Walk into a 3D lesson.Watch a learner go through the bar scenario, step by step.- Industries
- Financial services
Financial services security awareness training, for every request that moves money.
In a bank or an insurer, one released payment or one disclosed code can cost more than years of training. Cyberfrog trains client-facing staff, payments, IT and the board with simulations of the requests that really arrive, and keeps the records DORA asks for and your auditors check.
- BEC, deepfake and vishing simulations
- Training for the management body
- Leaked staff logins found early
- DORA, NIS2 and PCI DSS mapping
I am with the lawyers and cannot take calls. The escrow payment for the acquisition has to leave before the 15:00 cut-off or the deal is delayed. The instruction is attached. Please keep this between us until the announcement and confirm once it is released.
Open payment instruction- Domain ends in .co instead of the group's own .com
- Asks for secrecy and skips the four-eyes approval
- Hard cut-off and a sender who cannot be called back
Where the money gets diverted.
Financial firms are trusted to move money quickly and to keep client data secret. Attackers exploit both: they impersonate executives, clients and suppliers, and they go after the people who can approve, release or reset.
- Phishing and stolen logins
In finance and insurance, phishing accounts for 20% and credential abuse for 15% of initial access, and the human element is involved in 65% of breaches. Verizon DBIR 2026
- Business email compromise
Losses from business email compromise reported to the FBI reached USD 3,046,598,558 in 2025. FBI IC3 Report 2025
- Deepfakes against identity checks
FinCEN has seen more suspicious-activity reports describing deepfake media used to get past identity verification. FinCEN Alert FIN-2024-Alert004
- Data theft and ransomware in EU finance
In the EU finance sector, data breaches made up 64% of cybercrime incidents and ransomware 36%. Banks were the subsector hacktivists targeted most. ENISA Threat Landscape 2025
Training per desk, from the counter to the board.
A relationship manager taking client calls, a clerk releasing transfers and a board member answering for ICT risk under DORA face different attacks. Each group gets its own path.
- Client-facing and branch staff
Callers posing as clients or their relatives, requests to change contact details, and pressure to skip identity checks.
- Payments, treasury and operations
Changed beneficiary details, urgent releases before cut-off and fake executive instructions, practised with the Verify before you pay course.
- IT, service desk and security
Password and MFA reset requests by phone, fake vendor alerts and remote-support tools, plus a report button that sends real threats to your SOC.
- Management body and board
Deepfake calls from a familiar face and the regular ICT-risk training DORA expects of management, with a leadership briefing in the regulated programme.
Rehearse the request before it is real.
Each simulation copies a pattern financial staff really meet. A mistake opens a short lesson on that exact trick; a report earns recognition and a harder scenario next time.
- EmailThe confidential escrow release
A CFO look-alike asks treasury to send funds before the cut-off and keep it quiet.
- VoiceThe client who is not the client
An AI caller, in the client's own language, asks an adviser to raise a limit and confirm a code.
- DeepfakeThe CEO on a video link
A lip-synced video of your own executive, made with recorded consent, asks for an exception to payment approval.
- MFAPush prompts at midnight
Repeated sign-in prompts, then a message from the 'service desk' asking the employee to approve the next one.
Find the logins that already leaked.
Logins of finance staff are worth more to criminals than most, and they leak through breaches of private accounts and infostealer malware on home devices. Cyberfrog checks your domains against Darknetsearch's breach and stealer-log data and ranks people by exposure, role and visibility, the way an attacker would.
Treasury, payments and executives with a leaked password move to the top of the list. They get a personal notice and a lesson on how their record leaked, and can receive a simulation built on that exact exposure. Passwords are shown only as much as your privacy settings allow.
What regulators expect of financial firms.
Banks and insurers answer to DORA in the EU, FINMA in Switzerland and federal and state rules in the US. Cyberfrog maps the programme to the frameworks it supports and keeps records per person for the rest.
| Rule | What it asks for | How Cyberfrog helps |
|---|---|---|
| DORA, Regulation (EU) 2022/2554, Art. 5(4) and 13(6)Mapped in Cyberfrog | ICT security awareness programmes and digital operational resilience training for all employees and senior management; management body members keep their ICT-risk knowledge current through regular training. | Programme mapped to DORA, with a leadership briefing, staff paths and completion records per person. |
| FINMA Circular 2023/1, Operational risks and resilience - banks | Measures to raise employee awareness of ICT, cyber and critical-data risks, and regular training for people with access to critical data. | Cyber and data-handling topics, an extra path for staff with critical-data access, and exportable records. |
| NIS2 Directive, Annex I (banking, financial market infrastructures)Mapped in Cyberfrog | Banks and market infrastructures are in scope, while DORA applies as the sector-specific law for ICT risk. | NIS2 mapping and management lessons where NIS2 applies alongside DORA. |
| PCI DSS v4.0.1, Req. 12.6Mapped in Cyberfrog | A formal awareness programme for card-data environments, with training at least every 12 months that covers phishing and social engineering. | Programme mapped to PCI DSS, with phishing simulations and dated completion records. |
| NYDFS 23 NYCRR 500.14(a)(3) | Cybersecurity awareness training, including social engineering, for all personnel at least once a year. | An annual programme with email, voice and SMS social-engineering simulations and records per person. |
| GLBA Safeguards Rule, 16 CFR 314.4(e) | Security awareness training for personnel, updated to reflect the risks found in the risk assessment. | Adaptive campaigns that change content as risk changes, with records per person. |
Summaries for orientation, not legal advice. Cyberfrog provides training records and coverage reports; it does not certify compliance.
Questions from banks, insurers and fintechs.
What are the DORA training requirements for staff?
DORA Art. 13(6) makes ICT security awareness programmes and digital operational resilience training compulsory for all employees and senior management. It has applied since 17 January 2025 and sets no fixed format, so most firms combine an annual programme with simulations and keep records per person.
Does DORA require training for the board?
Yes. Under Art. 5(4), members of the management body must keep their knowledge and skills on ICT risk up to date, including through regular training. Cyberfrog's regulated programme adds a leadership briefing and management lessons, with a record for each board member.
Does FINMA require security awareness training?
FINMA Circular 2023/1, in force since 1 January 2024, expects banks to raise employee awareness of ICT, cyber and critical-data risks and to train people with access to critical data regularly. Cyberfrog provides the lessons, simulations and records; whether they meet the circular is part of your own assessment.
What are the NYDFS training requirements?
23 NYCRR 500.14(a)(3) requires cybersecurity awareness training for all personnel at least once a year, and the training must include social engineering. Phishing, vishing and smishing simulations show whether it works in practice.
Why test phone calls and texts, not only email?
Because staff fall for them more often. The Verizon 2026 DBIR found that the median click rate in simulations using voice and text was 40% higher than for email. Cyberfrog's AI caller holds a real conversation in 28 languages and scores the transcript.
Related industries.
- IndustrySaaS
Phone calls that get staff to approve a malicious connected app, stolen OAuth tokens and fake job applicants.
Read more - IndustryMSPs and MSSPs
Attackers go after the provider to reach every client behind it, from the outsourced help desk to the remote-management tools.
Read more - IndustryLegal
Fake IT-support callers, diverted client payments and ransomware aimed at the confidential files every firm holds.
Read more
Test the next transfer request before an attacker does.
In a 30-minute demo we show the payment, vishing and deepfake simulations for financial teams, on your own domain.