Protect your people

Security awareness training and phishing simulations for your staff

Our security awareness training pairs short, plain-language sessions with phishing simulations your management approves in writing. Staff learn to spot a fake invoice, a false sign-in page or an urgent request from the boss, and to report it in one step. Management gets a report on how the office responds, without anyone's name on a list.

Ask us to call you back Book the free audit

Four clinic staff in scrubs, in their fifties and sixties, around a round break-room table with coffee mugs, listening to someone out of frame — Short sessions built on what the office's own test showed.

A person here calls you back the same business day, usually within an hour.

Written permission first
A report in plain words
Checked again after the fix

What the programme covers

A security awareness training programme with us has three parts: a phishing simulation that measures where your office starts, short training sessions built on what that test showed, and repeat simulations at a rhythm management chooses. Every round ends in a report that shows the trend for the office as a whole.

The aim is a habit more than a score. Staff who pause on an odd request and press the report button give your office an early warning that filters miss, and the Canadian Centre for Cyber Security notes that trained staff are less likely to fall for phishing.¹ The Centre's Learning Hub also offers free self-paced courses to organizations registered in Canada;² our sessions sit on top of that, built on your own office's results and examples.

Phishing test emails written for your office, sent only to the people and dates set out in the approval letter.
Cyber security training for employees in short sessions, in person in the Ottawa area by arrangement or online, in English or French.
A report-it habit: one clear way to flag a suspicious message, and a named person who receives it.
A round report for management after each simulation, with results grouped by team and no individual names in what is shared.

Why staff training sits among Canada's baseline controls

Staff training is one of the thirteen baseline controls the Canadian Centre for Cyber Security sets for small and medium organizations, and spotting malicious emails and links is named as a focus of that training.³ In its phishing guidance the Centre goes a step further: organizations should run internal phishing simulations so staff can practise in a safe setting.¹

Privacy law points the same way. PIPEDA requires organizations to make their employees aware of the importance of keeping personal information confidential, and Quebec's private-sector act requires security measures that are reasonable for the information a business holds.⁴⁵ A trained office and a dated training record are part of showing that those measures exist.

What Canadian guidance and law say about staff awareness
Source	What it says	What it means for your office
Cyber Centre baseline controls, BC.6.1	Organizations should invest in cyber security awareness and training for their employees.³	Training is a baseline expectation for an office of any size.
Cyber Centre, ITSAP.00.101 (2025)	Organizations should conduct internal phishing simulations.¹	Simulations are recommended practice, run inside your organization with approval.
PIPEDA, Schedule 1, clause 4.7.4	Organizations shall make their employees aware of the importance of maintaining the confidentiality of personal information.⁴	Awareness of staff is part of the safeguards duty for client data.
Quebec, CQLR c P-39.1, s. 10	A person carrying on an enterprise must take reasonable security measures for personal information.⁵	For Quebec clients, training records help show measures are in place.

How a phishing simulation programme runs

A phishing simulation programme runs in five steps: written approval, a baseline test, short training, repeat simulations and a report to management, after which the cycle starts again with the next round. The first test email goes out only after the approval letter is signed, and the people who must know in advance, such as IT and the person who receives reports, are told.

The rhythm is yours to choose. Some offices want a test every month during the first season and fewer after; others prefer one round per quarter tied to staff meetings. We propose a rhythm in the scope letter and adjust it with you after the first report.

1. Approval and scope

Management signs a letter that names who receives test emails, the sending window, the themes allowed, the themes ruled out (for example pay, benefits or medical matters) and who sees the results.

2. Baseline phishing test

A first round shows where the office starts: how many people opened, clicked, entered a password or reported the message. That baseline is what later rounds are measured against.

3. Short training built on the results

Sessions focus on what the baseline showed. A clinic that clicked on a delivery notice needs a different hour from a law office that answered a fake request from a partner.

4. Repeat simulations and the round report

Each later round changes the theme and the difficulty. After each one, management receives the trend, the themes that still work on staff and what the next session will cover.

One round of the programme, from written approval to the report that plans the next round.

What the cyber security awareness training sessions teach

The sessions teach staff to recognize the messages that actually reach small Canadian offices and to report them in one step. The Cyber Centre describes phishing as arriving by email, text, phone call, social media and QR code, so the training covers all of these, with examples close to your daily work.¹

Each session is short enough to fit between appointments and uses no jargon. Staff leave knowing what to do, who to tell and that slowing down a payment to check it will never get them in trouble.

Fake invoices and changed bank details, with the rule that a change is confirmed by phone on a number already on file.
Urgent requests that seem to come from the owner, a partner or a director (spear phishing and whaling).
False sign-in pages for Microsoft 365, Google and banks, and unexpected sign-in approval prompts on a phone.
Texts (smishing), voice calls (vishing) and QR codes (quishing) that lead to the same traps.¹
How to report a suspicious message inside the office, and where real incidents go: fraud to the Canadian Anti-Fraud Centre and local police, cyber incidents to the Canadian Centre for Cyber Security.⁶⁷

Fair to staff: how results are handled

A phishing test works when staff trust it, so results are handled under a confidentiality agreement and shared with management by team, with trends and themes. Individual results go only to the person named in the approval letter, and only to plan extra help.

Staff are told at the start that the office runs simulations, without being told when. A person who clicks gets a short explanation on the spot, the same day; nobody is named in meetings, emails or lists. Offices with a union check the collective agreement before the first round, and we adjust the plan to it.

What you have in hand

After each round you hold a report management can read in ten minutes and a training record you can show an insurer, an auditor or a client who asks how your staff are prepared.

Campaign report: share of messages opened, links clicked, passwords entered and messages reported, by round and by team.
Training materials from each session, in English or French, which stay with your office.
Attendance and dates of each session, for your records.
A plan for the next rounds: themes, rhythm and who receives reports.
Recommendations outside training where the results point to them, such as a second sign-in step or email security on your domain.

Why a contracted team: the risks of doing it alone, with a chatbot or a freelancer

Phishing tests sent from a free tool or a personal account tend to fail in one of two ways. Your mail filter blocks them, so the result says nothing, or the filter learns to trust that sender, which leaves an opening a real attacker can use. Either way the office learns the wrong lesson.

A chatbot writes a convincing lure in seconds, and that is the problem: it will happily imitate a real bank, a real courier or your own payroll provider, and it has no view of what your staff can fairly be tested on. A lure about pay cuts or a medical result can damage trust in a week, and staff remember who sent it.

A freelancer may run the campaign well and keep the results, the staff list and the click data on their own systems. With us the approval letter fixes who is tested and what themes are off limits, staff data is covered by a confidentiality agreement, and the reports and training materials belong to your office.

Five plain reasons to trust us with this

A registered Canadian company
INNOVA CONSULT LTD., federal corporation 1522612-1, based in Ottawa. itopsi is its brand.
In practice since 2013
The group behind itopsi has run legal and marketing practices since 2013. Its founder has worked in law and compliance for more than 14 years.
We run servers of our own
Our own servers and more than 80 websites are checked for known vulnerabilities every day.
Insured
Commercial general liability insurance of CAD 1 million is in force.
Your scope, your report
A fixed scope in a signed letter before any work starts. Licences and equipment at cost, with no vendor commission. The report belongs to you.

How the work goes

Five steps, in the same order every time.

Before any test, you sign a scope letter: what we test, on which dates, who to call, and what we must leave alone.

Your signature comes first

Step 1

We agree what to check

A short call, or the form at the foot of this page. Together we decide which website, server or office systems we look at.

Step 2

You sign the scope letter

It sets the targets, the dates, the contacts, and what we must leave alone. Work starts only once it is signed.

Step 3

We check, and write it down

One report in plain words for you, with the technical detail attached for whoever looks after your systems.

Step 4

We fix it

We make the repairs ourselves, or together with your current IT provider or web developer.

Step 5

We check again

A second check confirms that each problem is closed.

What it costs

Each job is a different size, so each one gets a fixed quote once the scope is agreed. You see the price in writing before any work starts.

Ask for a quote →

A fixed quote once the scope is agreed
The price in writing before work starts
A second check after the fixes

Questions

Questions owners ask us

Your question is missing? Leave your number and ask it in your own words.

Ask on a call

How often should we run phishing simulations?

Often enough to build a habit, and spaced enough that staff do not feel watched. We usually propose a round every month for the first few months, then one round per quarter once the share of staff who report a test message is steady. The rhythm goes into the scope letter, and we review it with you after the first results.

What if an employee clicks a real phishing email?

Keep the message, leave the computer on and tell the person who handles reports straight away. If a password was typed, change it from another device. If money moved, call your bank first. Report fraud to the Canadian Anti-Fraud Centre at 1-888-495-8501 and to local police, a cyber incident to the Canadian Centre for Cyber Security, and tell your insurer. Then send us your number.

Is phishing testing of staff allowed in Canada?

The Canadian Centre for Cyber Security recommends internal phishing simulations. How they are run is what matters: management approves in writing, staff know a programme exists, results stay confidential, and themes that would hurt people are ruled out. Unionized workplaces check the collective agreement first. For a question about your specific situation, your lawyer gives the legal answer.

Does training satisfy our cyber insurer?

The insurer decides what satisfies its own questions. If a renewal questionnaire asks whether staff are trained or tested for phishing, the round reports and attendance records give you dated evidence to answer it honestly. We can sit with you while you fill in the security questions, so what you declare matches what is actually in place.

How long are the training sessions?

Short. Each session is planned to fit between appointments or at the start of a staff meeting, and one session covers one theme. The exact length and format, in person in the Ottawa area or online, in English or French, are written into the scope letter after we know how many people take part and how your workdays are organized.

Will staff results stay confidential?

Yes. Results are covered by a confidentiality agreement. Management sees results by team, with trends and themes. Individual results go only to the person named in the approval letter, and only to plan extra help for someone who needs it. Names are kept out of meetings, emails and wall charts, because public lists teach people to hide mistakes.

How much does security awareness training cost?

The price depends on the number of staff, how many simulation rounds you want, how many sessions, the languages and whether sessions are in person or online. A 30-minute call is enough for us to write a fixed price into the scope letter, covering exactly the rounds and sessions it lists. Any software licence the programme needs is billed at cost, with no commission.

Tell us what worries you.

Leave your name and a number. A person here calls you back the same business day, usually within an hour, and asks what you want checked. Would you rather start on your own? The free audit takes about three minutes.

Book the free audit instead

Same day callback
Written permission first
Fixed quote