Security Awareness & Training : Your people are a control. The evidence has to say so.
Phishing simulation, security fundamentals, AI literacy, and role-based training — run monthly, reported by department, and recorded per person in the form your assessor asks for.
Part of security assurance. The programme runs under the seat’s policy; the completion evidence feeds the readiness reviews.
Four tracks. One programme.
Golonex runs delivery, tracking, and reporting; you provide the staff list.
Phishing simulation
Monthly campaigns tailored to your industry, systems, and brand, with progressive difficulty. Click and report rates tracked by department, with a short lesson on every click.
Security fundamentals
Passwords and MFA, safe email, social engineering, handling sensitive data, clean desk, and how to report an incident — for every member of staff, including new starters.
AI literacy
Using AI tools safely at work: what not to share, how to check outputs, recognising AI-generated phishing, and the oversight duties your AI policy sets. Written to EU AI Act Article 4.
Role-based tracks
Deeper modules for IT and privileged users, for people who handle personal or regulated data, and for senior management on their own obligations under the frameworks you answer to.
Reports an assessor and a manager can both use.
Every month: completion, click and report rates, and the trend by department. Every quarter: the completion report. Always: per-person records for the evidence pack.
- Monthly phishing campaign with click, report, and completion rates by department
- Quarterly training completion report by department and role
- Per-person completion records and attendance evidence, formatted for the evidence pack
- Trend reporting: your own baseline and movement over time
- New-starter module assigned at onboarding
Every requirement, evidenced.
| Framework | Requirement | Covered by |
|---|---|---|
| NIST SP 800-171 — 3.2.1 / 3.2.2 | Awareness of security risks and role-based training | Fundamentals and role-based tracks with per-person completion records |
| ISO/IEC 27001 — A.6.3 | Information security awareness, education, and training | Programme and completion evidence usable directly as ISMS evidence |
| PCI DSS v4.0.1 — 12.6 | Formal security awareness programme, with phishing awareness | Phishing simulation plus fundamentals, with annual acknowledgement records |
| EU AI Act — Article 4 | AI literacy for staff dealing with AI systems | AI-literacy module with attendance evidence |
| RBI and DPDP (India) | Staff awareness programmes and personal-data handling | Delivered through the India branch; detail on the India page |
Automating a process with AI? The process & AI automation service includes hands-on upskilling for the teams who work with it; the formal AI-literacy module here provides the attendance evidence.
Security awareness & training — your questions, answered
How does phishing simulation work without embarrassing staff? +
It is a training tool, not a disciplinary one. Someone who clicks a simulated link lands on a short lesson, not a warning. Results are reported by department and role, and completion is recorded per person because that is what an assessor needs to see — but no individual league tables.
What does AI-literacy training cover? +
What the AI tools your people use can and cannot be trusted with, what must never be pasted into them, how to recognise AI-generated phishing, and the human-oversight duties your AI policy assigns. It is written to EU AI Act Article 4 and to your own policy, with attendance evidence.
How do we prove completion to an assessor? +
Every completion is logged by person, date, and module version, and every simulation produces a campaign report. We format them for the evidence pack: NIST 800-171 3.2.1 and 3.2.2, ISO 27001 A.6.3, PCI DSS 12.6, or the RBI and DPDP expectations for Indian entities.
Can the modules be delivered in languages other than English? +
Yes, on request — including Hindi for Indian teams. Tell us the languages during scoping.
What results should we expect? +
We do not quote industry averages. From the first campaign you get your own baseline click rate by department, and every month after you see your own trend. That trend, not a benchmark, is what we report and what an assessor will ask about.
Who runs it and how is it priced? +
A named Golonex engineer owns the programme — campaigns, modules, reporting — with a second briefed for cover. Fixed monthly pricing by seat, dedicated or fractional; six-month minimum.
Start with your own baseline.
The first campaign tells you where your people stand. Every month after, you see the trend — and so does your assessor.
Managed delivery — seven practices · All managed delivery →
Managed GCC
Your Global Capability Center — set up, run, and handed over
02Managed talent
Supervised engineering seats in six practices
03Managed software delivery
Teams and builds with a Golonex lead on every engagement
04Managed infrastructure
Azure, AWS, Google Cloud, on-prem, and the data center
Security assurance
Recovery, patching, evidence, identity, and people — tested, not assumed
You are here
Managed Microsoft ecosystem
Microsoft 365, Azure workplace, and Dynamics 365
07Managed process & AI automation
A process lead in your business, automating the work