Alan Hughes
https://www.savenetsolutions.ie/
11-50
IT Services and IT Consulting
Dublin, Ireland
At a Glance
Savenet Solutions is a Dublin MSP of around 15 staff serving regulated organisations, healthcare and financial services. They build every client to the technical controls of ISO 27001 whether that client goes for the certificate or not — which is exactly what made security awareness training such an awkward gap.
Key outcomes
- Over 75% fewer phishing interactions, measured on a repeat of the identical simulation twelve months apart
- Credential entry fell from 50 staff to two or three in the same 200-person test
- Two ISO 27001 controls covered, not one — continuous training plus policy management with signature and version history
- A whole client onboarded in two to three hours, with no new administration job created
The Challenge
You can configure a firewall. You cannot configure a person.
Security awareness training is the one Annex A requirement you can't switch on from a console. At Savenet it was still a PowerPoint, opened once a year. Their clients were doing exactly the same.
And every click carried a cost that Savenet's own engineers absorbed. The sequence never varied: an alert that an account was live outside its normal location, an investigation, a word with the user, then a password and MFA reset.
“As a consequence, thirty or forty minutes times five per client is a lot of time to take away from other tasks that you could be doing day to day.”
Thirty to fifty minutes a head. Rarely one head, either. And Savenet carry the ISO 27001 promise for every client.
“At worst, it would probably be highlighted as maybe a minor non conformity that needed attention.”
The Solution
It ran itself, and it ticked a second ISO box
Alan set the bar before he went looking, and it was narrow. Savenet wanted the troubleshooting hours back, but not by taking on a second job administering the fix — which quietly ruled out most of the market. The established brands sold everything worth having as a bolt-on.
“And then we came across usecure through one of our distributors. And what we loved about it was the fact that it was very self-administering.”
The part nobody had budgeted for was policy management. Savenet went shopping to satisfy one ISO 27001 requirement and came away covering two.
“Couple that with its policy management feature, we then started to stray into a second area of ISO 27001, which is policy management, that usecure was actually ticking the box for then as well.”
The Results
The same test, twelve months apart
The proof came out of a demonstration Savenet ran for an educational institution in Dublin, and the first set of numbers was ugly enough to sell the project on its own. They phished 200 staff.
“Of the 200 staff, a hundred interacted with the email and visited the website. Of that 100, 50 people entered in their username and password. One of them was a member of the IT department.”
Twelve months of training later Savenet re-ran the identical simulation on the same parameters. The hundred had fallen to under twenty, with only two or three people handing over credentials. The training behind that shift was a five-minute video once a month.
- Training: a yearly PowerPoint in a room, now a five-minute video monthly — seven to eight minutes a month per person
- Phishing clicks: 100 of 200 staff, now under 20
- Engineer time: 30–50 minutes a head across three to five heads, now reclaimed with no new admin job
- ISO evidence: no record of policy sign-off, now signature and version history
How They Did It
They sell security for a living. This is what convinced them.
“Onboarding a client with usecure is incredibly easy. If the client is engaged with it, is giving you the time, there is nothing to say you couldn't have a client fully up and running within two to three hours within the actual platform.”
- It administers itself. Configure it once, then usecure onboards the staff, reads their posture, builds the training and runs the phishing on a schedule.
- Two ISO 27001 boxes, not one. Continuous training plus policy management, with the signature records and version history an auditor asks for.
- A straightforward sell. No separate line items for the training library or the phishing module, and a price Alan can explain in one sentence.
Alan's advice to MSPs
“I would recommend usecure. The support team are great to deal with. The content is being updated regularly. Custom phishing simulations — their support team are fantastic at helping us to design those and build those for our actual clients.”
Start your own story
Book a walkthrough and see how quickly security awareness training stops being the one control you can't evidence.