Awareness module in OdySecure, Cybervize's security platform

Security awareness with evidence, not an attendance list

Training, phishing simulation and policy acknowledgement run where your risks, measures and audits already live. Every completion becomes audit evidence, and the training and reporting rates feed the metrics register. Five languages, workforce register from a file import, hosted in Germany.

Book a free demo

Colleagues together recognising an envelope with a fishing hook, a lightbulb above them

What the awareness module covers

Awareness rarely fails on the training video and almost always on the evidence: who completed what and when, who is still missing, and how do you show it in an audit? The module answers that from maintained data rather than from spreadsheets exported out of a separate system.

A workforce register that actually reconciles

The register is the denominator behind every metric. A file import reconciles the workforce in full: new people are created, missing people are marked as leavers, and their records are retained. Every run is calculated as a preview first and only written after confirmation, matched preferably on the personnel number, otherwise on the email address. Repeated runs never apply twice.

Training that sounds like your organisation

A wizard builds company-specific training from a reviewed core. You supply the context, meaning assets, risks and the tools in use, and the AI tailors sections and test questions to it. Every draft passes a review before release. Language variants then follow in German, English, Spanish, Turkish and Chinese, with the correct answers identical across all of them. You can bring in existing SCORM training.

Phishing measured by report rate, not click rate

Simulated campaigns run through a connected phishing environment. What is measured is not only who clicked but who reported: the report button produces a reporting rate, the metric that actually shows maturity. Anyone who clicks receives follow-up training immediately rather than next quarter.

Policy acknowledgement

Policies are pushed out for confirmation and signed off per person. Expected against confirmed acknowledgements produce a rate that answers the audit question of whether a policy merely exists or is actually known.

An evidence pack at the push of a button

The export bundles training completions per person, certificates, policy acknowledgements and phishing results into one file. That addresses ISO 27001 A.6.3 and the training obligation in NIS-2 Article 20, without anyone assembling screenshots from a separate system before the audit.

Metrics that land in the register

Training coverage, phishing report rate and acknowledgement rate appear as tiles in the overview, with a jump to the people still outstanding. A daily run writes the training rate and phishing report rate into the platform metrics register; the acknowledgement rate appears in the overview but is not written to the register. Awareness therefore appears in the same management report as risks and measures.

What three waves of results look like

Each wave with recipients, click rate and report rate. The click rate falls while the report rate rises, and both numbers sit side by side so the second one is not lost. From the software, not a mock-up.

Phishing simulations in OdySecure: three completed waves with 32 recipients each, click rates of 34, 28 and 22 per cent, report rates of 6, 13 and 22 per cent

No CISO of your own?

In a vCISO mandate, your vCISO works with OdySecure and the platform is included. From €3,600/month.

Book an intro call vCISO in detail

More about the awareness module

Why the module sits inside the platform rather than beside it

The training content is not the difference. The cores come from freely available material published by European and American authorities, which anyone can use. The difference is where the results end up.

The security process for training and awareness draws its operational coverage straight from the module rather than being asserted in the ISMS.
Recurring duties such as annual training and semi-annual phishing simulation exist as process tasks with due dates, in the same task pool as the rest of operations.
Evaluations can be restricted to an organisational unit, meaning a plant or a department. That is the precondition for steering anything at group scale.
A separate awareness tool creates exactly the evidence gap that the ISMS then has to close by hand.

What the awareness module aligns to

Two requirements drive this topic in regulated organisations, and the same evidence serves both.

ISO/IEC 27001 Annex A.6.3 (information security awareness, education and training): completion records and certificates as auditable evidence
NIS-2 Article 20 (training obligation for management bodies and staff): documented delivery with date and scope
Training content based on freely available cores from European and American authorities, with source and licence attribution carried automatically
Data protection: tenant separation, evaluation optionally per organisational unit, leavers drop out of the rates while their records are retained

Who the awareness module is built for

Three situations where the training list turns into an audit question.

Information security officers

Need evidence in an audit, not intent. The evidence pack delivers completions, certificates, acknowledgements and phishing results in one go, and the rates are already in the management report.

Awareness programme owners

Run training, phishing and newsletters across the year and need to find stragglers without reconciling lists. The overview shows open assignments per person, and the import keeps the workforce current.

Manufacturing and multi-site operations

Workforces do not all speak one language. Five languages, evaluation per plant and a register that tracks joiners and leavers make the difference between a group-level rate and one that means something per site.

FAQ about the awareness module

How is this different from a standalone awareness tool?▼

In the outcome, not the training video. In a separate tool, completions, rates and certificates are created outside the ISMS and have to be collected again for audits and management reporting. Here they flow into the same evidence and metrics record as risks, measures and incidents, and the security process for awareness draws its coverage directly from operations.

Where does the training content come from?▼

From freely available cores published by European and American authorities, which serve as the starting point in the wizard. Company-specific tailoring builds on that: you supply assets, risks and the tools in use as context, and the AI produces sections and test questions as a draft. Release only happens after a human review. Source and licence attribution is carried automatically. Alongside that, you can bring in existing SCORM training.

Which languages are supported?▼

German, English, Spanish, Turkish and Chinese. Language variants are produced in the wizard from the same training, each variant can be edited individually, and the correct answers stay identical across all of them. For manufacturing workforces this is often the point at which awareness programmes otherwise fail.

How does the workforce get into the system?▼

Through a file import that reconciles the workforce in full rather than only adding to it. The run first shows a preview with the number of new, changed and departing records and is only written after confirmation. Matching is preferably on the personnel number, otherwise on the email address. Repeated runs do not apply twice.

Do you measure click rate or report rate?▼

Both, but the report rate is the metric that counts. A falling click rate mainly shows that staff have become more cautious. A rising report rate shows that they actively report an incident, and that is what a security operation needs. Anyone who clicks on a simulation is assigned follow-up training immediately.

What is in the evidence pack for the audit?▼

Training completions per person, issued certificates, policy acknowledgements and phishing results, bundled into one file. That addresses ISO 27001 A.6.3 and the training obligation in NIS-2 Article 20 in a single step.

Awareness is a module of OdySecure

The awareness module shares its data layer, permission model and audit trail with the ISMS (ISO 27001), BCM (ISO 22301), assessment and TPRM modules. That is where the cross-connections come from: training rates feed the metrics register, the security process for awareness draws its coverage from real data, and the evidence sits in the same audit record as risks and measures.

See the platform overview

Memberships, programmes and partnerships