Skip to content
Book a consultation
МКEN

Security awareness

Security awareness training and phishing simulation

Many attacks begin with a message that asks someone to click a link, approve a payment or share a password. Training does not make that risk disappear, but it changes what happens next: people recognize the signs, report quickly and know that reporting is welcome. We build role-based programs for staff, IT and management, test them with realistic and ethical phishing simulations, and track how your organization improves over time.

Book a consultationHow it works
  1. Simulated messageRealistic and approved by management.
  2. RecognitionStaff learn the signs of deception.
  3. ReportA quick report to the security team.
  4. Short lessonA timely explanation, no shaming.
  5. Next roundHarder scenarios over time.
Phishing simulation flow: the goal is more reports

Security awareness & phishing simulation

What you get

01

People who report instead of hiding

Staff recognize phishing and social engineering, and they report a suspicious message quickly, even one they have already clicked.

02

Management that can lead

Directors and board members understand their responsibilities under the NIS2-aligned law and can oversee security decisions with confidence.

03

Progress you can show

Training and simulation results are tracked by department over time, so you can see where behavior improves and where to focus next.

04

Evidence for audits

Training records and campaign reports support the law’s cyber hygiene and training measure and ISO/IEC 27001:2022 control 6.3.

What's included

  • Role-based training for all staff, for IT and technical teams, and for management bodies
  • Management briefings on their duties under the NIS2-aligned law: a risk assessment at least once a year, oversight of security measures and regular training
  • Realistic phishing simulations approved by management, with rules agreed with HR and staff told in advance that the program exists
  • A short, private explanation for anyone who clicks, with no public lists and no blame
  • A simple way to report suspicious messages, with feedback for everyone who reports
  • Results reported by department and over time, without ranking individuals
  • Material in Macedonian and English, adapted to your sector and to the lures seen in the region
  • Training records that support the law’s cyber hygiene and training measure and ISO/IEC 27001:2022 control 6.3

How we work

  1. 01

    Baseline and agreement

    We agree goals, audiences and rules of engagement with management and HR. If you want a starting point, we run a first simulation to see where you stand.

  2. 02

    Role-based training

    Short, practical sessions for each group: everyday habits for staff, deeper technical topics for IT, and responsibilities and decision-making for management.

  3. 03

    Simulate

    We run phishing campaigns that mirror the lures your sector actually receives and raise the difficulty gradually. Anyone who clicks gets a short explanation on the spot.

  4. 04

    Strengthen reporting

    We help you set up a clear way to report suspicious messages and make sure every reporter hears back. A fast report is worth more than a perfect test score.

  5. 05

    Measure and repeat

    We compare results by department across campaigns, report the trends to management and aim the next round of training at the weak spots.

Who it's for

  • Essential and important entities that must provide regular training under the NIS2-aligned law
  • Organizations implementing or maintaining an ISMS under ISO/IEC 27001:2022
  • Banks, public institutions and companies whose staff handle payments, personal data or services for citizens
  • Management bodies that want to understand and oversee cyber risk, not only approve budgets

Frameworks and standards

  • NIS2-aligned law of North Macedonia (cyber hygiene and training)
  • ISO/IEC 27001:2022 (control 6.3)
  • ISO/IEC 27002:2022

Frequently asked questions

Is security training required by law?
For entities in scope of North Macedonia’s NIS2-aligned law, yes. Cyber hygiene and training is one of the ten risk-management measures, and entities must provide regular training for the members of their management bodies and for staff. ISO/IEC 27001:2022 sets a similar expectation in control 6.3.
Will employees who click be named or shamed?
No. Simulations are there to teach, not to catch people out. Anyone who clicks sees a short explanation straight away, and reports show results by department, not lists of names. We also avoid lures that would cause real distress, such as fake layoff or health notices. The rules, including how personal data is handled, are agreed with management, HR and your data protection officer before the first campaign.
How do you measure improvement?
We track a few indicators across campaigns: how many people report a simulated phishing message, how quickly the first report arrives, and how many people click or enter a password. The trend by department matters more than any single result, and we measure you against your own starting point rather than external averages.
Is the material available in Macedonian?
Yes. We prepare training and simulations in Macedonian and English, so local staff and international teams get the same message in the language they work in.
Do you train management separately?
Yes. Directors and board members get a dedicated session on their responsibilities under the NIS2-aligned law, how to read cyber risk and what they will need to decide during an incident. It is shorter than staff training and focused on decisions.

Related services

NIS2 complianceScoping, gap assessment and readiness for North Macedonia’s NIS2-aligned law, from portal registration to incident reporting.Learn moreISO 27001 implementationAn ISO/IEC 27001:2022 management system built around your risks, from scoping and controls to the certification audit.Learn moreManaged SOC 24/7Round-the-clock monitoring, detection and response across EMEA, with AI-assisted triage and analysts who make the final call.Learn more

Let’s talk about your security

Tell us what you need: 24/7 monitoring, testing or readiness for the NIS2-aligned law. In a short call we will agree on scope and next steps.

Book a consultation+389 75 340 034

Mon–Fri 09:00–17:00 · SOC 24/7 · info@diverto.mk