behavioural Habits
Pausing-before-clicking becomes routine. Reporting rates climb steadily. Culture shifts.
4-5
Month
6+
Resilient Workforce
Strong, lasting awareness. Faster reporting. Measurable improvement to defend at audit.
6+
The Difference
Annual training vs. Continuous Awareness
Most organisations still treat security training as a once-a-year tick-box.
Here's how that compares to a programme designed for genuine behavioural change.
Here's how that compares to a programme designed for genuine behavioural change.
The Old Way
Annual Training
A once-a-year compliance exercise
Frequency of learning
Once a year, then forgotten
Realism of testing
Hypothetical examples
Response to evolving threats
12 months out of date
Tone & approach
Compliance tick-box
Measurable improvement
Completion rates only
Reporting culture
Reporting rarely encouraged
The Intouch Way
Continuous Programme
An always-on behavioural change engine
Frequency of learning
Bite-sized, monthly reinforcement
Realism of testing
Real-world simulations
Response to evolving threats
Updated with new threats
Tone & approach
Supportive & behavioural
Measurable improvement
Real behavioural data
Reporting culture
Reporting actively rewarded
Business Outcomes
What a security-aware workforce gives you.
This isn't compliance training. It's a measurable, ongoing improvement in your organisation's resilience
— and the evidence to demonstrate it to boards, auditors and insurers.
— and the evidence to demonstrate it to boards, auditors and insurers.
Reduced Human Risk
Phishing click-rates fall measurably and stay down. Employees recognise and avoid attacks before they become incidents.
Stronger Security Culture
Security stops being IT's problem and becomes everyone's responsibility, visibly, measurably, and in a way people actually engage with.
Faster Threat Reporting
Suspicious emails are reported in minutes, not hours. Your SOC and IT team see threats early, before they reach colleagues.
Measurable Improvement
Click rates, report rates, time-to-report, all trending in the right direction, all defensible at board meetings, audits and insurer renewals.
Compliance & Governance
Always-on evidence for Cyber Essentials, Cyber Essentials Plus, ISO 27001 and cyber insurance, the proactive human risk management auditors look for.
Organisational Resilience
Fewer incidents reach production. Fewer breaches start with email. Your business continues, because your people caught what tech missed.
Built for:
IT Directors
Security Managers
HR & People Teams
Compliance Managers
Executive Teams
Finance & Procurement
MSPs
Get Started
Find out where your team stands today.
Book a free security awareness assessment. We'll baseline your team's current phishing readiness, identify high-risk groups, and design a programme that builds lasting behavioural change.
FAQ
Security Awareness questions
Answers to the questions UK businesses ask us most about Security Awareness & Phishing Simulations.
What is security awareness training?
It's ongoing training that helps your staff spot and handle cyber threats, especially phishing, social engineering and impersonation. Paired with realistic simulations, it changes how people behave over time instead of being a once-a-year tick-box exercise.
How are phishing simulations delivered?
We send your team realistic, controlled phishing emails that copy the tricks attackers use right now. If someone clicks, they get immediate, friendly feedback there and then, so it turns into a lesson rather than a telling-off.
Isn't training just blaming employees for security failures?
Quite the opposite. Good awareness training supports people, it doesn't punish them. The aim is to give your team the confidence to spot and report threats, and to build a culture where reporting is welcomed. We never trot out the 'users are the weakest link' line. People are the layer that catches what the technology misses.
How do you measure success?
We track phishing click rates, how many people report suspicious emails, how quickly they report, and how awareness trends by department. You get clear evidence of improvement over time, which is exactly what your board, auditors and cyber insurers want to see.
Does this help with Cyber Essentials and ISO 27001 compliance?
Yes. The training feeds the staff-education and human-risk controls that Cyber Essentials, Cyber Essentials Plus, ISO 27001:2022 and most cyber insurance policies expect, and it produces the ongoing evidence auditors look for.
How long are training sessions?
Short and regular, usually three to five minutes, rather than one long annual course. Little and often sticks far better for memory and behaviour, and it slots into the working day without getting in the way.
Can the programme be customised to our industry?
Yes. We tailor the scenarios and content to your industry and to each team's real risks. Finance sees invoice fraud, HR sees CV-based malware, executives see CEO impersonation, and so on.
FREE SECURITY AWARENESS ASSESSMENT
See Where Your Team Stands on Phishing
We'll baseline your team's phishing readiness, flag the highest-risk groups, and design training that changes behaviour. Phishing simulations and reporting aligned to Cyber Essentials Plus and ISO 27001.
0333 370 7000
Mon-Fri 8am-5pm · 24/7 for managed clients
[email protected]
Response within 1 business day, guaranteed
United Kingdom
UK-based team, since 2012
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
