Exercise & Uplift

Training & Simulation

Tabletop exercises and adversary simulations that find what your runbooks will not.

Cyber exercises built on real campaign data.

Vectra's training and simulation practice runs role-based exercises across the executive, the SOC and the wider workforce. We take real campaign data from our SOC and DFIR work and replay it against your team, under realistic time pressure and with measurable outcomes.

We build each exercise around a real scenario your sector has faced, then run it to a measurable conclusion. Outputs are runbook gaps, decision-rights changes and capability findings - not a participation certificate.

Training & Simulation

Make awareness an operating process, not an annual event.

Email security, endpoint protection and identity controls stop a lot of attacks before a user sees them. But phishing, impersonation, credential theft and social engineering are built to sway the choices people make when something gets through. Attackers use every change in how we work. In March 2020 alone, as staff moved to home networks and their own devices, criminals ramped up phishing attacks by over 667%.

Firms under PCI DSS, HIPAA, Sarbanes-Oxley, NIST or ISO 27001 often train all staff once or twice a year. That is a start. Regular training cuts your overall risk within 12 months, and a cycle of real-world tests, useful lessons, follow-up and measurement shows whether behaviour is really getting better.

The goal is not a perfect simulation score. It is fewer risky actions, and faster reporting when a real attack arrives.

  1. 01

    Baseline

    Run a first test to see how users spot, act on and report suspicious messages.

  2. 02

    Simulate

    Keep running phishing tests based on the email and social-engineering attacks of today.

  3. 03

    Train

    Give short lessons on the risks each user is most likely to meet in their role.

  4. 04

    Reinforce

    Use quick feedback, targeted lessons and repeat tests to build habits, without wearing people out.

  5. 05

    Measure

    Track trends by user, group or whole organisation, and aim the next round where the risk is highest.

Two supported platforms. Choose the model that fits.

Both solve the same problem in different ways. KnowBe4 is a platform built for human risk. Check Point adds phishing tests and training to its email security platform.

Dedicated human risk platform

KnowBe4

Vectra is a KnowBe4 partner. KnowBe4 is the better fit when awareness is a program in its own right. Its AI-Native Security Awareness Training brings training, phishing and vishing tests, live coaching, user risk scores and deep analytics into one standalone platform.

  • Large, continually updated training library
  • Training content in 35+ languages
  • Phishing and vishing simulations
  • Custom campaigns, templates and user groups
  • Role- and risk-based personalisation
  • Real-time coaching and targeted follow-up
  • User, group and organisation risk scoring
  • Detailed reporting and executive dashboards
  • Directory and user-provisioning integrations
Vectra and KnowBe4
Integrated SAT add-on

Check Point Email Security

If you use Check Point Email Security, you can add Security Awareness Training to the platform you already run. It is simpler to deploy, target and report on, and testing stays close to the email controls that guard you.

  • Microsoft 365 and Google Workspace support
  • Simulations delivered straight to mailboxes via API
  • No allowlisting of simulation sending IPs
  • AI-adaptive simulations based on recent attack patterns
  • Custom phishing templates written by administrators
  • Training modules and reminders
  • User and group targeting through SAT policies
  • Simulation, feedback and training activity in Email Security
  • One platform beside your email protection
Vectra and Check Point

No need to force one answer on every customer.

Both platforms can run a strong program. The choice comes down to how much depth you need, and whether it helps to keep it all in your email security platform.

Your situation Best fit
Already using Check Point Email Security, and want testing, training and reporting close to the email platform Check Point
A dedicated enterprise awareness program with deeper customisation, content, risk scoring and automation KnowBe4
Complex groups or business units needing granular campaigns, different training journeys and advanced reporting KnowBe4
Fast deployment for existing Check Point customers, without the usual simulation-delivery issues Check Point
An extensive training library, personalised across roles, risks and languages KnowBe4
A simple phishing and awareness requirement, without another management console Check Point

Human risk management is not about catching people out.

It gives people enough realistic practice that the safer action becomes the normal action.

We train and test the decisions attackers try to sway.

Phishing

Links and credential theft

Spot suspicious messages, unsafe links, fake login pages and attempts to steal usernames, passwords or MFA codes.

Impersonation

BEC and executive fraud

Spot urgent payment requests, fake suppliers, spoofed executives and attempts to skip normal approvals.

QR and new lures

Quishing and mobile handoff

Know QR-code attacks, and messages that try to move users off safe work devices to channels you cannot see.

Social engineering

Trust and urgency

See through tricks that play on authority, fear, curiosity, urgency and trust.

Identity

Passwords and MFA

Build safe sign-in habits: good passwords, care with MFA prompts, and reporting access attempts you did not expect.

Data handling

Safer everyday choices

Handle sensitive data, cloud sharing and team tools in line with your security policies.

We can run the program, not just sell the licence.

Vectra can manage your human risk program on either platform, as a complete managed service delivered online. We tailor it to your organisation and advise on best practice as it runs.

Onboard

Set up the platform

We configure the platform, domains, policy, branding and simulation delivery, and sync users and groups from Active Directory.

Baseline

Find the starting point

We run a first simulation, study your specific social-engineering weak points and review your training and policy needs.

Campaign

Test at random

We build and send phishing, vishing and smishing campaigns that match your culture, translated into any language you need.

Remediate

Focus the follow-up

We assign targeted learning where users or groups repeat risky behaviour, and run onboarding training and policy sign-off for new staff.

Report

Show the results

We report on simulation outcomes, reporting behaviour, completion and risk trends, in a short format that shows the return on the program.

Improve

Keep it current

We adjust scenarios, content and cadence to real outcomes and to new social-engineering techniques.

Measure behaviour, not attendance.

Finishing a training module does not mean the risk has changed. We use the reports in your platform to track behaviour over time and show where to focus next.

  • Who engaged

    Who clicked, replied, entered data or engaged with a test attack in some other way.

  • Who reported it

    Whether users reported suspicious messages, not just ignored them.

  • Repeat mistakes

    Risky actions that keep coming back, and teams that may need different training or tests.

  • Training done

    Which modules were set, which are done and what is still due.

  • Risk over time

    How things improve, using the scores and analytics in your platform.

  • Reports for leaders

    A clear view for security and leadership of who took part, where the risk sits and what comes next.

Platform only, fully managed, or in between.

Platform

Your team runs it

Vectra helps you select, buy and deploy KnowBe4 or Check Point SAT, then hands day-to-day campaigns to your security or IT team.

Co-managed

Share the workload

Vectra manages setup, campaigns and reporting. Your team owns user communications, policy and organisational change.

Managed

Vectra runs the program

Vectra handles onboarding, recurring simulations, training campaigns, reporting and ongoing improvement as an operational service.

Build a human risk program

Features vary by product edition, licensing and release. We confirm the right KnowBe4 or Check Point setup during scoping.

Choosing and running the right program.

What is human risk management?

It is the ongoing work of finding, cutting and measuring the cyber risk that comes from what users do. Here the focus is phishing tests, awareness training, follow-up and reporting, not one training session a year.

How often should phishing tests run?

Often enough to build habits, but not so often that tests become predictable or people tune out. A typical managed program starts with a baseline test, core training and onboarding for new staff. Random tests then run each month and training each quarter. Teams that show higher risk get extra coaching or tests as needed.

Should users be told that tests are running?

Tell staff that phishing tests are part of the awareness program. You do not usually need to announce when each test runs or what it contains. Take your HR, privacy, legal and industrial rules into account when you set up the program.

Where the simulation exposes your gaps.

Executive tabletop

Tabletop exercises with real APAC campaign data, run to a measurable conclusion. Decisions, comms and authorisations, rehearsed before you need them live.

SOC analyst training

Detection, triage and response training, built on the workflows our analysts run every day. Hands-on lab time, not slides.

Phishing and BEC simulation

Behaviour-led simulation programs. They track clicks, reports and credential handling - not vanity metrics.

Crisis comms rehearsal

Internal, customer, regulator and media communications rehearsed against the same scenarios the technical team is running.

Related products & services.

Managed XDR

Incident Response Retainer

Contracted response hours with defined SLAs for investigation, containment and recovery.
Advisory

Red & Purple Team Operations

Adversary simulation measured in MITRE ATT&CK coverage, detection latency and response gaps - not CVSS scores.
Managed XDR

Managed Detection & Response

Sovereign Australian XDR powered by 18 global SOCs, AWS Australia hosting and 24x7 human-checked response.

Start with a conversation.

Speak to us about your cyber governance and compliance requirements.

Send us a message

What can we help with?

A sentence or two is plenty. We'll ask for detail when we reply.