CYBSAFE LTD

CybSafe PHISH

Phishing & social engineering resilience software that reduces susceptibility through realistic simulations, in the moment coaching, and continuous improvement. CybSafe PHISH measures risky responses, identifies high risk patterns, and triggers targeted interventions to improve reporting and safe decision making. Demonstrate measurable reduction in phishing-related risk.

Features

• Security awareness training content library
• Personalised learning journeys by risk and role
• Adaptive microlearning and reinforcement nudges
• Behaviour goals and action planning
• Contextual guidance for everyday security decisions
• On demand security advice and support
• Content customisation to match organisational policies
• Knowledge checks and comprehension tracking
• LMS and LXP integration options
• Learning campaigns and engagement management

Benefits

• Transform awareness into lasting behaviour change with less effort
• Increase awareness, engagement, and behaviour change using analytics
• Deliver the right guidance at the right time
• Boost engagement while proving compliance more effectively
• Improve security behaviours with behavioural science and psychology
• Increase executive engagement and senior stakeholder buy in
• Drive higher user engagement through personalised training support
• Link training content to real world risk outcomes
• Scale security awareness with targeted, evidence based guidance
• Reduce effort while increasing program visibility and confidence

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at commercial@cybsafe.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

427166231907040

Contact

Commercial Team
02039 096913
commercial@cybsafe.com

About your service

• Service categories:

  Systems Infrastructure Software

  Security

  • Security analytics
  • Governance, risk and compliance

  Data security

  • Information protection
  • Digital trust
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: CybSafe Human Risk Management Platform
• Cloud deployment model: Public cloud
• Service constraints: CybSafe has no known service constraints.
• System requirements:
  • Internet Access
  • Supported Browser: Microsoft Edge, Google Chrome, Mozilla Firefox, Apple Safari

User support

• Email or online ticketing support: Yes
• Support response times: We aim to acknowledge all queries within 4 business hours
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: N/A
• Onsite support: No
• Support levels: 1. Fatal - 4 Normal Business Hours. ; 2. Severe - 12 Normal Business Hours. ; 3. Medium - 24 Normal Business Hours. ; 4. Minor - 24 Normal Business Hours
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: We understand that every organisation is different, and that the process to achieve maximum user engagement will vary between organisations. The following process represents the typical process clients go through prior to deployment. However, we encourage you to liaise with our Sales Engineering and Customer Success Team leading up to your deployment to ensure it’s right for you. Planning session takes place with a Sales Engineer to scope technical requirements (such as single sign-on or an active directory integration) and plan any customised learning content. One-to-one training is provided to all administrators as part of the on-boarding process. This allows familiarisation with the platform, features, reporting and analytics. Configuration requirements are confirmed and guidance is also provided on how to roll out the campaign to obtain maximum user engagement. Client administrators assess training content and add contextual annotations and links to organisational policies.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: We design the product using privacy by design and default principles. Prior to the expiration of the term, customers are able to go into the platform and download their data in easy to read formats.
• End-of-contract process: Prior to the end of the contract, Customers are able to download their data. This is included in the cost. Additional access after the term ends, or specifically technical or complex data extraction requests, may incur additional charges.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: None
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: CybSafe provides a documented REST API that allows customers to securely access and exchange data with the platform. Customers with the API add‑on can authenticate using an access token and call read endpoints to retrieve user data, training information, phishing simulation results, and behaviour and culture survey metrics for use in data warehouses, and BI tools such as Power BI. https://api.cybsafe.com/v1/docs/; In addition to read access, selected write endpoints allow customers to create behaviour events and related actions from external systems. This enables organisations to bring additional telemetry into CybSafe, enriching behaviour and risk analytics with signals from tools such as email security, custom phishing platforms, or in‑house applications.; Most administrative setup and configuration (for example user provisioning manual and via SCIM, SSO, campaign configuration and content management) is performed via the CybSafe UI and standard integrations rather than via the public API. The public API is therefore not a full administrative interface. It is intentionally focused on secure data access, selected data ingestion, and integration into broader reporting and analytics workflows, subject to documented rate limits and authentication controls.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Customer Admin-level customisation options within the CybSafe platform currently allow Administrators to:; Use their own company logo as the primary logo on the platform.; Add a secondary logo to the platform (I.e. in instances where partners might want their own logo and the logo of the end customer on the platform.; Add their company logo to the CybSafe User Certificates.; Annotations - All content within the CybSafe platform can be annotated by customer administrators using our annotations tool. This powerful mechanism allows administrators to add in their own organisational examples to add context for users. It's versatile, allowing annotations to be set to only display to the user groups they are relevant for. It also allows administrators to add links to internal intranet pages, external web pages and extra downloadable content (such as policies and procedures).; More advanced customisation requirements such as bespoke/customised learning modules, languages, bespoke features etc. must first be discussed with a CybSafe sales POC to assess suitability and determine cost.

Scaling

• Independence of resources: CybSafe utilises dynamically scaling cloud platform technologies to provision extra resource is provisioned when capacity reaches a defined limit or is expected to experience an increase.

Analytics

• Service usage metrics: Yes
• Metrics types: CybSafe provides a unified human risk analytics layer across your workforce. Track human risk scores, behavioural exposure, intervention activity, and measurable behaviour change over time. Monitor adoption, engagement, compliance status, and risk trends by team, role, and location. Export audit ready reporting and executive summaries to evidence progress, prioritise effort, and prove impact.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: CSV exports triggered via the web interface and delivered within the platform.
• Data export formats:
  • CSV
  • Other
• Other data export formats: PDF
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: CybSafe shall use commercially reasonable endeavours to make the Services available 99% 24/7 ; CybSafe will provide at least 3 hours notice for unscheduled maintenance performed during the Core Hours. ; ; The CybSafe platform is covered by the standard service levels that are found within our EULA, and are all included the licence fee.; ; Fatal - 4 Normal Business Hours; Severe - 12 Normal Business Hours; Medium - 24 Normal Business Hours; Minor - 24 Normal Business Hours; ; We do not offer any service credits or refunds.
• Approach to resilience: CybSafe have a resilient modern cloud architecture, utilising principles from site reliability engineering. Further details available on request
• Outage reporting: A public dashboard, and if required email alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: "P&P 602 (Access Control) 4.2 covers the controls in our Cloud Based Server (G-Suite) that limits access to customer data on a need-to-know basis. The movement of data, particularly data in privileged access areas, is tracked and logged. If attempts are made to copy this to personal devices or removable media - admin is notified by the system.; ; Approval is granted by the CTO, by rule of least privilege. For Platform Access CybSafe do not grant remote access unless for authorised staff.; By adhering to NCSC: Cloud Security guidelines, CybSafe only grants access to trusted users."
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: CybSafe’s information security management is captured over a number of policy and procedure (P&P) documents. ; These include:; - CYBSAFE-P&P-308-Risk Management Policy. - CYBSAFE-P&P-311- ISMS Policy; - CYBSAFE-P&P-409-Physical Access & Security Policy; - CYBSAFE-P&P-508-Asset Management Policy; - CYBSAFE-P&P-602-Access Control; - CYBSAFE-P&P-603-Data Protection Policy; - CYBSAFE-P&P-605-Passphrase Policy; - CYBSAFE-P&P-607-Acceptable Usage Policy; - CYBSAFE-P&P-609-Breach Notification & Response; - CYBSAFE-P&P-701-Platform Disaster Recovery Policy; - CYBSAFE-P&P-702-Software Development Life Cycle; - CYBSAFE-P&P-704-Data Retention Policy; - CYBSAFE-P&P-705-Operational Security & Resilience policy; ; CybSafe has a library of Policy & Procedure (P&P) documents that are available on the company Notion page. Employees are bound by a number of information security-related clauses in their contracts of employment. ; The Information Security Steering Committee comprises the General Counsel and Head of Infrastructure who manage ISO. Members of the Management Team, as well as external advisors, are invited onto the steering committee (as required) to ensure that policies and guidance are fully informed.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: P&P 301 (Policy) covers overall change management including review frequency. How to initiate; how to test/review; how to approve, how to publish and how to log. Changes are logged in a change matrix at the top of each P&P. Each change also has an approver who is part of the management team. Both the change author and change approver’s name are on each document. Frequency of reviews are based on the category of the P&P. Relating to question 2.0, categories 600 ‘IT & Information Security’ and 700 ‘Development’ are reviewed every 12 months. CybSafe employs continuous threat detection systems
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: CybSafe operates a SOC on it's own infrastructure; compliance is monitored via a suite of automated reporting tools and configured checks. In some cases, CybSafe subcontracts the use of PaaS (Platform as a Service) as part of it's cloud providers, a service which includes security compliance monitoring. The use of SubContractors remain the responsibility of the CTO & DevOps team to ensure necessary security obligations are met. CYBSAFE-P&P-705-Operational Security & Resilience, Vulnerability Response Criteria details prioritisation, and execution of detected events. CYBSAFE-P&P-609-Breach Notification & Response details the policy with respect to Stakeholder communication
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: CybSafe operates a SOC on it's own infrastructure; compliance is monitored via a suite of automated reporting tools and configured checks. In some cases, CybSafe subcontracts the use of PaaS (Platform as a Service) as part of it's cloud providers, a service which includes security compliance monitoring. The use of SubContractors remain the responsibility of the CTO & DevOps team to ensure necessary security obligations are met. CYBSAFE-P&P-705-Operational Security & Resilience, Vulnerability Response Criteria details prioritisation, and execution of detected events. CYBSAFE-P&P-609-Breach Notification & Response details the policy with respect to Stakeholder communication
• Incident management type: Supplier-defined controls
• Incident management approach: In accordance with P&P 609 (Breach Notification & Response), section 4, the predetermined Incident Response Team (IRT) comprises the CEO, GC, CTO, DPO, VPM. External Legal Counsel and PR company are added to the IRT as necessary. Readiness simulations are conducted annually. Policy CYBSAFE-P&P-701-Platform Disaster Recovery Policy and CYBSAFE-P&P-705-Operational Security & Resilience policy detail our robust efforts to investigate and recover from disaster/incidents. We perform a rigorous assessment of post-incident review through a comprehensive retrospective process ensuring that we put in place some proactive processes in addition to reactive processes.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: We offer a free two week proof of value trial, giving you hands on access to CybSafe and measurable outcomes to support an informed purchase decision.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Monday 1 December 2025
• What the ISO/IEC 27001 doesn’t cover: 1. Supporting utilities; 2. Cabling security, ; 3. Redundancy of information processing facilities,; 4. Outsourced development - all N/A for CybSafe. ; ; We develop our SaaS product inhouse.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 38fb253b-da36-41c0-b87b-06e916b449d3
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 2606b80e-3cb0-47f5-b32d-6fb40c5b920c
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Volunteering opportunities for staff

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Working conditions which promote an inclusive working environment and promote retention and progression

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at commercial@cybsafe.com. Tell them what format you need. It will help if you say what assistive technology you use.