Guides
Straight answers on phishing and training.
Written for MSPs and the small businesses they look after. Each guide starts with the short answer, then the detail, with sources.
For MSPs
For MSPsHow do MSPs sell security awareness training to small business clients?MSPs sell security awareness training most easily by tying it to something the client already has to deal with: a cyber insurance application, a compliance rule such as the FTC Safeguards Rule, or a recent phishing scare. Package it inside your managed plan or as a simple per user add-on, run it for the client with little effort on their side, and show results in every review.For MSPsHow should MSPs price security awareness training?Most MSPs price security awareness training in one of three ways: bundled into a managed security plan, sold as a separate add-on, or included only in a higher tier. Charging per user keeps price tied to cost and risk, while a flat per company fee is simpler to quote. Whichever you pick, price from your own cost, delivery time and target margin, not from a competitor's list.For MSPsWhat security awareness metrics should MSPs show clients in QBRs?In a QBR, show a small set of security awareness metrics as trends over time: phishing click rate, report rate, training completion, repeat clickers and coverage (the share of staff enrolled). Pair each number with one sentence on what it means and one action for next quarter. Owners care about direction and evidence, not dashboards full of detail.
Insurance and compliance
Insurance and complianceDo cyber insurers require security awareness training?Many cyber insurers ask about security awareness training, and some ask specifically about phishing simulations and how often staff fail them. Requirements vary by insurer, form and policy size: some applications ask several detailed training questions, others ask none. Answer every question accurately, because insurers rely on the application, and keep records that prove what you said.Insurance and complianceDoes PIPEDA require security awareness training?PIPEDA does not name a specific training course, but it does require it in substance. Schedule 1, Principle 4.7 says organizations shall make their employees aware of the importance of maintaining the confidentiality of personal information, and the Privacy Commissioner advises regular training on security safeguards. A documented, recurring awareness program is the practical way for a small business to show it meets that duty.Insurance and complianceDoes the FTC Safeguards Rule require security awareness training?Yes. Under 16 CFR 314.4(e)(1), businesses covered by the FTC Safeguards Rule must provide their personnel with security awareness training that is updated as needed to reflect risks found in their risk assessment. The rule covers many small non-bank financial businesses, such as tax preparers, mortgage brokers and auto dealers that arrange financing, and the training requirement applies regardless of size.Insurance and complianceWhat does HIPAA require for security awareness training?The HIPAA Security Rule, at 45 CFR 164.308(a)(5), requires covered entities and business associates to implement a security awareness and training program for all members of their workforce, including management. It lists four addressable specifications: security reminders, protection from malicious software, log-in monitoring and password management. Addressable does not mean optional, and related documentation must be kept for six years.
Phishing basics
Phishing basicsWhat is a phishing simulation?A phishing simulation is a harmless practice email, built to look like a real scam, that an organization sends to its own staff. It shows who clicks, who reports it and who ignores it, then gives a short lesson to anyone who falls for it. The aim is practice and feedback, not punishment, so people get better at spotting and reporting real phishing.Phishing basicsHow often should you run phishing simulations?For most small businesses, once a month is a sensible default: one short practice email per person, with a quick lesson for anyone who clicks. Official guidance from the NCSC, the Canadian Centre for Cyber Security and NIST does not set a fixed frequency. Monthly is a practical choice because it builds a habit, gives a usable trend and stays light enough that staff do not resent it.Phishing basicsWhat should you do if you clicked a phishing link?If you clicked a phishing link at work, tell your IT team or managed service provider right away and keep the email. If you typed a password, change it and turn on or reset multi-factor authentication. If you downloaded something, run a security scan. Contact your bank if you shared payment details. Reporting quickly matters far more than the click itself.Phishing basicsWhat is business email compromise and how do small businesses stop it?Business email compromise (BEC) is fraud where criminals use a hijacked or convincing fake email account to trick a business into sending money or changing payment details. The FBI's IC3 recorded over $3 billion in reported BEC losses in 2025. Small businesses stop it mainly with a call-back rule for any payment change, multi-factor authentication on email, and staff trained to spot pressure and unusual requests.
Microsoft 365
Microsoft 365How do you set up Microsoft 365 Advanced Delivery for phishing simulations?In the Microsoft Defender portal, go to Email & collaboration, Policies & rules, Threat policies, Advanced delivery, then the Phishing simulation tab. Add the simulation vendor's sending domain (up to 50) and sending IP addresses (up to 10). Messages that match at least one domain and one IP are delivered without filtering, and Safe Links will not block or detonate their links at time of click.Microsoft 365Why do phishing simulations show clicks nobody made?Email security tools open links automatically to check whether they are safe. Microsoft Defender Safe Links scans URLs before delivery and can detonate unknown links in the background, and many gateways and sandboxes do the same. A phishing simulation that counts every link visit as a click will record these automated checks as people clicking, which inflates click rates and blames staff who never opened the email.
Become a founding partner.
We're onboarding our first MSP partners now. Bring two clients and we'll set them up with you.