Security Awareness Training for UK Organisations
Cyber Essentials, the NCSC's 10 Steps, and UK GDPR require ongoing security training. A-SAT delivers adaptive phishing, smishing, deepfake, and voice-clone simulations with audit-ready reporting.
By submitting, you agree to receive communications from Aspire Tech. You can unsubscribe at any time.
For UK teams who have to evidence it, not just deliver it
Change behaviour with realistic, personalised simulations
Four channels, one adaptive platform. Every simulation is role-based, escalates with each user's risk score, and teaches at the exact moment a mistake is made.
UK-relevant lures
Tested on the messages your staff actually receive
HMRC notices, Companies House filings, payroll and pension changes, supplier invoice redirection — not IRS and 401(k) templates that nobody in your organisation would ever open.
- AI-generated email and SMS, refreshed continuously
- UK-context scenarios across finance, HR and operations
- Mobile-optimised landing pages staff actually meet
HMRC: you are due a tax refund of £248.60. Submit your claim before it expires:
hmrc-refund-claim.info
Good catch. HMRC never notifies refunds by text link. Micro-lesson delivered — at the moment it mattered.
Point-of-click training
Catch the click at the exact moment it happens
When someone clicks, taps or complies, micro-training fires immediately — while the lesson lands. This is also the closest thing on the market to what the NCSC actually asks for: security designed around how people work, rather than an exercise that punishes them for being human.
- Instant micro-lesson tied to what was missed
- Live risk score per user drives difficulty
- High-risk staff get more; low-risk staff are left alone
Updated bank details for this month's invoice
from: accounts@aspire-tss-billing.co
Please note our new account details before Friday's payment run…
3 clues you can spot next time:
- Look-alike domain
- Deadline pressure
- Bank details changed by email
Beyond email
Meet a deepfake before a criminal introduces you to one
A cloned voice needs about thirty seconds of audio; a deepfake video needs a short clip. Around two-thirds of employees cannot reliably spot AI-generated video — a controlled test is a better place to learn that than a payment request.
- Photorealistic deepfake video from a short clip
- Live conversational AI voice-clone (vishing) calls
- Dark web credential exposure fed into risk profiles
Finance Director
Incoming call · +44…
The evidence file
Evidence for your assessor, your board and the ICO
A completion report proves the training was delivered. A trend line proves it worked — and under an outcome-based framework like the CAF-aligned DSPT, only the second one counts. Reporting is automated and mapped to UK GDPR, ISO/IEC 27001:2022 and PCI DSS v4.0.
- Per-user completion by department, site and role
- Click rate, report rate and repeat-offender tracking
- Proof that board and senior management were trained too
Human risk dashboard
Cyber Essentials · UK GDPR · ISO 27001
Phishing click rate — trending down
85%
fewer security incidents
92%
training completion
Your certification covers systems. Attackers target people, on four channels.
Most awareness platforms sold in the UK simulate one thing: email. The attacks landing on UK organisations arrive by SMS, by phone and increasingly by video — with UK-relevant lures, not translated US templates.
SMS smishing
AI-generated SMS modelled on the messages your staff actually receive — delivery notices, bank alerts, HMRC messages and multi-factor prompts — with mobile-optimised landing pages.
Deepfake video
Upload a short clip; the platform generates a photorealistic avatar for a simulated executive-impersonation attack.
Voice cloning (vishing)
A cloned voice from around 30 seconds of audio; an AI agent calls staff and holds a live conversation, responding in real time.
Dark web monitoring
Continuous scanning of breach data for compromised staff credentials — included from the entry tier, not sold separately.
Cyber Essentials Plus tests how your organisation stands up to simulated attack. If your current platform has only ever tested email, you do not know how your people respond to the other three channels.
UK compliance
Where UK requirements actually sit in 2026
Cyber Essentials assesses five technical controls — and every one of them can be undone by a member of staff who hands over credentials to a convincing email. Cyber Essentials Plus goes further and tests how your organisation stands up to simulated attack, at which point the state of your people stops being a theoretical question.
Certifying without training your staff is buying a lock and leaving the key with someone who has never been taught not to give it away.
Cyber Essentials
Danzell question set, April 2026IASME published updated Requirements for IT Infrastructure (v3.3) on 3 November 2025, effective April 2026 and applying to all assessment accounts created after 27 April 2026. The question set is now Danzell, replacing Willow — with a significant change to how MFA is assessed, new auto-fail rules for security update management, and a new cloud services definition that can no longer be excluded from scope.
NCSC 10 Steps
User education and awarenessThe NCSC treats user education as foundational, and its position is explicit: blaming users for clicking is not a security strategy. Security should be designed around how people actually work — an argument for adaptive, contextual, in-the-moment training rather than an annual module.
UK GDPR
Article 32Appropriate technical and organisational measures are required. Following a personal data breach the ICO consistently examines what staff training was in place — and evidenced training with a measurable trend is a materially stronger position than an assertion.
Cyber Security and Resilience Bill
In the Lords, 2026The most significant update to UK cyber legislation since the 2018 NIS Regulations. Introduced 12 November 2025, it cleared the Commons and entered the Lords on 25 June 2026, with second reading on 14 July 2026 and Committee Stage scheduled for 1 September 2026. Royal Assent is expected in late 2026, with full effect around 2028 via secondary legislation.
Cyber Governance Code of Practice
Cyber Resilience Pledge, 7 July 2026More than 60 businesses and strategic government suppliers have committed to implement the Code within 90 days and to ensure all board members complete NCSC Cyber Governance Training, repeated annually. Board-level cyber training now has a date attached — and most awareness platforms have nothing built for a board.
NHS DSPT
CAF-aligned, 2025/26The Data Security and Protection Toolkit is now aligned to the NCSC Cyber Assessment Framework and assessed on outcomes. The former requirement to train 95% of staff on the national e-learning was replaced by a requirement that all staff have an appropriate understanding of information governance and cyber security — a harder bar, because it requires measurement rather than a completion figure.
What UK organisations see
average reduction in security incidents
training completion rate
organisations served
Measured across Aspire Tech client deployments. Methodology and measurement period available on request.
How A-SAT compares
MetaCompliance is UK-based with a long track record, and we are a new entrant here — we say so. The rows that decide it are deepfake, vishing, dark web and adaptive difficulty.
| Capability | A-SAT | MetaCompliance | KnowBe4 |
|---|---|---|---|
| Email phishing simulation | Yes, AI-generated, continuously refreshed | Yes | Yes, largest library |
| SMS smishing simulation | Yes | Limited | Limited |
| Deepfake video simulation | Yes, self-service avatar creation | Not available | Not available |
| Voice-clone (vishing) simulation | Yes, live conversational AI agent | Not available | Not available |
| Dark web credential monitoring | Included from entry tier | Separate | Separate product |
| Point-of-click micro-training | Immediate, at moment of failure | Batch | Batch |
| Adaptive per-user difficulty | Yes, driven by live risk score | Partial | Partial |
| Board-level training content | Yes | Yes | Yes |
| UK market presence | New entrant | UK-headquartered, established | Global incumbent |
Full feature-by-feature comparison on our KnowBe4 alternative page.
Built for your regulator
Financial services
FCA operational resilience expectations, UK GDPR and PCI DSS in one reporting view.
NHS and healthcare suppliers
CAF-aligned DSPT evidence — demonstrating appropriate understanding, not just a completion percentage.
Public sector suppliers
Cyber Essentials and Cyber Essentials Plus readiness on the human-controls side.
Legal and professional services
High-value BEC and invoice redirection exposure, client data under UK GDPR.
Enterprise and SME
ISO 27001 and Cyber Essentials evidence without a dedicated compliance headcount.
How deployment works
- 1
Discovery call, 30 minutes
We map your workforce, structure and current programme against what your assessor, regulator or board expects. Available within 24 hours of request.
- 2
Pilot
A defined group with a baseline simulation, so you see the real click rate before anything changes.
- 3
Directory integration
Active Directory, Okta, SAML or HR system sync.
- 4
Rollout
Role-based paths assigned, adaptive simulation schedule begins — in days, not quarters.
- 5
First evidence file
Baseline versus current, formatted for Cyber Essentials assessment, ISO 27001 audit, DSPT submission or a board pack.
A 30-day free trial is available, or start with a scoped pilot.
Pricing
Plans start from $1.17 per user per month, billed annually. Every plan includes phishing simulation, adaptive training, risk profiling and dark web exposure monitoring. Higher tiers add 24/7 support, automated compliance reporting, real-time attack simulation and SOC integration. 30-day free trial, no card required.
GBP pricing and VAT treatment confirmed on your quotation.
See it against your own organisation
Thirty minutes, a live walkthrough, and a straight answer on the gap between the training you run today and the evidence your next Cyber Essentials assessment, DSPT submission or board review will ask for.
By submitting, you agree to receive communications from Aspire Tech. You can unsubscribe at any time.
Frequently asked questions
Does Cyber Essentials require security awareness training?
Cyber Essentials assesses five technical controls rather than listing staff training as a separate requirement, and user education runs through the scheme supporting guidance. In practice the technical controls depend on staff behaviour, and Cyber Essentials Plus tests how the organisation stands up to simulated attack — at which point untrained staff become a visible failure point.
What changed in Cyber Essentials in April 2026?
IASME published an updated Requirements for IT Infrastructure document, version 3.3, on 3 November 2025, effective from April 2026 and applying to all assessment accounts created after 27 April 2026. The question set is now called Danzell, replacing Willow. Key changes include a significant revision to how multi-factor authentication is assessed, new auto-fail rules for security update management, a new definition of cloud services which can no longer be excluded from scope, and updates to scoping, certification transparency, backups, user access control and application development.
What does the NCSC recommend for staff security training?
The NCSC 10 Steps to Cyber Security treats user education and awareness as foundational, and its guidance is explicit that blaming users for mistakes is not a security strategy. Security should be designed around how people actually work, which points towards continuous, contextual training rather than an annual presentation.
Will the Cyber Security and Resilience Bill require staff training?
The Bill widens the range of regulated sectors and strengthens incident reporting and enforcement. As of August 2026 it has cleared the House of Commons and is in the House of Lords, with Committee Stage scheduled for 1 September 2026, Royal Assent expected in late 2026 and full effect expected around 2028 through secondary legislation. Organisations newly in scope should expect to evidence people controls alongside technical ones.
What does the NHS Data Security and Protection Toolkit require for staff training?
The 2025/26 DSPT is aligned to the NCSC Cyber Assessment Framework and assessed on outcomes. The former requirement to train 95% of staff on the national Data Security Awareness e-learning was replaced by a requirement that all staff have an appropriate understanding of information governance and cyber security.
Is A-SAT UK GDPR compliant?
The platform is built to support UK GDPR obligations, including the technical and organisational measures expected under Article 32, and is SOC 2 Type II certified. Data processing terms and hosting arrangements are confirmed as part of onboarding.
Can A-SAT simulate deepfake and voice-phishing attacks?
Yes. Administrators can generate a photorealistic avatar from a short video clip for deepfake simulations, and the platform AI agent can call staff using a cloned voice and hold a live conversation, tracking who complied, who questioned and who reported.
How does A-SAT compare with MetaCompliance or KnowBe4?
Both are established platforms with large content libraries and long UK track records. The A-SAT differences are simulation coverage beyond email — SMS, deepfake video and voice cloning — dark web credential monitoring included from the entry tier, adaptive per-user difficulty driven by a live risk score, and training that fires at the moment of failure.