One link for your people. One file for the auditor.
A 50-minute session built from the same material as the public training: eight short briefs, a twenty-question exam, a pass mark of 80%. Your employees need nothing but the link. You need nothing but the email you enter below.
You order
Company, headcount, one email. The price is on the screen the whole time.
You confirm
One click in the email you receive. That opens the session and creates the links.
Your people train
You paste one link into your team chat. Each person enters a name once and starts. No accounts.
You get the file
Completion, scores, the weakest topic, and the register as PDF and CSV, on your results page and by email.
Eight ways people get fooled. One session on each.
Not a video and not a slideshow. Each topic is a short brief on how the real attack is built, followed by situations where the person has to decide. 16 warm-up decisions, then a 20-question exam with a pass mark of 80%. About 50 minutes, in the browser, on any device. Useful in any country; in the EU it also produces the training evidence NIS2 asks for.
The Bet
Tuesday, 8:47 AM. You're half-awake, coffee in one hand, phone in the other. That's the exact moment RED is betting on. Not your firewall. Not your antivirus. The three seconds before your brain fully shows up.
URL Literacy
One thing decides who a link belongs to: the REGISTERED DOMAIN - the last two pieces before the first slash.
The Inbox
The name you see in your inbox - “PayPal Support”, “Anna from HR” - is FREE TEXT. Anyone types anything there.
Impersonation
“Are you at your desk? Quick favor. I'm in a meeting, can't talk.” - authority plus unavailability. The one thing that kills this scam is a 20-second call to the real person, so the script removes exactly that.
SMS & Calls
Texts are phishing's favorite terrain: tiny screens, no hover, sender IDs spoofable - a fake can even land in the SAME THREAD as your bank's real alerts.
QR & Messengers
A QR code is a link you CANNOT read. Stickers over parking meters, fake 'menu' codes, 'pay the customs fee' letters - the square hides the destination completely.
Identity & Accounts
Reused passwords turn one leaked site into your whole life: attackers replay leaked pairs everywhere automatically (credential stuffing).
After the Click
Everyone clicks eventually - analysts included. The difference between an incident and a catastrophe is the first 10 minutes, and shame is the attacker's best friend: every hour of embarrassed silence is an hour of free reign.
Their own score by topic, what to look at again, and nothing about anyone else.
Completion, pass rate, the weakest topic in the company, results by department, and the register.
A CSV and PDF register: who, when, score, per topic. 8 topics mapped to the training articles of NIS2.
Two minutes. Then it runs by itself.
A seat is taken when a person starts, not when a link is opened. Same person again on another device: a four-character resume code. Abandoned seats free themselves after 48 hours. You can release any seat yourself.
Your results page has its own key, sent only to the email you confirm with. Employees see their own score and nothing else. Nobody sees a ranking.
Who trained, when, with what result, per topic. The format is the one described on the evidence page. Article 21(2)(g), with the management line for Article 20(2).