Pillar 04 ยท Develop
You can spend a fortune on technology and still be undone by one person having a bad Tuesday.
This is not a criticism of your staff. It is how modern attacks work. Phishing was the most common attack type reported by UK businesses in the government's 2025/26 Cyber Security Breaches Survey, hitting 38% of them, which is more than three times the next most common category. Attackers target people because people are reachable, and because a convincing email costs nothing to send.
Fourarmed's cyber security awareness training treats your staff as a security control, which is what they are. Get it right and they become the layer that catches what the technology missed. We deliver training across the UK from our base in Bristol.
Here is the uncomfortable thing about people as a control. They are the only factor that can be improved without buying anything, and the one most organisations invest in least.
The typical approach is an annual e-learning module. Everyone clicks through it, some people watch it, and the completion report goes in a folder to show an auditor. It changes almost nothing, because it was designed purely to provide evidence that training happened.
What shifts behaviour is more specific and more awkward. Show someone a phishing email naming their own supplier, their own finance system and their own managing director, and it lands in a way that a stock example never will. Walk them through the invoice fraud that nearly worked at a business like theirs. Finally, make it completely safe for them to say: "I think I've clicked something".
In most breaches involving a person, the damage is done in the gap between the click and the report.
Often, someone realises something is wrong, feels stupid, and waits an hour, a morning or a weekend before telling anyone. Closing that gap is often the single highest-value thing that training achieves, and it is a cultural change more than a knowledge one.
Our core offering is interactive, in-person workshops. These are working sessions, not lectures. People look at real examples, argue about which ones are fake, and get things wrong in a room where it costs nothing. A typical workshop covers:
Phishing, spear phishing, business email compromise, malicious attachments, fake login pages, and the increasing use of AI to write convincing English. Also the ones people forget, such as text messages, phone calls, QR codes, and someone walking in wearing a hi-vis.
Sender domains, display-name spoofing, reply-to mismatches, urgency as a tactic, and the specific pressure signature of a request pretending to come from a director.
How changed bank details work, why "the finance director asked me to do it quickly" is the whole attack, and what a verification step should look like.
Why reuse is the real problem, how password managers work, and what to do when an MFA prompt arrives that you did not trigger, which is a genuine attack in progress and widely ignored.
Where company data is allowed to live, the risks of personal devices and shadow IT, and what to do with a lost laptop or phone.
Who to tell, how fast, and the firm commitment that nobody gets in trouble for reporting.
We tailor the examples to your business. A session for a firm of solicitors or accountants uses conveyancing and payment fraud, one for a manufacturer uses supplier impersonation, and one for a defence supplier covers the targeting that comes with being part of a sensitive supply chain.
Training tells people what to look for. Simulation tells you whether it worked.
We send controlled, realistic phishing emails to your staff and measure what happens. Who clicks, who enters credentials, who reports it, and how quickly. Then we do it again later with different bait.
Simulation also produces something useful for the board: a number that moves.
For clients who want more than a one-off, we build a rolling schedule. Typically this involves an initial all-staff workshop, then quarterly simulations with short follow-up sessions, plus targeted content for the people at highest risk. This last group is usually finance, HR, executive assistants and anyone whose email address is on the website.
Finance teams get payment fraud in depth. Senior leaders get whaling and the specific ways they are targeted. IT staff get the operational side of response. Shop-floor and operational staff get the physical and removable-media angles that office-based training skips.
A short module in week one, when habits are being formed and nobody has learned to ignore the intranet yet.
A tabletop walkthrough of a realistic breach: who decides what, who calls the insurer, what you tell customers, and who is authorised to take systems offline at 9pm on a Friday. Tabletop exercises reliably surface gaps that a written plan does not.
Acceptable use policies tend to be written for auditors and are too long to be used by anyone else. We will help you produce something shorter.
Training works best alongside the technical picture. If we have run a cyber security audit or risk assessment for you, we build the programme around what it found. There is no point spending a session on removable media if nobody uses it.
Training that cannot be measured is impossible to justify at budget time, so we measure:
You get a short report after each round, including what we sent, what happened, how it compares to last time, and what we would focus on next.
One caution about the numbers. A click rate that falls to zero usually means the simulations have become too easy or too familiar, and not that the risk has gone. We vary the difficulty deliberately, and a well-run programme should keep catching a few people. This is the sign it is still testing something real. What you want is a workforce that reports quickly, not one that has learned to identify our test emails.
Keep these reports. Since Fourarmed came out of an insurance broker, we know how much weight an underwriter puts on evidence of staff training at renewal. A year of simulation results and attendance records answers a question most applicants can only assert an answer to. The same records support the awareness expectations that come with Cyber Essentials certification. More on our cyber insurance page.
Smaller organisations often get the most benefit from this, because training is the one control that scales down without losing its value. The usual starting point is a single all-staff workshop with a baseline phishing simulation. It is a low-commitment way to find out where you stand, and the results tend to make the case for whatever comes next.
