Managed Security Awareness Training and Phishing Simulation

It is a recurring, fully managed program that IT Partner operates on Microsoft Attack Simulation Training in Defender for Office 365: monthly phishing simulations with rotating techniques, automatic micro-training for users who fail, an automatic onboarding stream for new hires, and quarterly reports formatted for cyber insurers and auditors. It costs $375 per tenant per month plus $3 per enrolled user per month, with no long-term commitment.

Small and mid-size organizations that need continuous, evidenced security awareness training — most commonly because a cyber insurance renewal, a compliance framework, or a customer audit asked for proof of regular phishing simulations and training completion, and a once-a-year test no longer answers the question.

The one-time engagement is a project: up to three deeply customized payloads built for your environment, executed within a month, with a findings report — excellent as a baseline or an annual red-team-style exercise. This service is the ongoing program: a campaign every month, training follow-through, new-hire coverage, and quarterly evidence reporting, billed monthly per tenant plus per enrolled user. Many clients run the one-time simulation first and roll its results into this program's first quarterly report.

Microsoft requires Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2 for users included in Attack Simulation Training — and the license is needed by every simulated user, not just the administrator. Note that Microsoft 365 Business Premium includes Defender for Office 365 Plan 1, which is not sufficient for this feature; Plan 2 is available as an add-on. We verify licensing during onboarding and flag exactly who is covered before anything launches.

IT Partner designs that month's campaign — technique, lure theme, and target groups — launches it through Attack Simulation Training, monitors delivery, and reviews the results. Users who click or submit credentials get training assigned automatically. Your named contact receives a monthly summary; every third month it rolls up into the quarterly evidence report.

Nothing punitive from our side: the user lands on a teachable moment and is automatically assigned a short, relevant training module with a due date and reminders. Results reach your contact in aggregate, with repeat-clicker patterns identified so you can decide how to handle them under your own HR policy — that consequences framework is deliberately yours, not ours.

The evidence insurers and auditors actually request: simulation cadence and coverage, click and compromise rates by campaign and technique, training assignment and completion rates, repeat-clicker analysis, new-hire coverage, and quarter-over-quarter trends — presented so it can be attached to a renewal questionnaire or shown to a board without rework.

Automatically. New users are enrolled into an onboarding stream — a baseline simulation plus foundational training — without anyone filing a request. New employees are a favorite phishing target precisely because they do not yet know what internal email looks like, so the program covers them by default rather than by memory.

Three practical reasons: the capability is already in licensing many organizations own (E5 or Defender for Office 365 Plan 2), it runs natively inside your tenant with no additional vendor processing your employee data, and results integrate with the Microsoft security stack you already operate. If your organization is committed to a third-party platform, this particular service is not the fit — we scope it honestly rather than manage a tool it is not built for.

Two components, both monthly. A $375 per tenant per month program fee covers the platform side — configuring and maintaining Attack Simulation Training in your tenant, designing and launching each month's campaign, running the new-hire stream, and producing the monthly summaries and quarterly evidence reports. On top of that, $3 per enrolled user per month covers each person simulated and trained — the users included in the program that month are the users billed. As a worked example, a 100-user organization pays $375 + $300 = $675 per month. Program setup in the first cycle is covered by the tenant fee rather than billed as a separate onboarding charge. It is a month-to-month service with no long-term contract: you can stop at any time, and all we ask is payment of previously approved invoices.

The program is designed to build a reporting culture, not a fear culture. Campaigns respect the freeze periods and sensitive-team exclusions you set, individual results are handled through automatic training rather than public callouts, and communications templates for launch are part of onboarding so employees hear about the program from leadership, not from a lure.

Campaigns are tailored within the program — lure themes, targeting, difficulty, and timing are adjusted to your organization, and techniques rotate monthly. Bespoke payload engineering that deeply mimics your internal applications is the province of the one-time Phishing Attack Simulation engagement, which exists precisely for that depth and pairs well with this program as an annual exercise.

The program is built around what insurers commonly ask for — regular simulations, measured completion, documented cadence, and trend evidence — and the quarterly report is formatted to answer those questionnaires directly. But no service provider can honestly guarantee an underwriting outcome: insurers differ, and the decision is theirs. What we ensure is that when the question arrives, you have real evidence instead of a scramble.

We tell you, in plain terms, in the monthly summary or quarterly review — for example, if failure patterns suggest weak email authentication or missing Defender policies, or if a real incident surfaces during the program. Fixing those problems is separate, honestly scoped work: email security hardening for posture gaps, and the Managed Detection and Response service if you need continuous monitoring and response behind the training layer.

The first monthly cycle covers onboarding end to end: licensing verification, tenant configuration, scope and communications sign-off, and the baseline campaign. From the second cycle the program is in steady state. The main schedule dependency is your side's sign-off on scope and communications — the technical setup is rarely the long pole.