Getting started with Security Awareness Training

Moraph resells, implements and runs KnowBe4 as a managed service for banks, credit unions, broker-dealers and other financial firms. We plan simulated phishing campaigns around the fraud your staff actually see, such as fake wire transfer requests, payment change requests and executive impersonation, and assign training to the people who need it. Your security and compliance leads approve the program, and you get the evidence examiners and cyber insurers ask about.

What it is for

Financial institutions are required to train staff on information security, and the people most often targeted by fraud are the ones who move money: wire rooms, tellers, payment operations and executive assistants. Many training programs run generic annual courses and occasional off-the-shelf phishing tests that look nothing like a business email compromise aimed at a bank. The platform is bought, but nobody has time to plan campaigns, follow up with repeat clickers or turn results into evidence for examiners, auditors and insurance applications.

• Simulations are generic and do not reflect the payment fraud staff actually face
• Training is a once-a-year course rather than a response to what people do
• Nobody owns the program day to day, so campaigns lapse
• Evidence for examiners, auditors and cyber insurance applications is assembled by hand

Who uses it

• Chief information security officers and information security officers at banks, credit unions and financial firms
• Compliance and risk leaders who answer for training under GLBA and state cybersecurity rules
• Operations leaders responsible for wire, ACH and payment teams
• HR and learning teams who manage required training
• Internal audit and examiners, who need evidence that training and testing happen

Before you start

• Your organization uses Security Awareness Training as a managed platform from Moraph, under an agreement that covers it.
• Licences for KnowBe4, bought through Moraph or under your own agreement with the vendor.
• A Moraph account in your organization for each person who works with Moraph on the service.
• Named technical and security contacts, recorded in the Moraph Portal.

Steps to get started

1. Agree the scope of the managed service for Security Awareness Training with Moraph, including which environments and teams it covers.

2. Name your administrators, technical contact and security contact in the Moraph Portal under People and access.

3. Review the configuration baseline Moraph proposes for your regulations, and record any changes you need.

4. Confirm how users will sign in, through your identity provider where the platform supports it.

5. Agree the pilot group and the cut-over plan with your Moraph delivery lead.

Where to go next

• Onboard Security Awareness Training
• Everyday tasks
• Connect your systems
• Security, data and compliance
• Troubleshooting and the support guide
• Product overview on moraph.com