Cyber Awareness Training
Turn your employees into your strongest security layer
What this engagement covers
The service
Human error is the #1 cause of data breaches. Our Cyber Awareness Training platform delivers interactive, engaging security training to your entire organization. Employees complete bite-sized courses, pass knowledge checks, and earn certificates - while you get a compliance-ready dashboard showing completion rates, risk scores, and audit evidence. Built for SOC 2, HIPAA, PCI-DSS, and ISO 27001 compliance requirements.
What we test
Our platform covers all critical security awareness topics: phishing recognition and email security, password hygiene and multi-factor authentication, social engineering tactics and defense, data handling and classification, remote work security, physical security best practices, incident reporting procedures, compliance-specific modules (HIPAA, PCI-DSS, GDPR), mobile device security, and insider threat awareness.
Scoping & Assessment Depth
Black Box Assessment
Zero-KnowledgeSimulates an external adversary targeting Cyber Awareness Training with no internal credentials, source code, or architecture documentation. Assesses perimeter exposure, unauthenticated attack paths, and edge resilience.
Gray Box Assessment (Recommended)
CredentialedSimulates an authenticated user, tenant, or insider threat within Cyber Awareness Training. We evaluate role segregation, authorization boundaries, privilege escalation, and business logic flaws across user tiers.
White Box / Source-Assisted
Full-KnowledgeConducted with direct access to architecture schematics, configuration files, and API/code documentation. Eliminates blind spots and provides exhaustive coverage of security mechanisms governing Cyber Awareness Training.
Attack Surface & Vulnerability Vectors
Low phishing awareness among non-technical staff
Rigorous testing and validation to uncover Low phishing awareness among non-technical staff across your Cyber Awareness Training environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Password reuse across personal and work accounts
Rigorous testing and validation to uncover Password reuse across personal and work accounts across your Cyber Awareness Training environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Failure to recognize social engineering tactics
Rigorous testing and validation to uncover Failure to recognize social engineering tactics across your Cyber Awareness Training environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Improper data handling and sharing practices
Rigorous testing and validation to uncover Improper data handling and sharing practices across your Cyber Awareness Training environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Missing incident reporting knowledge
Rigorous testing and validation to uncover Missing incident reporting knowledge across your Cyber Awareness Training environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Weak physical security awareness
Rigorous testing and validation to uncover Weak physical security awareness across your Cyber Awareness Training environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
How we run it
We deploy a branded training portal for your organization with role-based course assignments. New hires get onboarded automatically, and recurring annual training is scheduled and tracked. Courses use interactive scenarios, short videos, and real-world examples - not boring slideshows. Admins get a live dashboard with completion tracking, department comparisons, and exportable audit reports. The platform integrates with your HR system for automatic user provisioning.
Deploy branded awareness portal
Rigorous technical execution, boundary verification, and manual exploitation testing targeting deploy branded awareness portal across your cyber awareness training deployment.
Import employee roster and assign roles
Rigorous technical execution, boundary verification, and manual exploitation testing targeting import employee roster and assign roles across your cyber awareness training deployment.
Configure course paths by department/role
Rigorous technical execution, boundary verification, and manual exploitation testing targeting configure course paths by department/role across your cyber awareness training deployment.
Launch initial training campaign
Rigorous technical execution, boundary verification, and manual exploitation testing targeting launch initial training campaign across your cyber awareness training deployment.
Track completion and quiz performance
Rigorous technical execution, boundary verification, and manual exploitation testing targeting track completion and quiz performance across your cyber awareness training deployment.
Generate compliance reports for auditors
Rigorous technical execution, boundary verification, and manual exploitation testing targeting generate compliance reports for auditors across your cyber awareness training deployment.
Schedule recurring annual refresher training
Rigorous technical execution, boundary verification, and manual exploitation testing targeting schedule recurring annual refresher training across your cyber awareness training deployment.
Provide ongoing platform support and updates
Rigorous technical execution, boundary verification, and manual exploitation testing targeting provide ongoing platform support and updates across your cyber awareness training deployment.
What you receive
Findings land in your tracker as you go, not only in a PDF at the end. Retest is in scope, not a change order.
- Branded training portal for your organization
- Interactive course library (20+ modules)
- Automated onboarding for new employees
- Role-based course assignments
- Completion certificates for each employee
- Admin dashboard with analytics and reporting
- Compliance audit reports (SOC 2, HIPAA, etc.)
- Annual training schedule management
What we usually find
The issues this engagement surfaces most often. Yours will differ, but this is the shape of it.
Who this is for
Auditor-Ready Compliance Crosswalk
| Framework | Control Section | Testing Evidence & Report Deliverable |
|---|---|---|
| SOC 2 Type II | CC4.1, CC7.1, CC7.2 | Technical testing evidence validating system boundaries, access restrictions, and vulnerability identification controls. |
| HIPAA Security Rule | 45 CFR § 164.308(a)(8) | Formal technical evaluation verifying the integrity of ePHI safeguards, network segmentation, and privileged access safeguards. |
| PCI DSS v4.0 | Requirement 11.4 & 11.4.3 | Adversary-driven external and internal penetration testing with application-layer validation and vulnerability remediation verification. |
| ISO/IEC 27001:2022 | Control A.8.8 & A.8.20 | Management of technical vulnerabilities and network security verification through independent technical assessments. |
| NIST Cybersecurity Framework | PR.AC, DE.CM, RS.AN | Technical testing verifying access controls, anomaly detection efficacy, and incident response mitigation capabilities. |
| GDPR Article 32 | Art. 32(1)(d) | Documented evidence of regular testing, assessing, and evaluating the effectiveness of technical measures protecting personal data. |
| CMMC 2.0 Level 2 / 3 | CA.L2-3.12.1, SC.L2-3.13.1 | Technical validation of Controlled Unclassified Information (CUI) protection, perimeter defense, and enclave isolation. |
Findings are mapped to SOC 2, HIPAA, PCI-DSS, ISO 27001, NIST CSF, GDPR, CMMC, so the report drops into an audit package rather than needing to be translated first. If you need the readiness work behind one of those, that is a separate engagement.
Frequently Asked Questions
Direct answers on scoping, methodology, compliance validation, and deliverables.
Our Cyber Awareness Training service combines deep manual testing with automated verification. We cover: Branded training portal for your organization, Interactive course library (20+ modules), Automated onboarding for new employees, Role-based course assignments, Completion certificates for each employee. Every engagement includes reproducible proof-of-concept exploits, developer-ready remediation guidance, and a free retest.
Yes. Findings are directly mapped to SOC 2, HIPAA, PCI-DSS, ISO 27001, NIST CSF, GDPR, CMMC control requirements. The resulting report is auditor-ready and formatted for immediate submission to SOC 2 CPAs, PCI QSAs, and enterprise vendor risk assessment teams.
Yes. Every Lorikeet Security engagement includes free retesting within 30 to 60 days to validate that your remediation patches successfully resolve the identified vulnerabilities before your final report is issued.
Typical active testing turnaround is Annual subscription, with critical findings reported immediately via your Talon portal so your engineering team can begin remediation without waiting for the final PDF.
Pricing starts from $5,000/year. We scope the engagement in one call based on your environment's surface area, user roles, and complexity, providing a transparent, fixed-price quote with no hidden change orders.
Scope it in one call
Tell us what is in scope and we come back with a fixed price and a start date. No discovery-call maze, no hourly estimate that moves.
