Skip to content

STRATEGICRepublic of San Marino

AboutContact
ItalianoEnglish
Client area
Contact

Security training

Cybersecurity training for staff and managers: role-based courses and agreed phishing simulations

Many attacks go through a person before they reach a system: an email that looks like it comes from a supplier, a call from fake technical support, a reused password. Strategic trains office teams, accounts, managers and IT with courses designed for each role. Phishing simulations are announced and agreed with management, nobody is punished, and every activity goes into a log.

Let’s talk about the programmePhishing simulations
Example graphic: a test email from a fake supplier with two warning signs highlighted, the role-based tracks, what is measured and the training log.
Example · the email, sender and activities are not real
By role
office teams, accounts and payments, managers, IT
Announced simulations
agreed with management, nobody is punished
Training log
useful for NIS2 and for client questionnaires

01 · copy the link to this sectionThe situation

The most common attacks go through people

None of these attacks needs a flaw in your systems.

An email asks you to update a supplier’s bank details. A call from fake technical support asks you to install a program. A password also used outside work opens the company mailbox.

One course for everyone, once a year, does little. Whoever pays invoices must spot a fake change of bank details. Whoever runs the company must know what to decide in the first hours of an incident. Whoever manages the systems must know the attacks on accounts with the most permissions.

That is why training is designed by role, with examples taken from everyday work and hands-on exercises.

Fake Microsoft support: how to recognise the callHow a reused password opens the company’s doors

02 · copy the link to this sectionRole-based tracks

A track for every role, from office teams to the board

Everyone starts from the same basics. Then each role works on the risks it actually meets.

CYB Office teams Suspicious emails, attachments and links, QR codes, passwords and two-factor sign-in. What to report, to whom and how, without worrying about bothering anyone. Hands-on exercise: a few sample emails to recognise and report.
CYB Accounts and payments Bank detail changes, fake invoices, urgent requests that seem to come from the top. The rule of checking by phone, on a number you already know and not the one in the message. Hands-on exercise: a fake payment request, examined together.
CYB

Managers and the board

Who decides what in the first hours of an incident, and what to communicate to whom. For NIS2 entities, the training the law requires of the management bodies. Hands-on exercise: a drill on a simulated incident. Cyber incident response
CYB IT and system administrators Accounts with elevated permissions, supplier access, isolated backups, signs of an attack under way and first moves. Hands-on exercise: an access review on a test system.

The exercises are examples. The real ones are chosen with you before we start.

03 · copy the link to this sectionPhishing simulations

How to run a phishing simulation without embarrassing anyone

A simulation is there to teach people to report, not to catch anyone out.

Agree it with management

Objective, period, who is involved, what is measured and what is not. The data protection officer is involved and, where needed, your lawyer and staff representatives.

Announce it

Everyone knows that tests will arrive during the period. Nobody is told when or how.

Send the test

A credible email, built on real attacks. Personal topics such as health, family or pay are avoided.

Explain straight away

Anyone who opens the link sees a page showing the signs to look for. No telling-off.

Discuss as a group

Results are presented by team, without names. Together, you decide what to change in your procedures.

What is measured?
How many people report the test to the contact person, and how quickly. Those who open the link only count as a group figure.
Why is nobody punished?
People who are afraid of getting it wrong do not report. In a real attack, what matters is that someone raises the alarm straight away.

04 · copy the link to this sectionReference

The training log and what NIS2 requires

Updated 7 November 2026

In short: in NIS2 entities, leadership must be trained and must promote staff training. The ACN expects a training plan and a log of activities.

  • Management bodies. They must follow cybersecurity training and promote regular training for staff (Legislative Decree 138/2024, Article 23(2)).
  • Security measures. The minimum elements include basic cyber hygiene practices and cybersecurity training (Article 24(2)(g)).
  • Documents. Among the evidence the ACN lists are a cybersecurity training plan and logs of staff training activities (FAQ MSB.11).

What we record in the log

For each activity, the date, the group involved, the topics and the results of the exercises, by group. The same log serves for client and insurer questionnaires.

This box is for information only and is not legal advice. For companies outside NIS2, the obligations of each case, for example on data protection, should be assessed with your lawyer.

Sources (consulted on 7 November 2026)

NIS2 readiness

05 · copy the link to this sectionWhere and how

On site or remotely

  • On site in San Marino, Romagna, the Marche and Emilia. Remotely anywhere in Italy. You can also mix the two, for example managers on site and office teams remotely. Schedule and length are set in the programme before we start.

  • No real data in the exercises. We work with sample emails and documents, or with anonymised data.

AI training courses

06 · copy the link to this sectionFrequently asked questions

Frequently asked questions about cybersecurity training

Is cybersecurity training for staff mandatory?
For NIS2 entities in Italy, yes, in two ways. The management bodies must follow training and promote regular training for staff (Article 23 of Legislative Decree 138/2024). The ACN also lists a training plan and an activity log among the evidence. For other companies, the obligations of each case should be assessed with your lawyer. Clients and insurers often ask for it anyway.
How do you run a phishing simulation without causing problems with staff?
It is agreed beforehand with management, the data protection officer and, where needed, your lawyer and staff representatives. Everyone is told that tests will arrive during the period, but not when. Results are presented by group, without names, and nobody is punished.
What is measured in a phishing simulation?
Above all, how many people report the test to the contact person, and how quickly. That is the behaviour that counts in a real attack. Those who open the link only count as a group figure, to see which teams need more practice.
Where are the courses held?
On site in San Marino, Romagna, the Marche and Emilia, or remotely anywhere in Italy. You can mix on site and remote. Schedule and length are set in the programme before we start.

07 · copy the link to this sectionObservatory

From the Observatory: scams that go through people

Analysis and guides from the Strategic editorial team.

All cybersecurity articles

The essential parts of this page print as a short summary of a few pages, without images or invitations to get in touch.

08 · copy the link to this sectionContact

A training programme for your company

A few details are enough: how many people, which teams, on site or remote, and any deadlines. We reply by email, usually within two working days.

Please do not put staff personal data in the form.

Or write to us:WhatsAppstaff@strategic.sm

On WhatsApp, messages are answered by Strategic’s AI assistant. Please do not use it for confidential information.

Your requestCYBCybersecurity

Do any of these questions sound familiar? tick the ones that apply to you

The form opens with the topic and the questions already filled in.