Skip to content

Dealing with an incident right now? Email [email protected] and mark it as urgent

Request a free consultationEspañol
Menu

Dealing with an incident right now? Email us and mark it as urgent.

[email protected]

3940 NW 79th Ave #744, Miami, FL 33166
Bogotá: Cl. 23 # 73-64, Torre 4, Of. 509 · Visits by appointment only

For HR and IT teams

Security awareness training and phishing simulation for your staff

Your people learn to recognize scams by email, text message or phone, and they practice with test emails. You get the evidence for your client or your auditor.

Request a free 30-minute consultationSee what your company receives

Free 30-minute consultation: we talk about who to train and how to measure. We reply during business hours.

Illustrative example — Fictitious data

Test email

Subject: Your paycheck is on hold

Phishing signs

Urgency, an external sender and a link requesting your details.

Pralogy is a cybersecurity firm that trains the employees of the companies it works with to recognize and report phishing and other scams. We combine awareness sessions with assessments and phishing simulations that your company approves, and we deliver training materials, attendance records and results. The training is for our clients' staff.

Does any of this sound familiar?

It usually starts when a client or an auditor asks for evidence, when an ISO 27001 audit is coming up or after an email incident.

  • “People open any email or forward everything to IT.”

  • “A client or an auditor is asking for evidence that we train our staff.”

  • “We gave a talk a while ago and do not know whether it worked.”

  • “Someone called pretending to be our CEO and asked for a payment.”

  • “Our people use artificial intelligence tools and do not know what data they can enter.”

  • “We had an incident and do not want it to happen again.”

Not sure where to start? In the consultation we talk about your staff, the scams that reach them and how to measure what they learn.

Request a free 30-minute consultation

Free 30-minute consultation. We reply during business hours.

What your company receives

  • Sessions for all staff, with an assessment

    On scams that arrive by email, text message or phone, and what to do about them. For example: a fake vendor asking you to change their bank account details.

  • Technical sessions for IT and development

    For the people who manage systems or write code, on the risks of their daily work.

  • Phishing simulations you approve

    Test emails, similar to real scams, that your company approves before they are sent. They show how many people fall for the scam and how many report it.

  • Awareness messages between sessions

    Short emails that keep the topic fresh. In one of the managed security programs we run today, they go out every month.

  • Training materials, attendance and assessments

    They serve as evidence when your client or your auditor asks whether your staff is trained.

  • Results presentation to management

    What happened in each simulation and each assessment, and which topics to reinforce in the next session.

How we do it

  1. Needs assessment and plan

    Who to train first, which topics your people need and how we will measure.

  2. Your approval before each simulation

    We agree in writing on the dates, who receives the test email and what it will look like.

  3. Sessions with an assessment

    With examples of current scams. At the end, an assessment shows what was understood.

  4. Phishing simulation

    We send the test email and measure how many people fall for the scam and how many report it.

  5. Results and next session

    We present the results and what to reinforce. The next session focuses on that.

Documented case

Incident response and training

A compromised email account: an alert to all staff, then training

Organization with sensitive data

< 1 hour

All staff received the alert in less than 1 hour. Containment was the same day, and the preliminary forensic report came in 2 days.

These times are from this case, not a response-time commitment. The client did not report any disruption to its operations.

Situation
The organization's corporate email was compromised.
What we did
We alerted all staff, contained the incident and performed the forensic analysis. Afterward, we supported the organization with its reporting obligations and trained its staff.

See other real cases, anonymized

Is your client or auditor asking for evidence of training?

Tell us what you were asked for, how many people you have and by when. We will tell you where to start.

Request a free 30-minute consultation

Free 30-minute consultation. We reply during business hours.

The same, on an ongoing basis

A once-a-year talk is easily forgotten. In the managed security program, training and phishing tests are a module of the yearly plan. In one of the programs we run today, we train the staff every two or three months.

See the managed security program modules

Frequently asked questions

Who is security awareness training for?

For the staff of the companies and organizations we work with. We design it with your company, based on your risks and the tools your people use.

How much does security awareness training cost?

It depends on how many people, sessions and simulations are involved. In the free 30-minute consultation we define the scope, and then we send you a written proposal.

What is phishing?

A scam that impersonates someone you trust, usually by email, to get a person to hand over a password, pay a fake invoice or open a malicious file. It also arrives by text message or phone.

What is a phishing simulation?

A controlled exercise: a test email, similar to real scams, that we send to your staff with your company's prior approval. It shows how many people fall for it, how many report it and which topics need reinforcement.

How do you agree on each phishing simulation with my company?

Before each send, we agree in writing on the dates, who receives the email and what it will look like. Nothing is sent without your company's approval. In the consultation, we also discuss how you want to receive the results.

What topics does security awareness training cover?

We define them with you based on what reaches your company. For example: emails and calls that impersonate a vendor or the CEO, the use of artificial intelligence tools your company has not authorized and how to report a suspicious email. There are technical sessions for the IT or development team.

How long is each training session?

The sessions we deliver today last one hour and end with an assessment. The length and number of sessions are set in the proposal.

What do I receive after the security awareness training?

The materials from each session, the attendance record, the assessment results and the results of each simulation, with the topics worth reinforcing.

Does security awareness training help with ISO 27001 or with what my client asks for?

Yes, it helps. ISO/IEC 27001:2022 includes staff awareness, education and training among its controls (control 6.3 of Annex A). Training materials, attendance records and assessments are evidence you can show your auditor or your client. See how we prepare your company for ISO 27001.

What should a person do with a suspicious email?

Report it through the channel your company defines, without opening links or attachments. How to report a suspicious email is one of the topics we cover in the sessions.

Can security awareness training be part of the managed security program?

Yes. In the managed security program, training and phishing tests are one of the modules of the yearly plan. See the modules.

Let's talk about training your staff

Tell us how many people you have, what scams reach them and who is asking for the training. Our engineering team handles your request.

What happens next: we reply during business hours to set a time. If you want to continue, we define the scope and send you a written proposal.

Request your free 30-minute consultation

Fields marked with * are required.

Your work email, preferably. A personal email also works.

Optional, if you prefer a phone call.

If you are not sure, choose the last option.

Add details (optional)

Do not include passwords or confidential information.

You can access, correct or delete your data by writing to [email protected].

Free 30-minute consultation. We reply during business hours.

We work with companies and organizations, and we also train our clients' staff.

Prefer email? [email protected]

Sources

  1. ISO/IEC 27001:2022, Annex A, control 6.3: information security awareness, education and training. See the source

Updated on October 20, 2026.