Custofaber Guard / Guard Aware
Awareness
Most attacks start with an email. Prepare your staff.
Guard Aware brings together short, clear awareness trainings and controlled phishing exercises. It measures not who clicked what, but how much more resilient the organisation becomes over time.
Training, exercise, measurement.
Not a presentation once a year, but a short, regular cycle.
Short trainings
A few minutes each, in your organisation's language: real scenarios such as a fake invoice, a fake request from a manager or a fake password reset.
Each training: one topic, one example, one piece of advice.
Controlled exercises
Harmless phishing emails are sent to staff from the organisation's own server. Anyone who clicks immediately sees a short explanation.
No harmful attachments, no outside service.
Progress report
Tracks click and report rates by unit and over time. The goal is not to catch people out but to send training where it is needed.
Trends by unit, suggestions for repeat training.
A four-step cycle.
You set the scope and timing; Aware runs the cycle.
-
Training
Short content is assigned to staff and completion is tracked.
-
Exercise
A controlled phishing email is sent on the date and with the scenario you choose.
-
Measurement
Click, report and completion rates are reported by unit.
-
You decide
Which unit gets repeat training and when the next exercise runs: the decision is yours, the record is in Aware.
It does not single people out.
Reports focus on units and trends. The organisation decides how exercise results are shared.
It uses no outside service.
Training content and exercise emails go out from your organisation's server; staff data never leaves.
It does no real harm.
Exercise emails contain no harmful attachments and no page that collects real credentials.
Guard Aware FAQ.
Won't exercises damage staff trust?
We recommend informing the whole organisation before exercises begin. Nobody who clicks is blamed; they see a short explanation. The target is the habit, not the person.
Where are the emails sent from?
From your organisation's server, through a sender set up in your email system. No outside phishing service is used.
Can we edit the training content ourselves?
Yes. Your organisation's authorised staff write and edit both the training content and the exercise email text; every change is recorded.
How are results handled under Türkiye's data protection law (KVKK)?
Personal data is kept to a minimum, access depends on permissions and is recorded. Reporting is done by unit.
See Aware with your own scenario.
Tell us how many staff you have and the kind of phishing you see most; we will build the demo around it.