Phishing awareness for the staff of small businesses in Nice

Because it does not target the machine but the person in a hurry. A fake email from a supplier changing its bank details, a fake message from the director asking for an urgent transfer, a fake delivery notification: no anti-virus blocks a deliberate action taken by the user, with their own credentials, on a site that looks like the real one.

It is also the cheapest door to close. Where bringing an estate back up to standard needs a budget and a timetable, awareness produces a measurable effect within a few weeks — and it benefits every other protection, since it cuts the number of incidents to deal with.

We send fake phishing emails calibrated on your line of work — a fake supplier invoice, a fake message from the director, a fake bank notification — and we measure who clicks, without ever naming anybody. What you receive is a rate, together with an analysis of the scenarios that worked and of those that fooled nobody.

The scenarios are matched to the sector: a fake transfer for an accountancy practice, a fake delivery for a shop, fake IT support for a manufacturing firm. A generic campaign measures nothing useful: it is the plausibility that gives the result its value.

It starts from the results of your own campaign, not from generic slides. One hour, on site in Nice or by video call, to learn to spot a forged sender address, to check a link before clicking, and to handle an urgent request for a transfer — the scenario that costs small businesses the most.

The workshop ends with the most useful rule of all: when in doubt, pick up the telephone and call the sender on a number you already know, never on the one given in the message.

Follow a written procedure, put up on the wall and prepared in advance: who to report a suspicious email to, and what to do in the ten minutes after a click. Those ten minutes are often worth more than the rest of the arrangements put together: change the password concerned, tell the named contact, check the forwarding rules created in the mailbox, warn the accounts team if a transfer is in progress.

The procedure fits on one page. It names a person, not a department, and it states explicitly that reporting quickly will never be held against anybody. A firm where people dare not report finds out about its incidents weeks too late.

The session is charged as a fixed fee. A second campaign three months later measures the real progress: it is that comparison, not the initial rate, that says whether the exercise was worth it. In the small businesses we support, the click rate falls sharply between the first and the second campaign.

It is the cheapest action in a security plan, and often the most profitable. Repeating it once or twice a year is worthwhile, particularly after new people join the team.