Nineteen modules. One rule each.
Every module puts people in front of real-looking requests, then sends them back to work with a single rule they can say out loud. Packages are built from these four families.
The protocol
The A.W.A.R.E protocol. The spine of every package.
The A.W.A.R.E protocol
Four real-looking messages open it. One of them is genuine. People learn to name the ask, slow the clock and check on a channel they choose.
The rule: Assess the ask. Then ask.
Scenario rounds
Twenty-minute rounds on the attacks people see every week.
Sign-in pages and fake links
Fake sign-in pages, look-alike addresses, and pages that steal the code from your phone.
The rule: Never sign in from a link. Go the way you always go.
Codes, prompts and the helpdesk
Fake IT support, repeated sign-in prompts, and requests to read out or type a code.
The rule: If you didn’t start the sign-in, the code isn’t yours to give.
Calls from “the bank”
Fraud-desk impersonation, spoofed caller ID, SIM swap and mobile money fraud.
The rule: Nothing secret, nothing moved, on a call you didn’t make.
Texts, WhatsApp and QR codes
Parcel fees, traffic fines, refunds and QR stickers that lead to payment pages.
The rule: Typed, not tapped. Look it up in the app or address you know.
Faces and voices
Cloned voices, deepfake video calls and voice notes from “the boss” or family.
The rule: Don’t try to spot the fake. The call-back decides.
Where money goes
Changed banking details on invoices, and fake salary change requests.
The rule: A change of banking details is always the ask.
Data favours and AI tools
Requests for staff lists and personal information, and pasting work into free AI tools.
The rule: Who’s asking, why, and which way. A tool is a channel too.
Files and fake fixes
Unexpected attachments, fake updates, and “press these keys to prove you’re human”.
The rule: Expected, and no extra step. If it asks for one, stop.
Role labs
A live simulation of the team’s own process, in Gauntlet.
Money movers
For finance, accounts payable, procurement, approvers.
A live month-end: release the genuine payments, stop the fakes, before cut-off.
The rule: Every change to where money goes gets a call and a second yes.
People data
For hr, payroll, and anyone holding staff or citizen data.
Salary diversion, fake auditors and staff-list requests, handled live under POPIA.
The rule: The minimum, through the approved channel, to a verified person.
Gatekeepers
For it helpdesk, call centres, reception, switchboard.
Holding the identity check against an escalating caller, including a fake executive.
The rule: No reset without verification. Rank and anger don’t change the rule.
Principal’s circle
For executive assistants, pas, chiefs of staff, drivers.
A day of out-of-pattern requests in the principal’s name, by voice note, new number or video.
The rule: Calling your principal back is loyalty, not doubt.
Leadership
Decisions only leaders can take, practised under the Chatham House rule.
You are the target
Why leaders are the face, voice and signature attackers copy.
The rule: Your authority is the attacker’s best tool.
Expect: safe to check upward
How deference to seniority becomes the way in, and how leaders switch it off.
The rule: “If I ever ask you for money, data or access, call me back.”
Approving money safely
Overrides, deadlines and the “just this once” approval, decided under time pressure.
The rule: Never override the control. Say so in public.
Your public exposure
What attackers learn from profiles, speeches, travel and family posts.
The rule: Less in public means less to copy.
Tabletop: the first 24 hours
A ransomware incident with an impersonation twist, on a real clock.
The rule: Decide who decides, before it happens.
Facing the media
The first public statement after an incident, practised in a simulated media call.
The rule: Say what you know, what you’re doing, and when you’ll say more.
Five questions for leaders
How to govern cyber risk without being a technical expert.
The rule: Ask the five questions every quarter. Expect clear answers.
Every round ends with a rule.
Start with a setup call. We’ll recommend the package that fits your risk, and set dates away from month-end and payroll. Our advice: start with Helm or the Board Briefing, so your leaders go first.