Bunkers Cyber Defense

Training

Cybersecurity training

Cybersecurity training teaches your teams to recognize phishing, protect their access and react without panic. Bunkers Cyber Defense offers it to SMBs, MSPs and municipalities in Québec; format, audience and duration are defined with you.

Talk to us about your security

Phishing · fictional example

Five signals in a single email

The five signals, in the order the eye should catch them

  1. Sender: the domain is not the organization's
  2. Urgency and a threat of suspension
  3. Generic greeting, no customer number
  4. Link text does not match its destination
  5. Compressed attachment for a simple invoice

From : Billing department <accounts@secure-payment-qc.net>

Subject : URGENT: unpaid invoice — account suspended in 24 h

Dear valued customer,

We have not received your payment. To avoid the suspension of your account, please confirm your banking details now by clicking the link below.

https://portal.hydro-quebec.com/invoice (the link goes to secure-payment-qc.net)

Invoice_0925.zip · 412 KB

How it goes

  1. 01

    Assess

    Audit, compliance assessment or penetration test: we first measure where you stand.

  2. 02

    Protect

    Safeguard websites, cloud environments and corporate networks; tailored security strategies and compliance frameworks.

  3. 03

    Watch

    Proactive threat detection and incident response, 24/7.

Frequently asked questions

All the questions →

How often should employees be trained?

A short training at hiring, a refresher at least once a year and regular exercises, for instance quarterly phishing simulations. Thirty-minute sessions built on real cases stick better than long presentations. The goal is a reflex: report quickly, without fear of blame.

What should a basic training cover?

Recognizing phishing by email, text and phone; passwords and multi-factor authentication; what to do and whom to call in case of doubt or error; secure file sharing; remote work and devices; and confidentiality obligations toward personal information. Adapt the examples to the tools your teams really use.

Should we run phishing simulations with employees?

Yes, if they serve to train rather than to trap. A well-run campaign measures the click rate, shows the missed clues immediately and repeats a few times a year with realistic scenarios. The useful result is not a zero rate but employees who report suspicious messages quickly, which gives the team time to act.

What is a tabletop exercise?

An incident simulation in a meeting room, without touching the systems: a realistic scenario unfolds (ransomware on a Friday evening, the accountant's mailbox compromised) and everyone says what they would do. In two hours, the gaps in the plan appear: who decides, how to communicate, where the backups are. It is the best-yielding exercise for a management team.

How do we know whether the training works?

Through simple measures tracked over time: click rate and above all report rate during simulations, the delay between a test email and the first report, the number of incidents avoided thanks to an employee, adoption of multi-factor authentication and of the password manager. A rising report rate is worth more than a falling click rate.

Related services

All services →