Security Awareness Training

Most successful attacks still start with a person. A convincing invoice, a call that sounds like the bank, a password reused from a breached website: technical controls help, but they cannot stop every message that reaches an inbox. Our security awareness training in Kenya turns your staff into an active layer of defence and gives you evidence that it is working.

We start by measuring where you are. A short survey and an unannounced phishing simulation give a baseline click rate and reporting rate for each department. We then build sessions around the scams your people actually face: SIM swap fraud, M Pesa social engineering, invoice redirection, fake supplier changes, credential harvesting pages and business email compromise aimed at finance teams and executives.

Sessions are delivered live on site anywhere in Kenya or online for distributed teams, in plain English with Kiswahili examples where that helps. Executives receive a separate briefing on cyber risk, regulatory exposure under the Kenya Data Protection Act 2019 and the decisions they will face during an incident. Schools, universities, counties and NGOs can choose a train the trainer package so the programme continues internally.

Training is reinforced with monthly phishing simulations of increasing difficulty, and anyone who clicks receives a short, immediate lesson rather than a reprimand. Every quarter you receive a report showing click rates, reporting rates and completion against the baseline, broken down by department, which doubles as evidence for ISO 27001 clause A.6.3, CBK cybersecurity guidance and SASRA or ODPC inspections. Because our consultants also run penetration tests and incident response, the scenarios come from attacks we see in real engagements, not from a generic slide deck.

A typical programme runs for twelve months: a baseline in the first month, live sessions for every team in the first quarter, monthly simulations throughout and a review with leadership at the end of the year. Smaller organisations can start with a single half day session and one simulation, then grow the programme once they have seen the baseline results and the improvement that follows.