Baseline
A first simulated phishing round and a short staff survey show where you start.
Security awareness training: cybersecurity training services for every role
Security awareness training teaches your people to recognise social engineering, phishing and unsafe data handling, and to report them fast. Arke Technologies, in Johannesburg, provides cybersecurity training services to organisations, public bodies and schools across South Africa: role-based sessions, simulated phishing and reporting your board or governing body can use.
What is social engineering? The meaning in plain terms
Social engineering is manipulating people, rather than hacking systems, into giving away access, information or money. In cyber security the pattern is consistent: an attacker poses as someone you trust, creates urgency or fear, and asks for one action, such as a click, a password, a one-time PIN, a payment or a door held open. It exploits helpfulness, respect for seniority and speed, which is why technology alone cannot stop it and why training sits beside the technical controls in our cybersecurity services.
In South Africa, social engineering often looks like this:
- A "SARS eFiling" email promising a refund, linked to a fake log-in page.
- An SMS about a courier parcel or a bank alert, asking you to "verify" your details.
- A supplier's "new banking details" letter, sent from a hijacked or look-alike mailbox.
- A fake request for quotation or purchase order in a government department's or university's name, aimed at suppliers.
- A call from "IT support" or "the bank" asking for a one-time PIN.
Why cybersecurity training matters to boards, councils and governing bodies
Training is an organisational safeguard, and the frameworks your auditors use expect it:
- POPIA. Section 19 requires appropriate technical and organisational measures, and regulation 4 requires the Information Officer to ensure internal awareness sessions are held; see POPIA compliance.
- ISO/IEC 27001. Annex A control 6.3 requires information security awareness, education and training; see ISO 27001 readiness.
- NIST Cybersecurity Framework. Awareness and training is a named category of its Protect function.
- King IV, PFMA and MFMA. King IV Principle 12 puts technology and information risk before the governing body, and accounting officers must manage risk to public money and records. Training records form part of the evidence.
In schools, educators, administrators and bursars handle learner and parent records; see cybersecurity, POPIA and online safety for schools. In municipalities and departments, councillors and finance officials are frequent targets; see cybersecurity for government, municipalities and SOEs.
Our cybersecurity training services
Our security awareness programme is built around your risks rather than a generic course library:
Awareness for everyone
Short live sessions on social engineering, passwords and multi-factor authentication, email safety, personal devices at work and how to report.
Role-based training
Deeper sessions for finance and procurement (payment fraud), HR (personal information and payroll data), leadership and councillors (targeted attacks and deepfakes), IT administrators (privileged accounts), and educators and school administrators (learner data and online safety).
Social engineering tests
Simulated phishing and, by written agreement, other tests through the year.
Safe use of AI
What staff may and may not paste into public AI tools, in line with your policy; see AI governance.
Induction and refreshers
A session for new starters and an annual refresher tied to your own policies.
Sessions run live online or, by agreement, on site. Follow-up lessons run through Microsoft's attack simulation training where your licences include it, or through your own learning management system.
Social engineering tests and phishing simulations
A social engineering test measures how people respond to a realistic, harmless attack. The most common form is a phishing simulation: a fake email, built on lures your sector actually receives, sent with management's approval. Where Microsoft Defender for Office 365 Plan 2 is licensed (it comes with Microsoft 365 E5), we run simulations through its attack simulation training, and we run equivalent simulations on other email platforms. Every test follows three rules:
- Written authority first. Management and HR sign off scope, templates and dates. Phone-based or physical tests happen only with explicit written approval, usually within a penetration test.
- Teach, do not shame. Anyone who clicks sees a short lesson at once, and individual results go only to the people who need them.
- Measure reporting, not only clicking. The number that matters most is how many people report a suspicious message, and how quickly: where we manage your email, an early report lets us remove a real phishing email from other mailboxes before more people open it.
The technical set-up behind simulations, from the report button to mail-flow rules, is covered on our email security page.
Measuring whether training works
Awareness is measured by behaviour, not attendance. The measures we report:
- Completion of assigned training, by department.
- Click rate and credential-entry rate in simulations, by difficulty.
- Report rate, and the time from delivery to first report.
- Repeat clickers, who get extra support rather than blame.
- Real suspicious messages reported, and incidents traced to human error.
Trends matter more than any single round, so each measure is shown over time. Paired with a cybersecurity assessment, the results show whether your people and your systems are improving together.
What cybersecurity training costs
Last reviewed: September 2026.
Cybersecurity training services are priced on four things: how many people take part, how many role-based tracks you need, how often simulations run, and whether sessions are live online or on site. Licensing matters too: if you already own Microsoft Defender for Office 365 Plan 2, the simulation tooling is included. Training can be quoted as a standalone annual programme or included in a managed security SLA priced per user per month, alongside services such as managed detection and response. We publish no fixed training rates, because group size and the number of tracks change the work more than anything else. We quote after a short discovery call, and the quote lists every session, simulation round and report.
Governance, compliance, procurement and continuity
- Reporting and change control. Monthly results in your service review, an annual summary written for a board, council or governing body, and templates, schedules and communications approved before they run. A virtual CISO can own the programme at board level.
- Escalation. A real attack reported by staff during the programme is handled as an incident under your SLA, prioritised on the P1 to P4 scale with targets agreed per client; see incident response.
- Compliance evidence. Training records and simulation results kept as evidence for POPIA regulation 4, ISO/IEC 27001 control 6.3, King IV Principle 12 and PFMA or MFMA audits. Personal information in results is handled under POPIA and shared only with those who need it.
- Accreditation. Awareness training is workplace training rather than a qualification.
- Procurement. Arke Technologies (Pty) Ltd is a Level 1 B-BBEE contributor (sworn affidavit available on request). Company documents, our CSD supplier number and SARS tax compliance status are available on request, and we complete SBD forms when a bid requires them; see company facts. Buy on a proposal and purchase order, within an SLA or through a tender response.
- Continuity. You own the training records, results and the communications we write for you, and they are handed over in full if you change provider. The same programme scales from one office to many sites under one contract.
Social engineering techniques, and the habit that stops each one
Every technique below has a matching habit, and the habits are what training builds.