Sender identity
Check the real address and domain, not only the display name.
Build habits, not blame
Make safer verification and reporting part of normal work.
Authorised phishing simulations, short learning modules and organisation-level reporting for Australian teams—designed as a repeatable learning programme, not a staff “gotcha”.
No real-password collectionWritten simulation rulesQuarterly improvement review
Practice the decision
Teach people what to notice, what to verify and how to report it.
Generic annual training is easy to complete and easy to forget. A useful awareness programme connects a realistic message to a repeatable business response: pause, verify through a trusted channel and report the concern early.
Scenarios can reflect payment changes, shared-document invitations, account prompts or unusual executive requests without collecting real passwords or exposing personal results as a public leaderboard.
Urgency and pressure
Slow down when a message tries to compress a business decision.
Trusted verification
Use a known phone number, existing workflow or separate channel.
Early reporting
Make the escalation route clear enough to use without hesitation.
Measure the learning loop
Use reporting to improve the programme—not embarrass employees.
Organisation-level trends help managers decide where to simplify a process, strengthen a technical control or repeat a lesson. They should not be presented as proof that incidents cannot happen.
CoverageWas the intended audience included and able to access the learning?
Report rate and timeAre suspicious messages reaching the right team more often and earlier?
Repeat coachingWhich scenario themes or business workflows still need reinforcement?
Choose the right delivery platform
Training is stronger when the application supports the programme.
Compuloop can quote and manage several awareness and phishing platforms. The right choice depends on Microsoft 365 licensing, email controls, audience size, reporting needs and how much ongoing campaign management your team wants.
Simulate and coachSophos Phish Threat
Automated phishing simulations, awareness modules and reporting can sit alongside Sophos email and endpoint controls.
Ask about Sophos Phish Threat
Protect and measureIRONSCALES
Phishing simulation, security awareness training, user risk scoring and email protection can be managed as one human-risk programme.
Ask about IRONSCALES
Run regular learningWebroot SAT
Security awareness training and phishing testing can support a repeatable programme for teams that need simple ongoing delivery.
Ask about Webroot SAT
Use the Microsoft stackMicrosoft Attack Simulation
Eligible Microsoft environments can use attack simulation and reporting alongside existing identity, email and security controls.
Ask about Microsoft Attack SimulationHow this works: these are optional technology choices—not products automatically included in every service. Compuloop confirms the operational need, licence eligibility, Australian availability, data region, compatibility and final commercial scope before supply.
Programme principle
“The goal is faster recognition, safer verification and confident reporting.”
Training supports technical protection; it does not replace email authentication, access controls or incident response.
What should change
Build observable behaviours—not completion certificates.
Spot suspicious requests
Notice pressure, unexpected changes and identity cues before acting.
Use a trusted channel
Confirm payments, credentials and sensitive requests independently.
Escalate early
Make the reporting path clear enough to use without hesitation.
Fix process gaps
Use organisation-level patterns to improve controls and communications.
Monthly learning loop
A simple rhythm your team can understand.
Audience, internal communications and reporting rules are agreed before the first simulation.
Set boundaries
Agree participants, scenario rules and internal contacts.
Run one scenario
Deliver one authorised phishing simulation each month.
Reinforce the habit
Follow with one short, relevant learning module.
Improve quarterly
Discuss organisation-level reporting and the next priority.
Indicative programme
Phishing & Awareness
A manageable monthly cycle for teams that need consistent learning and useful reporting without an oversized programme.
$8 per user / month
+$199 setup · minimum $120 per month
- One authorised phishing simulation per month
- One short learning module per month
- Organisation-level reporting
- Quarterly improvement review
AUD excluding GST. Indicative only: platform, audience, contract term, availability and final scope require written confirmation.
Programme guardrails
Respectful by design.
A credible programme should improve behaviour without creating fear or collecting information it does not need.
No real-password collection
The proposed programme does not collect employees’ real passwords.
Authorised simulations only
Participants, communications and reporting rules are agreed before launch.
No prevention guarantee
Training reduces avoidable risk but cannot guarantee incidents will not occur.
Plan the audience before the platform
Build a programme people will actually learn from.
We will confirm the agreed audience, simulation rules, communications, platform and commercial terms in writing.
Before you begin
Awareness training questions
Will phishing simulations collect staff passwords?
No. The proposed programme does not collect employees' real passwords.
Is this a gotcha exercise designed to catch people out?
No. The goal is to improve recognition, verification, reporting and business processes. Participants, communications and reporting rules are agreed before the programme starts.
What happens when someone clicks a simulated phishing email?
The agreed platform can provide a short learning prompt or assign a relevant module, depending on the final programme design. The response is intended to reinforce a safer habit, not publicly shame the employee.
How often are simulations and training delivered?
The indicative programme includes one authorised phishing simulation and one short learning module each month, with a quarterly improvement review. The final cadence is confirmed in writing.
Do executives, managers and new starters take part?
They can, if they are included in the authorised audience. Different roles may face different risks, so the rollout and onboarding process should be agreed before campaigns begin.
Can campaigns be tailored to Microsoft 365 and our normal workflows?
Platform features permitting, scenarios and learning can reflect common Microsoft 365 and business workflows. Simulations remain within agreed guardrails and do not collect real credentials.
What will management see in the reports, and how is improvement measured?
The standard programme uses organisation-level reporting. Available measures can include delivery, interaction, reporting and training-completion trends, depending on the chosen platform and agreed privacy rules.
How do you handle repeat clickers without humiliating staff?
Use private coaching, short remedial learning and an agreed management process. Repeat risk should be handled respectfully and consistently, with attention to confusing business processes as well as individual behaviour.
Does awareness training replace technical email protection?
No. Awareness training complements email authentication, access controls, secure configuration, endpoint protection and incident response. It cannot guarantee that phishing or other incidents will not occur.
Is the advertised price final?
No. It is indicative. The selected platform, authorised audience, contract term, availability and final scope must be confirmed in a written quote.
Independent guidance: ASD small business cyber security handbook. It complements the service scope; it does not certify this service.