secctl · security in control · for 25 to 1,000 employees

Your staff trained, your risks in view, the evidence as PDF or Excel

Two products, on their own or together. Awareness trains every employee automatically at their own level, as evidence for NIS2 and ISO 27001. RiskCompass keeps your risk register and enforces your policy.

Awareness from €83 a month (up to 25 employees), RiskCompass from €99 a month. 15% off together.

Try it free for 30 daysNo payment details. It stops by itself if you don’t choose to continue.
See how it worksFour screens, no account needed.
Awareness administrator dashboard: 179 employees, 3 active campaigns, 893 completed trainings, an organisation Human Risk Score of 42.5, the employees at elevated risk and the phishing risk per person.

If your environment isn’t ready within one working day, your first paid month is free.

Two products and an assessment. You start with one.

IB Information security

Awareness

Available

After a baseline test, the auto-trainer assigns every employee the trainings they are missing, at their own level. You see the Human Risk Score per person and department.

From €83 a month, including 25 employees

RiskCompass

Available

One risk register: assessing in sentences, an owner and a plan per risk, a signal the moment someone falls behind, and a policy that largely writes itself.

From €99 a month per organisation

Awareness and RiskCompass together: 15% off the total.

PT Penetration testing

Active Directory assessment

Service

51 checks on your Windows network, mapped to MITRE ATT&CK: the attack paths ranked by risk and, for each finding, what to do about it. Only with your written permission.

From €2,950 per assessment

After the baseline test, Awareness does the rest

You don’t schedule courses. The auto-trainer measures, assigns and repeats.

  1. Adaptive baseline test in Awareness on ransomware: a level 5 knowledge question with four answers, one of them selected.

    Day 1: everyone takes the baseline test

    A few questions per topic, at rising levels. That is how Awareness learns what someone already knows.

  2. Auto-trainer settings in Awareness: monthly cycle, one training per cycle, a 7-day grace period, reminders 3 and 1 day ahead, a mandatory lesson after failing, and the departments the auto-trainer covers.

    Day 1: the auto-trainer assigns

    One short training per gap, at that employee’s level, with a due date and a reminder.

  3. The "Spotting phishing" training in Awareness: a mock email with five red flags marked, the chosen answer and the explanation of why the email is suspicious.

    Every week: staff train

    Short trainings and exercises with mock phishing emails, with points and streaks.

  4. Human Risk Score per department in Awareness: weighted and average score, highest score and number critical per department; Mechanical Assembly is falling behind.

    Every month: you see the Human Risk Score

    Per person, per department and for the organisation. As PDF or Excel, for your auditor or your board.

Try Awareness free for 30 daysNo payment details. It stops by itself if you don’t choose to continue.
Everything about Awareness

What it costs

Awareness costs €83 a month for 25 employees, then per extra employee. RiskCompass costs from €99 a month per organisation; 15% off together. Cancel any month, excluding VAT.

Worked examples for Awareness, excluding VAT
EmployeesPer monthPer year
25€83€830
50€131.75€1,317.50
100€219.25€2,192.50
250€481.75€4,817.50
500€844.25€8,442.50

Pay annually and you pay for 10 months out of 12. Excluding VAT.

Work it out for your headcount

Your risks: one register that enforces your policy

RiskCompass replaces the spreadsheet per risk. You assess impact and likelihood in sentences, so two people weigh the same risk the same way. Whoever is behind sees a signal.

From €99 a month per organisation, unlimited users.

Try RiskCompass free for 30 daysNo payment details. It stops by itself if you don’t choose to continue.
Everything about RiskCompass
Signals in RiskCompass: overdue reassessments, measures past their deadline and risks without an owner, each with the person who has to resolve it.

Frequently asked questions

The questions a board asks first, and the facts you can count on.

Does this make us NIS2 compliant?

Awareness delivers the evidence of staff training, one of the measures the law lists. The NIS2 self-assessment shows in ten questions which other areas still need work.

How do staff practise phishing?

Inside the app, with mock emails and the red-flag exercise. Your mail server and spam filter stay untouched.

Does it work with Microsoft 365?

Yes. Staff sign in to Awareness with their Microsoft account, or with email and password plus a second factor or a passkey. You add them with a CSV file, for example an export from Microsoft 365.

What happens after 30 days?

A week before the end you get an email with what you have built up. On day 30 you choose. If you continue, you get an invoice at the end of each month and can cancel any month, with no cancellation fee. If you don’t choose, the trial environment closes and you pay nothing.

Where is our data stored?

In a separate environment with its own database, in a data centre in the European Union. In the Netherlands only, if you prefer. You can export at any time, including during the trial. You can request the list of providers secctl uses.

Who is behind secctl?

secctl comes from the practice of ISO 27001 projects, ISAE 3000 reports and interim CISO work in Dutch SMEs. Rather talk to someone first? Book a 30-minute call at a time that suits you.

Read the trust centre

Try it with your own team for 30 days

You won't need payment details. Rather talk first? Pick a time that suits you.

Try it free for 30 daysNo payment details. It stops by itself if you don’t choose to continue.
Book a call30 minutes, at a time that suits you.