Your people are the target.
Make them your strongest defence.
Phishing awareness · Social engineering · Simulation · Behaviour change · Insider risk
Technology controls can filter, block and detect. But when an attacker calls your finance team pretending to be the CEO, or crafts a phishing email that bypasses every filter, your people are the last line of defence. Human Layer Security builds the habits, awareness and decision-making that technical controls cannot replace.
How attackers exploit people, not just systems.
Modern social engineering is sophisticated, targeted and increasingly difficult to distinguish from legitimate communication. These are the patterns we see used most consistently against UK SMEs.
A single credential phished from one staff member can give an attacker access to email, cloud storage, finance systems and HR data simultaneously.
Spear phishing and credential theft
Targeted emails crafted using publicly available information about your business, staff and suppliers. Not mass spam, but personalised messages that reference real context. Designed to harvest credentials or deliver malware through a single click.
Generic awareness training does not prepare staff for this level of targeting.
Business email compromise
Attackers impersonate the CEO, a supplier or a trusted partner to redirect payments, change bank details or request urgent wire transfers. Often initiated by email, sometimes followed up by phone to add pressure. Finance teams are the primary target.
UK SMEs lose millions annually to BEC. Most incidents are preventable with the right processes and awareness.
Vishing and impersonation calls
Phone-based social engineering where attackers pose as IT support, HMRC, banks or senior colleagues. Used to extract credentials, approve transactions or bypass security controls. More effective than most people expect, particularly under time pressure.
Staff rarely receive any training on how to handle or verify unexpected calls requesting action.
Pretexting and manipulation
Long-form social engineering where attackers build a fabricated scenario over time: a fake supplier relationship, a new colleague onboarding, a regulatory enquiry. Used to build trust before making a request that would otherwise raise suspicion.
This approach is increasingly used against professional services, legal and finance firms.
Insider risk and over-sharing
Not always malicious: staff sharing files to personal cloud storage for convenience, forwarding sensitive documents to personal email, or misconfiguring permissions without realising. Accidental data exposure is far more common than deliberate insider threat.
Without clear policy and awareness, well-intentioned shortcuts create real data protection exposure.
Reporting gap and silence culture
Staff who click something suspicious often say nothing for hours or days out of embarrassment or fear of blame. Early reporting is critical: the difference between a contained phishing incident and a full breach is often measured in how quickly someone spoke up.
Building a reporting culture is as important as teaching staff to spot attacks in the first place.
The same attack, two very different outcomes.
Awareness and process changes are the difference between a phishing email becoming a contained report or a full-scale incident. The attacker's effort is the same. The outcome is not.
What Human Layer Security covers.
The service combines realistic simulation, targeted training and process improvement across the human attack surface. Not a compliance tick-box. A programme that changes behaviour.
Relevant, realistic and repeated. Generic annual training does not build instinct. Contextual, scenario-based programmes do.
Phishing simulation programme
Realistic simulated phishing campaigns tailored to your organisation, sector and current threat landscape. Not off-the-shelf templates, but scenarios that reflect how attackers actually target businesses like yours. Campaigns run quarterly with increasing sophistication. Results benchmarked and tracked over time to show genuine behaviour change.
Targeted awareness training
Short, scenario-based training sessions focused on the specific threats relevant to your sector and role types. Finance and HR teams receive targeted business email compromise and payment diversion content. Technical staff receive credential security and social engineering content. Leadership receive executive impersonation and pretexting scenarios. Not the same session for everyone.
Social engineering assessment
Controlled vishing and pretexting exercises to test how staff respond to phone-based and multi-channel social engineering attempts. Conducted with full management authorisation and a clear debrief process. Findings used to identify specific role groups or processes that need targeted follow-up, not to name or blame individuals.
Reporting culture and process
Design and implementation of a clear, low-friction process for staff to report suspicious emails, calls and messages. Includes a defined response workflow so staff receive acknowledgement and feedback when they report. Removes the silence culture that delays incident detection by hours or days. Metrics tracked to show reporting rate improvements over time.
New starter and onboarding security
Security context built into the onboarding process before new staff have access to sensitive systems. Includes understanding of social engineering, acceptable use, and how to verify unexpected requests. Designed to be completed in the first two days, not as a standalone compliance module weeks after joining. Includes a specific module for staff with privileged access or financial authority.
Payment and process controls review
Review of the specific processes most targeted by business email compromise: payment authorisation, supplier bank detail changes, payroll amendments and urgent transfer requests. Identification of missing verification steps, dual-authorisation gaps and escalation paths. Recommendations documented with clear ownership and implementation guidance.
From baseline assessment to measurable behaviour change.
A structured programme, not a one-off event. Human Layer Security is designed to build instinct over time through repetition and relevance, with clear metrics at each stage.
Baseline phishing assessment
We run an initial simulated phishing campaign before any training is delivered, to establish a genuine baseline click rate and reporting rate. This gives you a real picture of current susceptibility, not one skewed by prior awareness. Results are anonymised at individual level and reported by role group and department.
Risk profiling and programme design
Using the baseline results alongside your sector, role structure and any known prior incidents, we design a targeted programme. Finance, HR, leadership and technical staff receive different content. Simulation scenarios are drawn from real attacks against organisations in your sector, not generic templates.
Delivery: training, simulation and process
Role-specific training delivered in short sessions that can be completed in 20 to 30 minutes. Followed by quarterly phishing simulations with increasing sophistication. Social engineering assessment conducted if in scope. Reporting process designed and communicated to all staff. Payment process controls reviewed and documented.
Measurement and ongoing programme
After 6 and 12 months, click rates, reporting rates and assessment results are compared against baseline. You receive a clear picture of what changed and what still needs work. For organisations that want ongoing support, we offer a retained human layer programme covering quarterly simulations, refresher training and new threat briefings as the landscape evolves.
From 34% click rate to 6% in twelve months.
A composite of UK SME engagements across professional services and transport sectors. Numbers are representative of real programme outcomes.
80-person professional services firm, finance team of 6, no prior phishing simulation, annual compliance training only.
- 34% of staff clicked the simulated phishing link
- 4% reported the email as suspicious before clicking
- Finance team had the highest click rate at 58%
- No staff had received BEC-specific training
- No formal process existed for reporting suspicious emails
- Leadership were not included in prior training or simulations
- 6% click rate on quarterly simulations, down from 34%
- 41% reporting rate: staff proactively flagging suspicious emails
- Finance team received targeted BEC training and process changes, including dual-authorisation for bank detail changes
- Leadership completed the same simulations as all staff
- One real phishing email caught and reported within 8 minutes of delivery
- Reporting culture embedded: staff ask questions rather than staying silent
A 41% reporting rate means the security team sees real attacks in near real time. That early warning is worth more than any reduction in click rate on its own.
Measurable outputs, not awareness theatre.
Every engagement produces concrete artefacts and metrics. Not a certificate of completion. Evidence of actual change in how your people think and respond.
Baseline and progress metrics
Click rates, reporting rates and assessment results tracked over time. You can demonstrate measurable improvement to insurers, auditors and clients.
Role-specific training content
Targeted sessions for finance, HR, leadership and technical staff. Short, scenario-based and immediately applicable. Not a generic module everyone clicks through.
Social engineering assessment report
Findings from vishing and pretexting exercises, anonymised at individual level, reported by role group. Identifies specific gaps to address with targeted follow-up.
Reporting process and playbook
A clear, documented process for staff to report suspicious activity, with defined response steps. Removes the ambiguity that leads to silence when something feels wrong.
Payment process controls
Documented improvements to payment authorisation, supplier bank detail change processes and urgent transfer workflows. Specific, implementable recommendations with clear ownership.
Board and insurer summary
Plain-language summary of programme activities, baseline versus current metrics, and forward programme. Suitable for cyber insurance renewal, board reporting and client due diligence requests.
Right for your business if any of these are true.
Human Layer Security is most valuable where staff are regularly targeted, where a successful social engineering attack would cause real damage, and where existing awareness has been generic or infrequent.
If your current programme is a once-a-year module that staff complete in 10 minutes, it is not building the instinct needed to resist targeted phishing or social engineering. This service replaces it with something that actually changes behaviour.
These roles are the most targeted by business email compromise and payment diversion fraud. Generic awareness training does not address the specific scenarios these teams face. Targeted content and process controls do.
A prior incident is a strong signal that current controls are insufficient. Whether credentials were compromised or an attack was narrowly avoided, a structured human layer programme addresses the root cause rather than hoping it does not happen again.
Insurers increasingly ask for evidence of phishing simulation and awareness training, not just confirmation that something exists. A documented programme with tracked metrics provides the evidence needed for renewal, client security questionnaires and regulatory requirements.
Ready to make your people your strongest defence?
If your current awareness programme is a compliance exercise rather than a genuine behaviour change programme, Human Layer Security is where to start. Realistic simulations, role-specific training and measurable outcomes. No blame culture. No generic modules. Security awareness that actually sticks.
Designed for UK SMEs with 10 to 500 staff where social engineering, phishing or business email compromise is a realistic and costly threat. Or call: +44 (0)33 0122 4448
Suspected phishing compromise, credentials stolen, or a payment diverted? The first hours determine how bad this gets. Do not delete emails, do not reset passwords without guidance and do not contact the attacker. Call first.
Out-of-hours availability for active incidents. UK-based advisory.