Strengthening the Human Firewall with Security Awareness

Protect: People Case Study - Allied Media

Allied Media engaged Cyclone to strengthen their human firewall by implementing Protect: People, a fully managed security awareness and phishing simulation service. The programme covers over 300 users and focuses on reducing the risks caused by human behaviour.

“What stood out with Protect: People is the continuous approach. Rather than one-off training, we’re seeing ongoing improvement in how our people identify and respond to threats. It’s helping us build a stronger security culture across the organisation.”

– Timo Janssen, CITO, Allied Media

The Challenge

Like many organisations, Allied Media recognised that phishing and social engineering remain one of the most effective attack methods. They needed an approach that would:

Build practical, lasting user awareness
Reflect real-world attack scenarios
Deliver measurable improvement over time
Be simple to manage and scale

The Solution

Cyclone implemented Protect: People, a continuous, managed security awareness programme combining:

Baseline phishing simulation to establish user behaviour and awareness
Ongoing phishing simulations with quarterly spear-phishing simulations
Behaviour-led localised online training
A personalised training session
Ongoing reporting to track engagement and behavioural improvement
End-to-end programme management with no additional management required by the customer

This enabled Allied Media to move beyond one-off training to a structured, measurable awareness programme.

Bringing the Risk to Life

As part of the programme, Cyclone delivers a quarterly targeted spear‑phishing simulation designed to reflect realistic attack scenarios.

In one campaign, users received an email offering a free coffee from a local café. The message included a link prompting users to log in to redeem the offer – mimicking a highly believable, localised phishing attempt.

Some users clicked the link and submitted their details, highlighting how easily even well‑intentioned employees can be caught by highly credible, real-world attacks. Some users took it a step further, even going to the café to redeem their ‘free’ coffee.

This example provided a powerful learning moment, helping users to:

Recognise suspicious links and login prompts
Better understand how attackers use familiarity and incentives
Apply critical thinking before engaging with unexpected offers