Security awareness and phishing simulation
Practical training for your staff and simulated phishing emails, with aggregated results for management.
- Initial campaign in 2 weeks
- Remote or in person in the Comunidad de Madrid
- Aggregated results for management
We run phishing awareness in Móstoles and, remotely, anywhere in Spain. We work with two tools: practical training for your staff and simulated phishing emails.
The simulations measure what share of your staff clicks and show us where more work is needed.
Read more Read less
We start with an initial simulation that sets the baseline. Then come the short sessions, the periodic simulations throughout the year and the aggregated results for management. The initial campaign is up and running in 2 weeks.
Request a quote
To talk about security awareness and phishing simulation, call or write to us and we'll tell you the next steps.
How we help
- Fake emails posing as a supplier or as management
- Knowing what share of your staff would open a suspicious link
- Documented security training required by a standard or a client
- A simple procedure for reporting a suspicious email
- Follow-up training for anyone who falls for a simulation
- A record of the training as evidence for audits
What security awareness and phishing simulation are
Phishing is a fake email designed to get someone to click a link, open an attachment or hand over data. It usually imitates someone familiar.
It is a deception aimed at people, which is why part of the work is done with people.
Read more Read less
Our service combines two things. We give your staff practical training and we simulate phishing emails to measure what share of them click and to reinforce where needed. A simulation is a test email, sent as part of a programme that management is aware of. It is there to measure and to teach, not to catch anyone out.
It is worth being clear: no training can ensure that nobody will ever fall for a fake email. What you will have is a baseline, a way to see how your staff progress and a simple procedure for reporting anything suspicious that arrives.
Which companies it makes sense for
This service is designed for companies where much of the staff work with email and with payments or customer data.
There, a click or a payment order that is not properly checked carries more weight.
Read more Read less
To find out whether it fits your case, ask yourself a few simple questions. Who pays the invoices and how do the payment orders reach them? Who answers customers by email? Does that person know who to tell if a message looks odd? If the answers are not clear, it is worth talking it over.
Common reasons to start
Companies usually come to this service because of something specific that has happened or that they have been asked for.
You do not need to have suffered an incident to consider it.
- Fake emails posing as a supplier or as management have arrived.
- You want to know what share of your staff would open a suspicious link.
- A standard or a client asks you for documented security training.
These are the reasons we commonly see:
How we work, step by step
We start with a meeting with management to choose realistic scenarios for your sector.
A test email only teaches something if it resembles what your staff might receive day to day.
Read more Read less
Then we launch the first simulation, with management informed, and deliver the training based on the results. The training sessions are short and can be remote or in person in the Comunidad de Madrid.
From there we continue with periodic campaigns and track progress. At the end of the year, management receives an annual report.
How we start
- We meet with management and choose realistic scenarios for your sector.
- We launch the first simulation, with management informed.
- We deliver the training based on the results.
- We continue with periodic campaigns and track how your staff progress.
- We close the year with a report for management.
- Meeting with management to choose the scenarios
- First simulation, with management informed
- Training based on the results
- Periodic campaigns and progress tracking
- Annual report for management
What the service includes
The service covers measurement, training and a record of what has been done.
That way management has an overall view and your staff know what to do when an email makes them hesitate.
Read more Read less
The results management receives for each campaign are aggregated. In other words, they show how the staff are doing as a whole. The service is not set up as a list for singling people out: anyone who falls for a simulation receives follow-up training.
- Initial phishing simulation to measure the baseline
- Short training sessions, remote or in person in the Comunidad de Madrid
- Periodic simulations throughout the year
- Follow-up training for anyone who falls for a simulation
- Simple procedure for reporting a suspicious email
- Aggregated results from each campaign for management
- Record of the training as evidence for audits
How the price is calculated and how long it takes
The price is annual and depends mainly on the number of people. The entry tier covers up to 50 employees.
With more staff, it is calculated according to how many people join the programme. The prices shown exclude VAT (21%).
The initial campaign is up and running in 2 weeks. To give you a figure, we need to know how many people are on your staff.
Call or write to us with that information and we will tell you what it would cost for your company.
When comparing with other options, ask what the price includes: how many simulations there are during the year, whether follow-up training is included and whether you receive a record you can show in an audit.
Initial campaign in 2 weeks
What is not included
We would rather you knew from the start. This service does not include technical email filters, which are part of the Microsoft 365 and Google Workspace security service.
Training people and configuring email are separate jobs.
Teams of more than 50 employees are not covered by the entry price either. They are quoted separately, based on the number of people.
What happens after the first campaign
The first simulation gives a snapshot of one specific moment. That is why the service continues with periodic simulations throughout the year and with tracking of how your staff progress.
Who you deal with at Oteo
Aitor is in charge of Oteo's management and client relations. If you have questions about the service or how it fits your company, you can raise them with him.
To make the most of that first conversation, have some basic information to hand: how many people are on your staff, who handles payments or customer data and whether any standard or client requires documented training.
Where we provide the service
We work remotely anywhere in Spain and in person in the Comunidad de Madrid.
If your company is in Móstoles or another municipality in the Comunidad de Madrid, you can choose in-person or remote sessions.
Read more Read less
If it is outside the Comunidad de Madrid, we work remotely. The same applies if your staff are spread across several sites or work from home: the remote format brings everyone together without travel.
Frequently asked questions about the service
These are the questions most worth clearing up before you start: whether staff are told, what management sees, how much time it takes up, how the price is calculated and when the initial campaign begins.
If your question is not here, call or write to us and we will tell you how to proceed.
Questions about security awareness and phishing simulation
Are staff told in advance?
Management knows at all times what is sent and when. Staff are told about the programme, but not the date of each simulation. That way the result reflects what happens on a normal working day.
Are the people who click singled out?
The report for management gives aggregated results. Anyone who falls for a simulation receives a short follow-up training session. The programme is designed for learning, not for finding someone to blame.
How much does it cost?
It is an annual price. The entry tier covers up to 50 employees and, with more staff, the price depends on the number of people. Prices exclude VAT. Call or write to us and we will tell you what it would cost for your company.
Does it take up much of your staff's time?
The sessions are short and can be held remotely, so they do not interrupt work. If your company is in the Comunidad de Madrid, they can also be held in person.
When do we start?
The initial campaign is up and running in 2 weeks. Before that, we meet with management to choose the scenarios for the first simulation.
Does it count as evidence for an audit?
We keep a record of the training so you can use it as evidence in audits. It is also a starting point when a standard or a client asks you for documented security training.
What if we have more than 50 employees?
Teams of more than 50 employees are quoted separately, based on the number of people. Tell us how many of you there are in total and we will tell you how to proceed.
Does it include email filtering?
No. This service works with people. Technical email filters are part of the Microsoft 365 and Google Workspace security service.
Microsoft 365 and Google Workspace security
We review and strengthen the configuration of your Microsoft 365 or Google Workspace: access, email and devices.
Penetration testing
Controlled, authorised penetration tests on your website, your applications or your infrastructure.
NIS2, ENS and ISO 27001 compliance
We prepare your company for NIS2, ENS or ISO/IEC 27001 and support you through the audit.
Incident response
We contain the attack, find out what has happened and help you get your business running again.
Let's talk about your staff
Call us on +34699240879 or email us at hola@oteosecurity.com.
Tell us how many people are on your staff and what led you to consider it: some fake emails, a request from a client or simply wanting to know where you stand.
With that, we will tell you how to proceed and what would be needed to prepare the first simulation.