// Your teams as the first line of defence, not the first weakness.
Security awareness training
The vast majority of incidents begin with an ordinary action: a click on an attachment, a reused password, a payment made on the strength of an email. No firewall protects against that. I spend a full day with your teams, because habits are not acquired by listening to a presentation — they are acquired by doing. The morning covers the ground, the afternoon is hands-on, using the very tools your staff will rely on the next day.
Fraudulent emails, phishing and invoice fraud
Recognising a malicious message, reading a spoofed sender address, spotting a link that does not lead where it claims, and treating an unexpected attachment with suspicion. We pull apart the attacks that actually work: those impersonating a known supplier, a delivery company, the tax office or the managing director. We then put in place a simple double-check rule before any payment — the measure that prevents the most damage, and it costs nothing.
Passwords: the manager and two-factor authentication
Why a password reused across services is the real danger, and why changing it every three months achieves nothing. Installing and getting to grips with a password manager, as a workshop: creating the vault, generating passwords, sharing securely between colleagues, choosing a master password. Then enabling two-factor authentication on the accounts that matter. We also cover shared accounts and staff departures, two frequent blind spots.
Encrypting what matters: containers and removable media
A laptop left on a train, a USB stick lost on a site: without encryption, everything is readable. A hands-on workshop creating an encrypted container — a digital safe for sensitive documents — then encrypting a USB stick and checking that the machine's own disk is properly protected. We also cover how to send a confidential document without exposing it as a plain attachment.
Metadata: what your files say about you
A photo taken on a phone carries the GPS position of the place it was taken. A Word quotation keeps the author's name, the revision history and sometimes the name of the client the template was originally written for. A PDF records the software and the machine that produced it. We open real files together to see what they reveal, then learn to clean them before sending or publishing. The habit takes ten seconds and prevents embarrassing leaks — and it falls under GDPR as soon as photos of people or work sites are involved.
Public networks, wifi and VPNs
Hotel, airport and café wifi are not trusted networks. We explain what a VPN actually protects — and what it does not, since many people credit it with virtues it simply does not have. We compare a corporate VPN, which brings the employee back inside the company network, with consumer offerings. And we show why tethering from a phone is often the simplest and safest option.
Ransomware and backups: the first thirty minutes
What to do when a machine starts encrypting files: disconnect the network, do not switch it off, who to alert, and why paying makes no sense. We walk through the scenario together so that everyone knows what to do without panicking. And beforehand, the only question that matters about backups: have you ever tested a restore? A backup you cannot restore is worthless.
Remote working, mobility and personal data
Personal devices used for work, documents sent to a private address, USB sticks found or borrowed, screens visible in an open-plan office or on a train. We close with GDPR in plain language: what data you handle, what may be shared and what may not, and what to do if something is lost. An IT policy can be drafted following the day.
// faq
Frequently asked questions
Why a full day rather than a short briefing?
Because a presentation is forgotten within a week. The afternoon is hands-on: everyone installs their password manager, creates an encrypted container, and practises spotting real fraudulent emails. These are habits, not knowledge — and a habit is learned by doing it.
How many participants, and how is the day organised?
Fifteen people at most, so that the workshops stay useful and everyone can ask questions. Beyond that, we plan several days. The day can also be split into two half-days if your production cannot stop. Each participant leaves with written material.
What is needed, and is technical knowledge required?
No prior knowledge at all. You need a room, a projector and, for the afternoon workshops, each participant's usual work computer — the tools must be installed on that machine to be of any use afterwards.
Can you test the teams with a simulated phishing campaign?
Yes, with written approval from management and after informing staff representatives. Results are reported anonymously and in aggregate: the aim is to measure collective vigilance and focus the day, never to penalise an individual.
Can the day be funded by a French training fund (OPCO)?
No, and I would rather say so upfront: this is an awareness session, not a Qualiopi-certified training programme, so it cannot be covered by a French skills operator. It is invoiced as an ordinary professional service.
// other services