Security Awareness Training for Charlotte Businesses
in Charlotte, North Carolina

Why Phin specifically?

Phin is built for SMB and mid-market with a specific design goal: make training content short enough and engaging enough that users actually complete it. Competing platforms (KnowBe4, Proofpoint Security Awareness, Infosec IQ) have deeper content libraries but longer, more traditional LMS-style modules that get lower completion rates in practice. Phin's format fits SMB workforces better. That said, we're not religious about platform — if a client has existing KnowBe4 licensing and wants to keep using it, we can manage the program on that platform instead.

Will employees know these are fake phishing emails?

Initially, yes — the rollout is announced. After the first month, simulations become routine and many employees assume everything unusual might be a test, which is actually the goal. Some clients prefer unannounced rollouts for harder baseline metrics; we can support both approaches.

What happens to repeat phishing-simulation clickers?

Repeat clickers get escalating intervention:

• First click: Remedial training on that attack pattern, no other action
• Second click in 90 days: Additional training assigned, manager notification (optional)
• Third click in 90 days: Documented review with the employee's manager and HR, additional scrutiny on that user's account activity
• Persistent pattern: Discussion with leadership about whether additional controls are warranted for that user (step-up authentication, limited permissions, coaching)

How does this satisfy HIPAA security training requirements?

HIPAA §164.308(a)(5) requires "security awareness and training" for all workforce members. Netsafe's program satisfies this through: initial baseline training on HIPAA-specific content for new hires and current staff, ongoing monthly training that refreshes HIPAA concepts, documented completion tracking per user, and annual attestation reports ready for OCR audit. We structure the evidence package for HIPAA audit-readiness from the start.

Can you integrate with our existing HR system?

Yes. For clients with HR systems (Workday, BambooHR, Rippling, Gusto, ADP) that integrate with Entra ID, user provisioning flows automatically — new hires get enrolled in training on their start date, terminated employees get deprovisioned at offboarding. For clients without HR-to-Entra integration, we configure that during setup.

What's your stance on "gamification" of security training?

Selective. Phin includes leaderboard and streak features that some clients love and others find distracting. We default to minimal gamification — clear completion tracking, transparent metrics, no leaderboards — and enable gamification features per client request.

Do executives take the same training as everyone else?

Executives get role-specific training covering attack patterns targeting them (whaling, wire fraud, deepfake voice calls, business travel threats). They also complete the general monthly content so they're aware of what their teams are seeing. Some executives resist training on principle; we handle that conversation directly with leadership — compliance evidence requires completion across all roles including leadership.

Does the program cover AI-related security topics?

Yes, and increasingly so. Current AI-topic modules include: deepfake recognition, AI-voice impersonation attacks, recognizing AI-generated phishing (harder to spot than older human-written phishing), risks of entering sensitive data into consumer AI tools, and company AI usage policy reinforcement. For clients deploying Copilot, we include specific training on responsible Copilot use and data boundaries.

Can we customize the content for our company?

Yes. Standard customization includes: logo and branding in emails and training, scenarios using your actual email patterns and domain, industry-specific modules activated. Deeper customization (recording custom videos, developing company-specific modules) is available as a project engagement.

---