Cookie settings
Security awareness · ISO 27001

Mandatory awareness training? Make it something employees actually remember.

No hours of videos that get clicked away, but a fun 15 to 20 minute multiple-choice test with real-world examples. Employees learn where the risks to your business lie by seeing where it went wrong elsewhere. With a certificate per employee and a report you can hand straight to your auditor.

Get in touch How it works
15–20 min
per employee
A.6.3
ISO 27001 control
Real
incidents as examples
TV5Monde's choice (2015)
After a hack the broadcaster gave a TV interview. In the background: notes with passwords.
Passwords on the wall, so everyone could find them.
Result: Anyone watching the news could read along.
The Hawaii control room's choice (2018)
A press photo of the control room showed a password on a sticky note stuck to a screen.
Stick the password on the screen so nobody would forget it.
Result: The photo went around the world, password and all.
The Super Bowl's choice (2014)
A TV report on the security operation showed the Wi-Fi password on a big screen.
The password in full view, even with the cameras rolling.
Result: Millions of viewers saw the Wi-Fi password.
MGM's choice (2023)
An attacker called the help desk and posed as an employee.
Issue a new password without an extra check.
Result: Hotels and casinos were partly down for days, damage about $100 million.
M&S's help desk's choice (2025)
Attackers called a supplier's help desk and posed as M&S employees.
Restore access.
Result: The web shop was down for weeks, damage about £300 million.
Twitter's choice (2020)
Employees were called by ‘colleagues from IT’.
Employees handed over their logins.
Result: Accounts of Obama and Musk, among others, were hijacked.
Uber's choice (2022)
An employee got login request after login request and a message from ‘IT’.
The employee approved one to make it stop.
Result: The attacker was in and proudly announced the hack in Uber's own Slack.
Arup's choice (2024)
An employee joined a video call with the CFO and colleagues: all deepfakes.
Make fifteen payments.
Result: About $25 million gone to fraudsters.
Pathé's choice (2018)
Emails from ‘the French CEO’ asked for secret payments for an acquisition.
Pay.
Result: Over €19 million gone, two directors dismissed.
FACC's choice (2016)
The Austrian aircraft supplier got emails from a fake CEO about a secret acquisition.
Pay.
Result: About €50 million gone, and the CEO was dismissed.
Facebook and Google's choice (2013–2015)
A fraudster spent years sending fake invoices in the name of a real supplier.
Pay.
Result: Over $100 million in total, most of it later recovered.
Ubiquiti's choice (2015)
Emails from ‘management’ asked for transfers to foreign accounts.
Transfer.
Result: $46.7 million gone.
Snapchat's choice (2016)
Payroll got an email from ‘the CEO’ asking for payroll data.
Send it.
Result: Data of hundreds of (former) employees leaked.
Heathrow's choice (2017)
An employee kept security files on a USB stick without a password.
No encryption and hardly any training.
Result: Stick found in the street, fine £120,000.
The UK Ministry of Defence's choice (2021)
A member of the public found secret documents behind a bus stop.
Take sensitive papers out of the office.
Result: They ended up with the BBC, with details about a navy ship and Afghanistan.
Hof van Twente's choice (2020)
A server was protected with the password ‘Welkom2020’.
An easy password.
Result: Hackers took the council offline for weeks.
Colonial Pipeline's choice (2021)
Hackers got in through an old, unused account with a leaked password.
Leave the account in place.
Result: Fuel shortages and $4.4 million in ransom.
RSA Security's choice (2011)
An employee pulled an email about a ‘2011 recruitment plan’ out of the spam folder.
Open the attachment.
Result: Hackers stole secrets of the security tokens.
Maastricht University's choice (2019)
Staff received phishing emails, and a few clicked.
Pay a ransom to get back to work.
Result: After weeks of disruption, about €200,000 went to the criminals.
Ferrari's choice (2024)
An executive got a call from an imitation of the CEO's voice.
Ask a check question only the real CEO could answer.
Result: The caller hung up. Not a cent was lost.
🤔 Which choice would you make?
Real incidents from the awareness test
SOUND FAMILIAR?

What businesses run into with awareness training

Click through and forget

Mandatory e-learning quickly becomes a tick-box: play video, next, next, done. Completed is not the same as learned.

With AsperityEmployees learn to assess risks themselves, based on real incidents.

It takes too much working time

Long modules for everyone in the organisation add up quickly, and nobody looks forward to them.

With Asperity15 to 20 minutes, whenever it suits.

The auditor wants evidence, not a story

For ISO 27001 you must show who was trained when, with what result, and that it recurs structurally.

With AsperityA certificate per employee and a report for the whole organisation.

Generic and far from the work floor

Translated courses about situations that never happen at your company. Employees tune out before they learn anything.

With AsperityRecognisable situations, and custom-made when needed.
REAL INCIDENTS

Where it went wrong at other companies

Not just what a phishing email looks like, but above all where the risks to your business lie. Many of these blunders still happen every day.

TV5Monde · 2015

Passwords on the wall, live on TV

After a major hack, the French broadcaster gave a TV interview. In the background hung notes with the passwords for their YouTube, Twitter and Instagram accounts, readable for everyone at home.

The question for youWhere do you keep your passwords and PIN codes?
MGM Resorts · 2023

The help desk let the wrong person in

Attackers looked up an employee on LinkedIn, called the help desk and posed as that person. They got a new password. Hotels and casinos were partly disrupted for days; the damage ran to about $100 million.

The question for youHow do our help desk and reception know who is really calling or at the door?
Heathrow Airport · 2017

A USB stick in the street

An employee lost an unprotected USB stick with over a thousand files about airport security. A passer-by found it and took it to a newspaper. Only 2% of the 6,500 staff had received data protection training. Fine: £120,000.

The question for youWhat do you put on a USB stick, and what happens if you lose it?
HOW A QUESTION WORKS

After every question: what happened at real companies?

Example question from the awareness test. Three companies got a message from ‘the CEO’ about a confidential acquisition requiring money to be transferred today. A: pay, Pathé's choice in 2018, over 19 million euros gone and two directors dismissed. B: video call first, Arup's choice in 2024, everyone on the call was a deepfake and 25 million dollars gone. C: a check question only the real CEO can answer, Ferrari's choice in 2024, the caller hung up.
This is what a question looks like: three choices, three real companies, and what it cost them. Who chose well?
HOW IT WORKS

Short, powerful, and actually quite fun

  1. 1

    Employees take the test

    A 15 to 20 minute multiple-choice test about real incidents. For each question: which choice did the company make, and what would you have done?

  2. 2

    After every question: what really happened?

    Employees see what happened at real companies that made their choice, and at companies that did it differently. So they immediately see what a choice costs, or gains.

  3. 3

    You get the evidence

    Every employee receives a certificate with name, date and score. You get a report of participation and results for the whole organisation.

ISO 27001 · CONTROL A.6.3

Ready for your certification, and fun for your employees

Certificate per employee with name, training, date and score
Company report: participation and results per team or department
Justification per ISO 27001 control for your audit file
Repeat yearly to keep awareness up to date
Real incidents, and the blunders that still happen every day
Developed by a cybersecurity professional

The training covers the awareness part of ISO 27001 (A.6.3). For certification the auditor looks at your whole ISMS; we provide the evidence for this part.

OFFERING

Ready-made or tailored

Security awareness test

Ready to use

A fun multiple-choice test on phishing, social engineering, passwords and reporting incidents, with real-world examples. For all employees.

Secure code training

For developers · based on your pentest

The vulnerabilities from your own pentest report, such as injection or broken access control, turned into an interactive training for your developers. So the same mistake does not come back, and you can demonstrate the follow-up (incl. A.8.8 and A.8.28 Secure coding).

Curious what fits your organisation?

Get in touch to discuss the options. I am happy to think along about numbers, planning and reporting. No obligation, and I reply personally within one business day.

Portrait of Geert van Asperen
Geert van Asperen Cybersecurity professional, founder of Asperity