Business Model — Practical Cyber Awareness Training

A standard engagement begins with a short discovery phase where we gather threat context, technology inventory and key personnel roles. Next, we design 3–5 tailored scenarios that mirror realistic threats for the organization. These scenarios are run as interactive sessions with predefined decision points and measurable tasks.

After exercises, stakeholders receive an after-action report containing prioritized tasks, short checklists for day-to-day prevention and a recommended cadence for follow-up exercises.

Example scenarios illustrate the practical orientation of our work:

• Phishing-to-account-takeover case that traces attacker steps and defensive handoffs.
• Insider information-handling scenario for HR and legal teams.
• Supply-chain impersonation exercise affecting procurement and vendor validation.

Each example includes observable indicators, role-based tasks and a short playbook to reduce recurrence.

Deliverables are concise and actionable: a one-page executive summary, a tactical checklist for operational teams, and a prioritized remediation task list tied to the scenarios run.

Reports focus on what teams actually did during scenarios, what succeeded, where decisions stalled, and specific steps to improve detection and response workflows.

Pricing is structured by organizational size and number of role-specific modules. We offer pilot packages for small teams, full-cycle programs for mid-sized organizations and subscription plans for ongoing scenario updates.

Clients can start with a one-day pilot exercise that includes two scenarios and a compact after-action report, or choose a multi-month program that integrates quarterly tabletop sessions and on-demand scenario updates.

Contact CyberHubEdu to discuss a tailored engagement for your organization.

Case study: a mid-sized Toronto-based accounting firm reduced successful phishing incidents through scenario-driven training. We ran a baseline simulated phishing campaign that resulted in a 22% click rate. Training combined short scenario videos, role-playing tabletop exercises with management staff, and follow-up micro-learning quizzes. After eight weeks, a repeat simulation measured a 9% click rate and improved incident reporting from 12% to 58%. The program emphasized realistic scenarios (invoice fraud, CEO impersonation) and clear escalation paths; lessons were shared across teams at CyberHubEdu workshops to refine detection cues and reporting scripts.

We prioritize measurable, scenario-based evaluation. Typical indicators include simulated phishing click-rate changes, time-to-report metrics in tabletop exercises, and task-based competency checks. Each module is paired with a pre-test scenario and a post-test scenario that mirrors common threats relevant to the client. Reporting dashboards break results down by role, department, and risk vector so leaders can target follow-up coaching.

Example metrics we track: baseline vs. post-training phishing susceptibility, percentage of staff who correctly follow incident escalation steps in a tabletop exercise, and retention scores on micro-learning modules over 90 days. Reports include anonymized case narratives to illustrate behavior patterns and recommended next steps. CyberHubEdu uses these findings to adapt content and create custom scenarios that reflect the client’s systems and workflow.

Implementation emphasizes incremental delivery with practical case scenarios at each stage. We deploy an initial discovery scenario to probe current controls, run targeted training pilots in high-risk teams, and then scale with quarterly scenario refreshers. Each phase includes a documented incident scenario and a corrective coaching plan, ensuring lessons translate into day-to-day practices.

• Discovery scenario: simulated spear-phish to map immediate vulnerabilities and reporting behavior
• Pilot scenario: role-specific tabletop (management, HR, IT) to validate controls and escalation paths
• Scale scenario: rolling monthly micro-simulations and team debriefs to maintain vigilance

A typical rollout for a 150-person organization spans 10-12 weeks: week 1 discovery, weeks 2-5 pilot modules and simulations, weeks 6-10 scaling and reinforcement, and ongoing quarterly scenario injections. Each step is anchored in documented case outcomes so leadership sees practical improvements and actionable insights without abstract promises.

Scaling requires tailoring scenarios to department workflows. For management, we simulate invoice diversion and vendor impersonation. For HR, we use candidate-supply chain social engineering scenarios. For IT, we simulate credential harvesting via fake ticketing messages. Each scenario is built from real incident patterns and includes a playbook for detection, reporting, and remediation.

Example: a regional healthcare provider adopted department-specific modules. Management saw improved verification calls to vendors, HR reduced credential exposure in onboarding exercises, and IT shortened mean time to contain simulated incidents through clearer ticket prioritization. CyberHubEdu documents these scenarios and outcomes so other departments can adapt the same templates to their context.