Cyber Security Awareness Month training that changes behaviour
October is the one month your board actually pays attention to cyber security.
Don't waste it on a phishing email, a webinar nobody watched and a fresh poster for the kitchen. We build programmes that put people inside the experience, where threats feel real, personal and urgent. Because they are. Runs in October. Runs in any month you want, really.
Why Cyber Security Awareness Month matters
You get budget, board attention and permission to interrupt people's day. Three things you don't get in February.
It's primetime for boosting your defences. Not an excuse to wheel out the same tired slide deck, but a chance to change what people do when it counts. The only question worth asking is what you spend it on.
Five attacks. Seconds to decide.
Phishing
Still one of the easiest ways into a business. Your team has sat through the "check the sender address" slide. Did it stick? Use the month to let them practice spotting suspicious messages under real conditions.
Ransomware
One dodgy attachment, opened by one busy person. Knowing that has never stopped an attack. Reacting correctly in the first ten minutes has. Let your people build that reaction before they need it.
AI-enabled attacks
Voice calls that sound like your CFO, emails polished enough to fool the sceptics, and not a spelling mistake in sight. A checklist can't catch that. Instinct can, and instinct comes from rehearsal.
Social engineering
Nobody bothers with your firewall when they can just ask. Urgency and trust, weaponised by someone friendly who's done their homework. Teach your team to feel it happening under pressure.
Business email compromise
No malware, no alarms. Just a supplier with new bank details, or someone senior asking for something urgent and slightly odd. It takes the most money and looks the most like normal work.
Naming them isn't handling them
Your people could probably name all five. Handling them at four o'clock on a Friday is a different skill entirely.
Why your awareness month is forgotten by November
Human error gets blamed for nearly every breach. Convenient, isn't it?
One label, and the tired slide deck gets to stay another year. People don't click bad links because they're careless. They click because nobody ever let them practice saying no.
Picture the standard version: a company-wide email, posters in the break room, a themed slide deck everyone has to endure. It achieves one thing: boring the sh*t out of your team.
Schemes like that are designed to educate, and education doesn't equal change. Change comes from practice, repetition and actually giving a toss. Our programmes engage your people first, then let them rehearse the decisions: spotting the message that isn't right, making the call, saying no to someone senior who's asking for something they shouldn't.
What should your awareness month include?
Vishing awareness
Thanks to AI, phone scams fool people who think they're unfoolable. Reading about vishing won't prepare anyone for a persuasive voice on the line. Taking the call will.
Password security
Don't skip the basics. Strong passwords and two-factor authentication are still two of the best barriers there are. Skip the lecture and focus on habits people will keep.
Social engineering
Hacking is rarely a genius in a basement. Far more often it's someone talking a helpful colleague into handing over a detail they shouldn't. Much less exciting, we know.
Reporting
People can't report what they don't recognise, or what they don't know how to report. Make it automatic: spot it, know who to tell, speak up while you're still not sure.
Executive incident response
Your leadership team has a specific job during an attack. Knowing it on paper isn't doing it at speed with half the facts. Let them rehearse the decisions first.
Cyber resilience
Awareness is a small part of resilience. Your team needs to see how their own actions connect to the security of the business, and watch the consequences play out somewhere safe.
Security culture
Reinforce the good behaviours, celebrate the catches, and make it clear security isn't the IT team's private hobby.
Not sure where to start?
Tell us what you're trying to change and we'll shape the month around it.
Here's the kind of thing we build
Depth, duration and how far into your organisation we go is what separates them. Facilitated sessions happen at your premises, and everyone who can't be in the room gets the digital scenarios, so remote and hybrid teams aren't left reading about it.
The Scout
A facilitated escape room session at your premises and a SHIFT campaign for everyone who wasn't in the room. Your starting point, and your baseline.
The Operative
A month, not a day: a launch-day escape room, a week of kit on site, CTRL+VISH phone booths and SHIFT running all month, so the whole organisation takes part.
The Strategist
Six to eight weeks of build-up, sessions across sites, a live CMD crisis simulation for your leadership team, and quarterly reporting.
The Architect
A SPACE_ installation built for your organisation. Up to 1,500 people a day, a custom scenario, and weeks of content and activities around it.
Build your own
A week across three countries. One day for two hundred people. A phone box and nothing else. A room built around the incident you had in March. Tell us the shape and we'll price that instead.
Good.
Every package started as something a client asked for that didn't exist yet. Tell us how many people, how many sites and what you're trying to change, and we'll build the one that fits.
The interactive scenarios sparked meaningful conversations about password security, multi-factor authentication and insider risks. One participant even changed all their passwords right after the session.
Sally Bolton, Cyber Human Risk Manager · ScottishPower Energy Networks
Everybody does October. Then nothing.
Four weeks of effort protecting fifty-two weeks of exposure. How's that maths working out? Every programme on this page runs in any month you like. October is just the one your board already agreed to fund.
And no, we're not about to hand you a list of hashtag days to hang posters on. World Password Day has never changed anybody's behaviour.
The months that work are the ones where something is happening
You've had a near miss
The most teachable fortnight you'll ever get, and it closes fast.
A wave of new starters
They turn up with the habits from their last job. Whoever gets to them first wins.
After a pen test or audit
You've got evidence and you've got attention. Use it before you lose it.
A big change landing
New system, restructure, acquisition, offshoring. Each rewrites who trusts who, and attackers read the news too.
Your quiet season
Use the quiet periods to engage people who'd otherwise be too busy to care.
November
The month everybody else stops. Nobody expects anything of you, which is exactly why it lands.
Why immersive experiences just work
Not by information overload, and not by being bored into submission.
Our experiences drop your people into a scenario where they have to decide something, get it wrong safely, and go again. Every activity is designed for behaviour change and a security culture that survives past the month it happened in. No tick-box exercises and no slide decks.
Run the month yourself, if you'd rather
Everything here is built for the person who got handed "sort out October" and no budget. Take it, use it, put your own logo on the bits that need one. Free resources will only get you so far, but they'll get you further than a new Teams background.
31 days, 2 minutes a day
Every other awareness calendar is 31 facts. This one is 31 things your people actually do, plus a planner to pull the month together. Two minutes a day, no kit.
Get the planner
Run-your-own tabletop
A cyber incident rehearsal any manager can run in a meeting room, cold, first time. Eleven injects, a decision log and the debrief questions that make the hour count.
Download it
Can you hear the con?
Four phone calls. Which one is a real person? Proof that the voice on the line stopped being evidence some time ago.
Take the ear test
Awareness Month bingo
Poster by the kettle. Password1! joke in the all-hands. Mandatory module by Friday. If you can shout house before the 3rd, that isn't a win.
Get the cardCheck your formula
Where your programme is strong and where it falls over, scored against the Behaviour Formula.
Start here20 ways to introduce engagement
Twenty practical, low-cost ways to move your programme from exposure to experience, straight out of the book.
Get the guideTraining ROI calculator
Put a number on what your current approach costs you.
Open the calculatorMay I Have Your Attention Please?
The book on engagement in immersive learning. Buy it, or download the PDF free.
Get the bookThe clock, not the calendar
Pre-engagement runs six to eight weeks before your first session, with planning time on top.
Kit and facilitators need two to four weeks, though we've moved faster when we've had to. Neither of those cares what month it is.
October is a brilliant month for engagement: the whole world is already talking about it, so you ride that instead of generating the interest yourself. If your heart is set on October, wonderful. Ask us early, because everyone else wants it too.
Awareness Month, answered.
What is Cyber Security Awareness Month?
An annual campaign held every October to encourage organisations to improve their cyber security knowledge and reduce human risk. Awareness is where it starts, not where it ends: treat it as a chance to change what your team does, not just what they know.
When is Cyber Security Awareness Month?
Every October. But the organisations that get the most from it don't start in October. They run pre-engagement in the weeks before, so the month lands on a team that's already paying attention.
Do we have to run it in October?
No, and some of our best engagements haven't been. Every programme works in any month. October is simply the month most boards have already agreed to fund. January, May and November all give you a hook to build around.
Can you build something different from the packages?
Yes, constantly. The packages are the shapes clients ask for most. Tell us which is closest and what you'd change, and we'll quote that instead. A week across three sites, a single day for two hundred people, a room built around the incident you had in March: all normal here.
Why is Cyber Security Awareness Month important?
Because attacks target people, not technology. That makes your people your first line of defence, whether they've been prepared or not. The month is a chance to prepare them properly: reinforcing behaviours, not just handing out facts.
What activities work best?
The ones your people take part in rather than sit through. Immersive experiences, live simulations, tabletop rehearsals and digital scenarios: anything that lets someone decide under pressure and fail safely. Posters and modules give you a completion rate, not a behaviour change.
How do you make it engaging?
Participation. Facilitated escape rooms at your premises, digital escape rooms for remote teams and crisis simulation for the leadership team. People compete, people talk about it afterwards, and the talking is where culture comes from.
What should a programme include?
The latest threats as well as the basics, like strong passwords, plus the chance to practice the skills that help people act fast when an attack happens for real. If every element is content and nothing is rehearsal, you've got a module, not an engagement programme.
How early should we start planning?
As early as you can. Several of our programmes come with six to eight weeks of pre-engagement, and kit and facilitators need two to four weeks on top. Everyone wants October, so ask early.
How much does it cost?
Kit hire starts from £1,000. Programmes start from £5,000 for a single facilitated day and go up depending on headcount, sites and how long you want the pressure to last. Large-scale installations are quoted bespoke, and every quote is built on your numbers.
How are immersive experiences different from traditional awareness training?
Traditional training focuses on education. It doesn't give people the tools to act when an attack happens, or build a healthy long-term culture. Immersive training involves your people in simulations, tasks and games where they practice key skills and get a safe space to fail, learn and try again.
Tell us the shape.
How many people, how many sites, and what you really want to change. We'll do the rest.