Security Awareness Training
75+ scenario-based courses covering phishing, social engineering, password security, and data handling.
See the curriculum about Security Awareness TrainingTrusted by security and IT teams at 1,200+ companies
Cut Human Risk by More Than Half in Six Months.
Find out who is most likely to click, train them on the attacks they actually receive, and prove the reduction with numbers an auditor will accept.
IdentifyYour people
2 of 9 at elevated risk
- Chat
- Voice
ReduceSimulate, then train whoever clicks
ProveHuman risk, reduced
- Finance31% → 9%
- Engineering22% → 7%
- Operations27% → 11%
Click rate, six months
GDPR compliant · SSO on every plan · No obligation
Works with the stack you already run, including:
- Okta
- Microsoft Entra ID
- Google Workspace
- Slack
- Microsoft Teams
- Jira
- ServiceNow
Product names are trademarks of their respective owners.
Who ClickSafe is built for
Small teams
Enterprise training without the enterprise markup
Per-employee pricing with the full content library included. No feature gating, no minimum contract.
Mid-market
Live in 48 hours
SSO, email connectors, and pre-built campaigns ready to go. No professional services engagement required.
Enterprise
Scale with evidence
Role-based access, audit-ready compliance exports, API access, and a named success manager.
The problem
Your team is your largest attack surface
Attackers stopped breaking in years ago. They log in, using credentials someone handed over, or a payment someone approved.
Annual compliance courses are forgotten within weeks. They were designed to satisfy an auditor, not to change what someone does at 4:55pm on a Friday when the CFO appears to be asking for a favour.
Behaviour changes through repetition and realistic pressure: frequent, relevant simulation that builds the instinct to pause and verify.
1 in 5
employees click a phishing email each year
Source: Verizon DBIR 2023
$4.29M
average cost of a data breach
Source: IBM Cost of a Data Breach 2023
41%
of data breaches involve phishing
Source: Verizon DBIR 2023
No email filter catches everything.
An attacker only needs one person out of five hundred. Technical controls reduce the volume; the people receiving what gets through are the last line.
What we provide
Four things, done properly
Training, simulation, reporting, and the portal that ties them together, behind one login, on every plan.
Phishing Simulation
100+ landing pages and 350+ email templates, deployable without touching email infrastructure.
Email Reporting
One-click reporting from Outlook and Gmail. Automated incident dashboards and audit-ready compliance exports.
Unified Training Portal
One login for training, simulations, internal policy docs, and reporting. Role-based access control throughout.
Assign, simulate, measure
The mechanism behind the loop. Three capabilities that run continuously and feed each other, not a sequence you complete once and forget.
Assign training
Pick from 75+ courses or upload your own content. Assign by role, department, or company-wide.
Run simulations
Launch campaigns from 350+ templates or build custom scenarios. Timezone-aware scheduling and randomised send times.
Measure and improve
Watch click rates, reporting rates, and risk scores in real time. Auto-enrol anyone who clicks into follow-up training.
What this looks like in your industry
The attacks your people receive depend on what your organisation does. These are the patterns we build programmes around.
Financial Services
CEO fraud, invoice scams, and credential harvesting target finance teams relentlessly, while SOX and NIST require documented proof of training.
Deploy finance-specific scenarios (wire transfer requests, regulatory notices, vendor bank changes) and track completion against audit requirements.
See a walkthrough for Financial ServicesHealthcare & Pharma
HIPAA obligations, ransomware delivered by phishing, and patient data exposed by a single mistaken click.
HIPAA-aligned modules, scenario training on protecting patient data, and one-click evidence exports for auditors.
See a walkthrough for Healthcare & PharmaTechnology & SaaS
Fast hiring and high turnover mean a steady stream of untrained staff, and a compromised employee is a supply-chain problem for your customers.
Automatic onboarding enrolment for new hires, short mobile-friendly modules for distributed teams, and continuous simulation.
See a walkthrough for Technology & SaaSGovernment & Contractors
NIST 800-171 and CMMC obligations, federal contractor requirements, and targeted state-sponsored phishing.
NIST-aligned curriculum, attestation reporting, and advanced scenarios modelled on state-sponsored tradecraft.
See a walkthrough for Government & ContractorsLaw & Accounting
Client data breaches create direct liability, and clients increasingly audit your security posture before signing.
White-labelled training, client-facing compliance reports, and scenarios built around legal and accounting social engineering.
See a walkthrough for Law & AccountingManufacturing
A mixed office and plant-floor workforce, shared terminals, low baseline tech familiarity, and industrial espionage delivered by email.
Mobile-first modules reachable by QR code, plain-language visual content, and shift-friendly scheduling.
See a walkthrough for Manufacturing
Built for speed, built on what actually works
More content, faster to deploy, and priced so that a fifty-person company gets the same library as a five-thousand-person one.
| Capability | ClickSafe | Typical alternative A | Typical alternative B |
|---|---|---|---|
| Training coursesSize of the ready-to-assign content library | 75+ | Often tier-gated | Often tier-gated |
| Phishing email templates | 350+ | Varies by plan | Varies by plan |
| Phishing landing pages | 100+ | Fewer, or an add-on | Fewer, or an add-on |
| Unified portalTraining, simulation, and reporting behind one login | YesSingle tool | NoSeparate products | PartialPartly bundled |
| SSO / SAML on the entry plan | YesAll plans | PartialUsually a paid upgrade | PartialUsually a paid upgrade |
| Outlook & Gmail reporting button | YesBuilt in | PartialOften an add-on | PartialOften an add-on |
| Compliance report exportsSOC 2, ISO 27001, GDPR, NIST, HIPAA | Yes | PartialLimited on lower tiers | PartialLimited on lower tiers |
Alternative columns describe common patterns in this category, not a specific product.
Know your exposure before it becomes a breach
Risk scoring that updates as campaigns run and training completes, with the per-factor breakdown visible so it is never a black box.
Overall risk score
42
8% lower this month
Lower is better. Combines simulation results, training completion, and role sensitivity.
Phishing click rate
18%
12 points since training
Share of recipients who clicked the link in the most recent campaign.
Training completion
87%
24 points this quarter
Assigned modules finished, across all active users.
Emails reported
34
5 more this week
More reports is a good sign: people are actively helping the security team.
Click rate over eight weeks
SampleCampaign cadence: weekly
31%29%27%24%22%21%19%18%
What changes after six months
The shifts teams look for once training stops being an annual event, written as the roles that own the programme would describe them.
“Deployed in two days. Phishing click rate dropped by roughly two thirds over six months.”
“Finally one platform instead of three. Training, simulation, and reporting all in one place.”
“The template library is the difference. Real-world scenarios our team actually encounters.”
Illustrative examples, not customer quotes.
Security
You are handing us your employee directory
So here is exactly how it is held, and the limits we put on ourselves when running fake attacks against your people.
Encryption
- AES-256 at rest, including backups, which are encrypted separately
- TLS 1.2 or higher for all data in transit
- Keys managed in a dedicated KMS and never stored alongside data
Access control
- Multi-factor authentication mandatory for every administrative account
- Role-based access control with least-privilege defaults
- Every administrative action written to an immutable audit log
Infrastructure
- Multi-region deployment with automated failover
- Automated backups every six hours, retained for 30 days
- Restore procedures tested on a regular schedule, not assumed to work
Incident response
- Documented response plan with named owners and defined severities
- 24-hour response commitment for P1 incidents
- Customer notification obligations tracked against contractual deadlines
Testing & assurance
- Independent penetration testing at least annually
- Dependency and container scanning in continuous integration
- Coordinated vulnerability disclosure programme
Privacy commitments
- We do not sell customer or end-user data
- We do not use customer data to train machine learning models
- Sub-processors are published, with notice before any change
Running fake phishing responsibly
- Simulated landing pages never store submitted credentials. A submission is recorded as an event only, with the password discarded before it is written anywhere.
- Simulation results are visible to programme administrators, not to line managers by default, and we recommend against publishing individual outcomes.
- Employee data is processed to deliver the service and for nothing else. It is not enriched, resold, or used for our own marketing.
Doing vendor due diligence? We keep a completed questionnaire, our latest test summary, our sub-processor list, and our DPA ready to send.
Request the packOne product. Everything included. Quoted to your size.
We do not publish a rate card, because the number genuinely moves with seat count and term. What does not move is what you get: there is no feature-gated tier where the security controls live.
Included for everyone
- All 75+ training courses
- All 350+ phishing templates and 100+ landing pages
- SSO / SAML and SCIM provisioning
- Compliance exports for SOC 2, ISO 27001, GDPR, NIST, HIPAA
- REST API and webhooks
- Outlook and Gmail reporting button
How the commercials work
- Priced per active user, per month
- Only active users count: remove a leaver, get the credit
- Discounted for annual billing
- No setup fee and no annual minimum
Get a quote
Tell us your seat count and you will get a figure back, not a discovery call.
Questions people actually ask
Grouped by what you are trying to work out. If yours is missing, the contact form reaches a person, not a queue.
Running the programme
Most teams go from signup to a live baseline campaign within 48 hours. That covers SSO or CSV user import, choosing a template, and scheduling the send.
Only if you run it punitively. We recommend framing simulations as a team exercise, never publishing individual results, and rewarding reporting rather than punishing clicks. Reporting rate is the metric that matters most.
Quarterly is the common baseline; monthly works well for high-risk roles such as finance and executive assistants. Annual-only programmes show almost no durable behaviour change.
We provide allowlist instructions for Microsoft 365, Google Workspace, and the major secure email gateways. Setup is a one-time configuration step documented in onboarding.
Tell us which languages your workforce needs and we will confirm what the library covers today and what is on the roadmap, before you commit to anything. Email contact@staatse.com.
Yes. You can host internal policy documents and custom modules alongside the standard library, so employees have one place to go.
It combines simulation outcomes (clicked, reported, ignored), training completion, and role sensitivity into a 0-100 score where lower is better. The per-factor breakdown is visible in the dashboard, so it is never a black box.
No. We do not sell customer data and we do not use your data to train models. See the Security & Compliance page for the full detail.
Pricing and contracts
Per active user, per month, quoted against your seat count and requirements. We do not publish a rate card because the number moves with volume, term, and how much onboarding you want. Ask us and you will get a figure, not a discovery call.
No. Only active users count toward your seat total. Remove someone the day they leave and the change is prorated on your next invoice automatically.
Adding seats applies immediately with a prorated charge for the remainder of the period. Reducing seats applies at the end of the current period, and any credit appears on your next invoice.
Every account gets a setup call and email support through your first campaign. Larger rollouts get a dedicated specialist who handles configuration, SSO, and directory sync end to end. We will tell you which applies when we quote.
Yes. Annual billing is discounted against the monthly rate; the exact figure is part of your quote. The annual term runs 12 months and renews only if you choose to renew.
Yes. A REST API and webhooks let reported phishing raise a Jira or ServiceNow ticket, or stream into your SIEM. CSV export is available throughout if you would rather not build an integration.
Yes. Email contact@staatse.com with proof of charitable status. Qualifying organisations typically receive 50% off.
We do not offer a self-serve free trial. Evaluation is a guided demo run against your own scenarios, covering training assignment, a live campaign, and the reporting you would actually use. If your procurement process needs a longer structured pilot, ask and we will scope one with you.
You can export everything at any time. After cancellation we retain data for 30 days so you can retrieve it, then delete it permanently. Deletion can be requested sooner.
Still stuck on something? Ask directly and we will answer honestly, including when the answer is that we are not the right fit. Or email contact@staatse.com.
Stay ahead of what is landing in inboxes
Practical guides and threat intelligence from the campaigns we run every week.
Compliance
NIST Cybersecurity Framework Explained: A Practical Guide
What the NIST CSF actually asks of you, how its six functions map to awareness training, and how to use it without turning it into a documentation exercise.
10 min
Measurement
How to Calculate ROI on Security Awareness Training
A defensible model for the business case, including the assumptions that make most vendor ROI calculators worthless and how to present the number without overclaiming.
9 min
Threat deep-dive
CEO Fraud: How to Verify Before You Send the Money
Business email compromise costs organisations billions a year and defeats email filtering entirely. The defence is process, not vigilance. Here is the process.
8 min
Find out what your click rate actually is
We will run a baseline campaign against your own team and show you the real number, not the one you hope for. Most teams are surprised.
20 minutes · Live product · No obligation