PassHRM — your people are the attack surface you can actually improve
A Learning Platform and Phishing Simulation module, tied to a measurable human-risk score. Turn security awareness from a compliance checkbox into a metric your security team can manage.
PassHRM is Passeca's human-risk management platform. It combines a Learning Platform — courses, localisation, micro-learning and policy management — with Phishing Simulation, and ties both to a measurable human-risk score. The score turns security awareness from an activity into an outcome a security team can manage and report.
The human risk score
Baseline measure improve.
Establish the starting point
An initial, no-notice phishing simulation measures how many people click, how many report, and how many enter credentials. That is your baseline human-risk score.
Track behaviour over time
Subsequent simulations and course completion feed the score continuously, so you see whether real behaviour is changing — not just whether training was assigned.
Show the reduction
Trend the score down over quarters and report it to leadership in the same language used for technical controls — a measurable reduction in human risk, with evidence.
The Learning Platform
Course library, localisation, micro-learning, and policy management with sign-off.
The Learning Platform delivers the awareness curriculum. A course library covers the topics that matter — phishing, passwords, data handling, removable media, social engineering, incident reporting — with localisation so content reaches every employee in their working language. Micro-learning modules fit into a few minutes, which is how adult learners actually consume security content.
Policy management closes the evidence gap. You publish a policy, assign it, and track sign-off — so you can prove to an auditor exactly who read and accepted which policy, and when. These records can provide supporting evidence for relevant awareness and training requirements.
Phishing Simulation
Templates, a difficulty ramp, and real-time coaching at the moment of click.
The Phishing Simulation module tests whether the learning stuck. A library of templates covers the lures in current circulation — from obvious spam to sophisticated spear-phishing and brand-impersonation. A configurable difficulty ramp lets you start gentle and escalate, so the programme challenges users without overwhelming them on day one.
The decisive feature is real-time coaching. When a user clicks a simulation, they are educated immediately — in the moment the mistake is fresh — rather than receiving a generic reminder weeks later. That immediacy is what changes behaviour.
Which regulations require security awareness training?
ISO/IEC 27001:2022
Annex A 6.3Requires information security awareness, education and training, making a managed awareness programme a direct control requirement for any certified ISMS.
GDPR
Art. 39Sets out the Data Protection Officer's tasks, including awareness-raising and training of staff involved in processing operations. It does not impose a universal training-programme requirement on every organisation.
HIPAA
§164.308(a)(5)The Security Rule mandates a security awareness and training program for all workforce members, including management, as an administrative safeguard.
PCI DSS
Req. 12.6Requires a formal security awareness program to ensure personnel are trained on cardholder-data security upon hire and at least annually.
NIS2
Art. 21(2)(g)Lists basic cyber hygiene practices and cybersecurity training among the mandatory risk-management measures for EU essential and important entities.
DORA
Art. 13(6)Requires financial entities to include ICT security awareness programmes and digital operational resilience training in their staff training schemes.
PassHRM is built to produce the evidence each of these clauses requires — completion records, policy sign-off, and simulation results — captured automatically rather than reconstructed at audit time.
How PassHRM fits the Passeca stack
Reported phishing flows into the same incident workflow as technical detections.
When an employee reports a real phishing email — the behaviour the simulation is designed to build — that report flows into PassIRP alongside technical detections. PassAI-Guard can then triage and enrich it like any other alert, so human-reported threats are not stranded in a separate mailbox.
How much does PassHRM cost?
Per-seat pricing — start with a free baseline phishing test.
PassHRM is priced per seat, covering both the Learning Platform and Phishing Simulation modules. Per-seat pricing — contact us for a quote.
The lowest-risk way to start is a free baseline phishing test: Passeca runs a no-notice simulation against your organisation and reports the click and report rates that form your starting human-risk score. There is no obligation to buy.
PassHRM, answered
The questions security and compliance leaders ask before launching a human-risk programme.
What is PassHRM?
Why 'human risk' and not 'security awareness training'?
How is the human risk score calculated?
What does the Learning Platform module include?
What does the Phishing Simulation module include?
Which regulations require security awareness training?
How is PassHRM priced?
Can I start with a phishing test before buying?
Start with a free baseline phishing test
Passeca runs a no-notice phishing simulation against your organisation and reports your starting human-risk score — click rates, report rates, and credential entry. No obligation to buy.
Related