Notes from the workbench.

What Auditors Actually Accept as Proof of Training

A sign-in sheet isn't evidence. What assessors look for when they evaluate security awareness training, and the five artifacts that close the finding.

Why We Don't Do Phishing Simulations

A 19,500-person trial found phishing simulations cut click rates by about 2%. Here's what that means, and why we built a training platform without them.

You're Already Paying for Half of Your Security Program. You Just Can't Prove It.

Meta description Most SMBs already own the controls an auditor asks about. What they can't produce is evidence. How to inventory what you have and close the proof gap.

The Invoice Was Real. The Bank Account Wasn't.

BEC cost businesses $3 billion last year at ~$123K per incident. How vendor payment fraud actually works, and the two habits that stop it.

They Didn’t Hack In. They Called the Help Desk.

Your Cyber Insurance Renewal Just Got Harder. Here’s What the Application Actually Asks For Now.

41% of cyber insurance applications get denied. The 10 categories carriers actually evaluate, what they want to see, and how to close gaps before you submit.

CMMC Phase 2 Is Suspended. Your Training Obligation Isn't.

CMMC Phase 2 is on hold, but DFARS 7012, your NIST 800-171 self-assessment, and the training controls behind your SPRS score aren't. Here's what still applies.

Most MSPs Sell Security Awareness Training Wrong. Here’s How to Actually Make Money on It.

Most MSPs sell security awareness training wrong. The playbook for positioning it as a real service line, capturing renewal revenue, and protecting margin.

CMMC Assessors: Here’s a Security Awareness Training Tool You Can Actually Recommend.

What to recommend when CMMC clients ask about security awareness training. Auditor-ready certificates, quarterly cadence, and a reseller program that pays.

CMMC and Security Awareness Training: What the Framework Actually Requires

CMMC Phase 2 starts November 2026. What the framework requires for security awareness training, what assessors look for, and how ClickCerts fits.

Watch for Typos and Bad Grammar. (And Other Phishing Advice That’s Now Wrong.)

Watch for typos and bad grammar — that's outdated advice. AI-generated phishing has changed the rules. What your security training needs to teach now.

Your MSP Sells Security. Are You Actually Selling It?

Cyber insurance now requires security awareness training. If your MSP doesn't offer it, you have a gap. Here's how ClickCerts closes it, with margin.

60% of Breaches Start with a Click. Here’s How to Stop Yours.

60% of breaches start with human error. See why security awareness training is the highest-ROI investment you can make, and how ClickCerts delivers it.

You Don’t Need 1,000 Training Modules. You Need Your Team Trained.

You don't need 1,000 training modules. You need certified, current training your people will finish. Why simpler beats bloated, and what CMMC requires.