Most breaches start with one person clicking the wrong thing. We run a managed awareness programme that fixes that: twelve short e-learning modules a year, four unannounced phishing simulations, and monthly reports you can hand to an auditor. Your team supplies a staff list and reads the reports. We do the rest.
This is a managed awareness programme rather than a one-off training day. Across twelve months your staff receive short e-learning modules, roughly one a month, each covering a single practical topic: recognising a phishing email, handling personal data under the PDPA, password and account security, safe use of devices away from the office, ransomware, and social engineering over the phone and WhatsApp.
Four times a year we run an unannounced phishing simulation against the whole workforce. Anyone who clicks is redirected immediately to a short, non-punitive explanation of the specific red flags they missed. That is the moment the lesson lands, and it is why simulation paired with training outperforms either on its own.
Orbix runs the platform, schedules the modules, designs the campaigns, chases completions and writes the reports. The only things we need from you are a staff list and someone to read a monthly one-pager. There is no software for your IT team to install and no administrative burden that quietly falls on HR.
Awareness is the control that decays fastest. Behaviour improves sharply after a session and drifts back within three to six months, which is why an annual training day protects you for one quarter and leaves you exposed for the other three. A programme spread across the year holds the improvement instead of rebuilding it each January.
It is also the control auditors ask about first. Regular staff security training is an expectation under the PDPA as amended, a requirement under ISO 27001, and a standing question on nearly every enterprise client security questionnaire. Attendance sheets from a single session are weak evidence. Twelve months of module completion data, four campaign reports and a documented remediation record are not.
And for levy-contributing employers the economics are unusual: the training component can be structured as an HRD Corp claimable programme, which makes sustained awareness considerably cheaper than most organisations assume.
Everything below runs on a published annual calendar agreed with you at the start of the cycle, so your team knows what lands when.
Short, practical, jargon-free modules built for general staff rather than IT professionals. Most take eight to twelve minutes, which is the length people actually finish. Delivered through our learning platform with completion tracked automatically.
Unannounced campaigns using different scenarios each quarter, modelled on lures that genuinely land in Malaysian inboxes: e-invoice and LHDN notices, DuitNow requests, HR payroll letters, courier notifications and Microsoft 365 password warnings.
Staff who click land on a short coaching page explaining exactly what they missed, framed as guidance rather than blame. Programmes that name and shame drive under-reporting, which is the opposite of what you need.
A one-page report covering module completion, campaign results and the trend since last month, written for management rather than for a security engineer.
Completion records, campaign reports and remediation notes retained and formatted as the documented evidence an auditor, an enterprise client or the Commissioner will ask to see.
Participants receive certificates verifiable through our certificate verification page. The training component can be structured as an HRD Corp claimable programme under SBL-Khas, subject to grant approval before delivery.
The programme is designed to survive its first year, which is where most internally-run awareness efforts quietly stop.
Monthly reinforcement plus quarterly testing prevents the post-training drift that makes annual sessions so ineffective. Click rates fall and, more importantly, reporting rates rise and stay risen.
The reason awareness programmes lapse is administration. We carry the scheduling, content, chasing and reporting, so nobody in your organisation has to run it on top of their existing job.
You are not doing extra work to satisfy an auditor. The records the programme generates each month are the evidence, already in the right format.
Someone joining in March is enrolled into the running cycle rather than waiting until next year's session, which closes the gap that new starters normally represent.
Most security mistakes are not defiance, they are people unsure what the rule is. Short, regular, practical guidance removes the guessing.
An annual programme fee is easier to budget than ad hoc training spend, and the training portion is claimable for levy-contributing employers.
A twelve-month cycle with a fixed rhythm. Setup takes about two weeks from the point we have your staff list.
We agree headcount, departments, any language or shift-pattern considerations, and the twelve-month module and simulation calendar. Where HRD Corp claims apply we plan the schedule around grant application timing so approvals land before delivery.
Staff are enrolled on the platform and your IT team allowlists our sending infrastructure so simulated mail reaches inboxes rather than being filtered. This is a configuration change on your side that we document step by step.
The first campaign runs unannounced, before any training, to establish an honest starting position. Announcing it produces a flattering number that tells you nothing about your real exposure.
Modules release on the calendar and simulations run each quarter at escalating difficulty. Non-completions are chased automatically, and repeat clickers receive additional targeted coaching rather than a company-wide repeat.
A one-page report goes to your programme sponsor each month. We flag anything that needs attention, such as a department whose completion rate has stalled or whose click rate has moved the wrong way.
At month twelve you receive a full-year report with the movement, the evidence trail and recommendations for the next cycle. Organisations wanting risk scoring and board-level governance on top move to human risk management.
Reporting arrives continuously through the year rather than as one document at the end of it.
Module completion by department, campaign results where one ran that month, and the trend since the previous report.
Full campaign results with click rate, credential submission rate, report rate and department comparison.
Per-employee completion data retained as documented evidence for audits, client assessments and regulator enquiries.
Issued on completion and verifiable through our certificate verification page.
A full-year account of the movement, what drove it, and the recommended focus for the following cycle.
Course outlines, trainer profiles and attendance records in the format the eTRiS submission requires, where the claimable structure applies.
It suits organisations that know annual training is not enough but do not have anyone internally with the time to run something better.
Any sector where staff handle personal or financial data, and particularly those facing regular client security assessments.
The programme works from around fifty staff upward. Below that, a single workshop plus an annual simulation is usually the more sensible spend, and we will say so.
The programme covers the whole workforce. These functions get the closest attention because a mistake there costs the most.
The hard part of an awareness programme is not month one. It is still being credible and still being read in month nine.
We treat awareness as a governance obligation rather than a training purchase. Reporting is built to drop into an audit evidence pack and a management review, which is where it has to land for the programme to be worth anything beyond the learning itself.
Content is sized to what your staff will actually finish. We would rather deliver a module people complete in ten minutes than a forty-minute course with a thirty percent completion rate, and we will tell you when the honest answer is a process fix rather than more training.
Our consultants have run compliance, data protection and security functions inside Malaysian organisations, not only advised on them from outside. That shows up in the advice: we know what a lean IT team can absorb in a quarter, and we know which recommendations get quietly shelved.
Scenarios use Malaysian references your staff will recognise, from DuitNow payment requests and e-invoice notices to LHDN and EPF correspondence. Reporting is framed against the obligations your regulators and auditors actually cite, including the 72-hour personal data breach notification duty introduced by the 2024 amendments to the PDPA.
Orbix is an HRD Corp registered training provider, so the training component can be structured as a claimable programme under SBL-Khas for levy-contributing employers, subject to grant approval before each delivery. See HRD Corp claimable cybersecurity training.
Tell us your headcount, your industry and what triggered the interest, whether that is an audit finding, a near miss, a board question or a regulator letter. We will come back with scope, timeline and a fixed quotation. No obligation, and we will say so if you do not need us yet.
