Security Awareness Training & Phishing Simulation That Changes Behaviour
Most attacks still start with a person: a convincing email, a fake login page or a phone call asking for a password reset. Annual click-through training rarely changes how people behave. A good awareness programme does, through short role-based lessons, realistic phishing simulations and measuring whether people report suspicious messages.
Mutex Systems runs awareness programmes and phishing simulations for organisations in the UK and Pakistan. Content is tailored to finance teams, executives, developers and front-line staff. Results are tracked over time in grComply as evidence for ISO 27001, PCI DSS and regulators.
Or call our London office on 020 3307 529901Why it matters now
The risk behind this service
Based on incidents and figures in our UK & Europe threat report.
- Phishing and social engineering remain the most common way in, and AI makes lures more convincing and better targeted.
- PCI DSS v4.0 requirement 12.6.3.1 now explicitly requires training on phishing and social engineering.
- Regulators and auditors want proof that training happened and that it works, not just a completion certificate.
Who this is for
- Organisations needing evidence of awareness training for ISO 27001 or PCI DSS
- Finance teams exposed to invoice and payment fraud
- Banks and NBFCs meeting SBP and SECP training expectations
- Companies after a phishing incident
- Fast-growing teams onboarding new staff
- Executives and assistants targeted by impersonation
02Services
What we deliver
Phishing Simulation Campaigns
Realistic, safe phishing emails at agreed intervals, with instant learning moments for anyone who clicks.
Role-Based Training
Short modules for finance, HR, executives, developers and front-line staff, focused on the attacks each role faces.
Executive & Board Briefings
Sessions on impersonation, deepfake voice fraud and the board’s responsibilities for cyber risk.
Vishing & Smishing Tests
Phone and SMS social engineering tests, with consent, to check help-desk and payment processes.
Report-Button Programme
Encourage and measure reporting, and connect reports to the SOC for fast response.
Learn moreNew Joiner Induction
Security essentials for every new starter, with policy acknowledgement recorded.
Metrics & Board Reporting
Click, report and completion trends by department, presented in plain language.
03Business impact
What an awareness programme changes
How a measured programme compares with once-a-year compliance training.
| Factor | Annual tick-box training | ● With a Mutex programme |
|---|---|---|
| Risk | Staff click, and no one reports suspicious messages. | Click rates fall and reporting rises, measured each campaign. |
| Fraud losses | Finance teams pay fake invoices and changed bank details. | Verification habits trained and tested for payment teams. |
| Detection | Phishing found only after damage is done. | Staff reports reach the SOC within minutes. |
| Compliance evidence | Completion certificates with no evidence of effect. | Trend data for ISO 27001, PCI DSS and regulators. |
| Staff time | Long annual courses people click through. | Short, relevant lessons that take minutes. |
04How it works
How an engagement runs
- 1
Baseline
An initial phishing simulation and survey to measure where you start.
- 2
Plan
Agree audiences, frequency, themes and how results will be reported.
- 3
Train
Role-based modules and live sessions for high-risk groups.
- 4
Simulate
Regular phishing and optional vishing tests with learning moments.
- 5
Measure & report
Track click, report and completion rates, and adjust the programme.
What you receive
- Programme plan and annual calendar
- Baseline and trend reports by department
- Training completion and policy acknowledgement records
- Executive briefing materials
- Evidence pack for ISO 27001, PCI DSS and regulators
05Compliance
Frameworks and regulations this supports
ISO 27001:2022
Control 6.3 requires information security awareness, education and training.
PCI DSS v4.0
Requirement 12.6 includes awareness of phishing and social engineering.
Cyber Essentials
Trained users support secure configuration and access control.
NIST CSF 2.0
Protect function: awareness and training.
SBP Cybersecurity Guidelines
Pakistani banks are expected to run staff awareness programmes.
NHS DSPT
Annual data security training for health and care staff.
grComply · GRC platform
Training evidence without spreadsheets
grComply includes a learning module. Training, policy acknowledgements and simulation results are recorded against ISO 27001 control 6.3 and PCI DSS requirement 12.6, ready for auditors.
Explore grComply- Training assignments and completion tracking
- Policy acknowledgement records per person
- Simulation results as audit evidence
- Department trends on board dashboards
What is a phishing simulation?
A phishing simulation sends realistic but harmless phishing emails to staff to see who clicks, who enters details and who reports. People who click get a short learning moment on the spot. Results are tracked over time.
Is phishing simulation ethical?
Yes, when it is run properly. We agree themes in advance, avoid distressing topics such as bonuses or health scares unless approved, never shame individuals and report results by department.
How often should we run phishing tests?
Monthly or quarterly works well for most organisations. Regular, varied tests build habits better than one large annual test.
What should we measure?
The click rate matters, but the report rate matters more. It shows people are spotting attacks and telling security quickly. We track both, along with training completion.
Does PCI DSS require phishing training?
Yes. PCI DSS v4.0 requirement 12.6.3.1 requires security awareness training to include phishing and related attacks, and social engineering.
Can training be delivered in Urdu?
For Pakistani clients we can adapt live sessions and key messages for local teams. Please mention language needs when you contact us.
How is this priced?
It depends on the number of staff, the frequency of simulations and the amount of live training. We send a proposal after a short call and do not publish prices.
Turn your staff into your first line of defence
Start with a baseline phishing simulation. Reply within one working day, or call 020 3307 5299.