Cybersecurity awareness training · Nonprofits and small organizations

Your team is the target.
Let’s make them the defence.

A 12-month, live, human-led cybersecurity awareness program for nonprofits and small organizations. Built around your policies and the scams your staff actually see, with the attendance, knowledge-check and completion records your board, auditor and insurer ask for. We run the whole program. You keep the records.

✓ One fixed fee for the whole team

✓ No per-seat licences, no minimums

✓ Five live sessions across the year

✓ Nothing for your staff to administer

✓ Evidence pack for audits and insurance

✓ Records hosted in Canada

Book a 30-minute fit call See the 12-month program

Delivered live online, in English, by a RapidIteration specialist. First designed for HelpAge Canada.

Your year at a glance

One program. Five live sessions. Everyone covered.

Month 1
Kickoff and awareness plan. Baseline questionnaire, your policies and reporting contacts, a written plan.
Month 2
Initial training and practical workshop. 90 minutes of live training, then 60 minutes of hands-on practice.
Months 5, 8, 11
Quarterly refreshers. 45 minutes each, built on the gaps the knowledge checks revealed.
All year
Reinforcement. Six awareness messages, a quick-reference guide and an onboarding checklist for new staff.
Month 12
Final program report. Attendance, results, outstanding follow-ups and next year's awareness calendar.

About five hours per person over the year. No modules to chase.

The weakest link is not your firewall

Most incidents at small organizations start with a message that someone trusted. Most Canadian charities have never trained their team to recognize one.

18%

of Canadian charities require regular cybersecurity training for staff.

CanadaHelps Digital Skills Survey, 2024 report

6 in 10

data breaches involve a human element such as phishing, a stolen password or a mistake.

Verizon Data Breach Investigations Report, 2025

100%

of wire-fraud cases in a 2024 sample of 200 nonprofits began with a compromised staff account.

Community IT Nonprofit Cybersecurity Incident Report, 2025

Why organizations call us

Usually it is one of these. Sometimes it is all of them at once.

An audit or board review asked for staff awareness training, and someone has to own the management response.

The cyber-insurance renewal wants proof that everyone was trained in the last 12 months.

Someone nearly paid a changed invoice, bought gift cards for “the director” or clicked a link they should not have.

New staff and volunteers joined, and nobody has ever walked them through what to watch for.

There is a training platform licence somewhere that most of the team never finished.

This program was built for exactly that moment.

It was first designed as a nonprofit's management response to an audit finding: a written awareness plan, live training for the full team, quarterly reinforcement, and records that show it happened. One fixed fee covers all of it.

Talk to us about your situation

How the 12 months work

Live, online, in your meeting platform. We set the dates with you at kickoff and handle everything in between.

Step 1

Kickoff and plan

A 60-minute kickoff, a baseline questionnaire and a written awareness plan covering curriculum, dates, responsibilities and tracking. One revision round with your feedback.

Step 2

Initial training

A 90-minute interactive session for the full team: phishing by email, text and QR code, fake login pages, strong passwords and password managers, safe MFA use, protecting sensitive information, and how to report.

Step 3

Practical workshop

A 60-minute session using realistic nonprofit scenarios: changed banking details, donor-list requests, grant notices, gift-card asks and unexpected MFA prompts. Staff practise checking and reporting through your own process.

Step 4

Quarterly refreshers

Three 45-minute sessions at months 3, 6 and 9 after the initial training. Fresh examples, emerging threats and whatever the knowledge checks showed people still find hard.

Step 5

Reinforcement and report

Six short awareness messages through the year, a quick-reference guide, an onboarding checklist for new hires, and a final report with results, priorities and next year's calendar.

Everything included, nothing to administer

You appoint one coordinator and share your team roster. We do the rest.

Written awareness plan

Objectives, curriculum, dates, responsibilities, reporting contacts and tracking. The document your auditor asked for.

Five live sessions

Initial training, practical workshop and three refreshers, all delivered live by a specialist, not a video library.

Tailored to you

Examples built around your policies, your tools and your staff's responsibilities. Finance, leadership and front-line staff see what targets them.

Knowledge checks

A baseline check before training and a post-training check with an 80% target. Anyone below it gets materials and another attempt.

Completion tracker

Session dates, attendance, knowledge-check results and follow-ups, kept current all year and shared with your coordinator.

Materials for everyone

A staff quick-reference guide, an onboarding and refresher checklist, and catch-up materials for anyone who misses a session or joins mid-year.

Six awareness messages

Short, ready-to-send reminders across the year so the training does not fade between sessions.

Final program report

Attendance, aggregate results, refresher records, outstanding follow-ups and a recommended awareness calendar for the following year.

Designed around what actually changes behaviour

Recent studies of annual video modules and automated phishing tests found they barely move the needle. We built the program around what the research says does work.

Live and interactive

Completed interactive training is associated with fewer failures. Repeated static modules are not. Every session in this program is live, with questions and practice.

Quarterly, not annual

Awareness gains fade within about six months. Three refreshers and six messages keep the year covered, in line with the quarterly cadence most Canadian organizations now use.

Scenarios your staff recognize

Failure rates vary enormously by lure. We use the ones aimed at nonprofits: grant approvals, donor lists, changed invoices, gift-card requests and HR notices.

Process, not just awareness

Training alone does not stop wire fraud. The plan includes a payment-change verification rule and a clear reporting path, so people know what to do, not just what to fear.

Sources: Ho et al., IEEE Symposium on Security and Privacy 2025 (randomized trial, 19,500 staff); Reinheimer et al., SOUPS 2020; CIRA Cybersecurity Survey 2025; Community IT Nonprofit Cybersecurity Incident Report 2025.

How this compares to your other options

Platforms are cheaper per seat and the right choice for some organizations. If that is you, we will say so on the call.

	Self-serve platform	One-off workshop	RapidIteration program
Who runs it	Someone on your staff: enrolments, campaigns, reminders, reports	The trainer, for one day	We do, for 12 months, including chasing completion
Delivery	Video modules and automated phishing emails	One live session	Five live sessions plus reinforcement all year
Tailored to your organization	Generic library	Sometimes	Built around your policies, reporting path and real nonprofit scenarios
Whole team, including volunteers and board	Per-seat licences, often 25 to 100 seat minimums	Whoever is free that day	Everyone, with catch-up materials for absentees and new hires
Evidence for board, auditor, insurer	Completion dashboard, if someone exports it	An attendance list	Written plan, tracker, knowledge checks and final report
Typical cost, 30 staff	About $1,000 to $2,000 a year, plus staff time to run it	About $2,000 to $3,000 per session	$6,000 fixed for the year, any team size

Platform and workshop figures are published Canadian and US list prices as of October 2026 and vary by vendor and contract term.

One fixed fee. No seat counting.

Prices in Canadian dollars, before applicable taxes. Half on signing, half when the program is complete.

Kickstart

For an insurance renewal, a first-ever training, or a team that needs the essentials now.

$2,500 one time

✓ 60-minute kickoff and roster review
✓ One 90-minute live training for the full team
✓ Post-training knowledge check
✓ Staff quick-reference guide
✓ Attendance and completion record

Upgrade to the full program within 90 days and the Kickstart fee is credited.

Ask about Kickstart

Recommended

12-Month Program

The full program described above, for your whole team.

$6,000 per year

Works out to $200 per person for a team of 30, and less as your team grows.

✓ Kickoff and written awareness plan
✓ Initial training and practical workshop
✓ Three quarterly refreshers
✓ Six awareness messages, guide and onboarding checklist
✓ Baseline and post-training knowledge checks
✓ Completion tracker and final program report
✓ Catch-up materials for absentees and new hires

Start the program

Add-ons

For organizations with specific requirements from an insurer, funder or board.

Quoted per organization

✓ A 30-minute board and leadership briefing
✓ Quarterly simulated phishing campaigns with reporting
✓ Finance and leadership track for payment fraud and executive impersonation
✓ Policy starter pack: acceptable use, passwords and MFA, incident reporting
✓ Recorded onboarding module for mid-year hires
✓ French-language delivery
✓ In-person sessions in the Lower Mainland

Discuss add-ons

The fee does not change with the size of your team or the hours we spend. Scope changes are agreed in writing before any extra work begins.

The records you will be asked for, ready when you are asked

Every deliverable is written so it can be handed to a board, an auditor, a funder or an insurer without rework.

✓ Maps to the Canadian Centre for Cyber Security baseline control on employee awareness and the CyberSecure Canada training control

✓ Covers the staff-training expectation in PIPEDA's accountability principle

✓ Answers the “all staff trained in the last 12 months” question on cyber-insurance applications

✓ Dated attendance, scores and content versions for each session

Hosted in Canada

Training materials and participant records we host stay in Canada. Secure handover or deletion at the end of the program.

No fear tactics

No surprise tests that shame staff. People learn faster when they are shown what to do and trusted to do it.

Your materials to keep

You may use every guide, checklist and slide internally after the program ends.

Clear boundaries

This is awareness training. Technical assessments, system changes and incident response are separate work, and we will tell you when you need them.

We already work with organizations like yours

This program was first designed for HelpAge Canada. We helped build and support Healthy Aging CORE with United Way British Columbia and have worked with Men's Sheds Canada. Our founder, Jamshid Hashimi, has run CodeWeekend, a nonprofit education initiative, for more than a decade. We are based in Vancouver and serve organizations across Canada.

Frequently asked questions

Do you run simulated phishing emails?

Every session includes hands-on practice spotting real-looking messages, and we are candid that large studies show automated phishing tests on their own change little. If your insurer or board requires simulated campaigns, we add quarterly campaigns with reporting as an add-on.

How much of our staff's time does it take?

About five hours per person across the year: the 90-minute training, the 60-minute workshop and three 45-minute refreshers, plus a few minutes for each knowledge check. Your coordinator spends roughly an hour a quarter with us.

What about volunteers, board members and part-time staff?

They are welcome in every session at no extra cost. The fee covers your whole organization, not a seat count. A separate 30-minute briefing for the board and leadership is available as an add-on.

What if someone misses a session or joins mid-year?

They receive the session materials and knowledge check, and new hires get the onboarding checklist and quick-reference guide. The tracker shows who still needs to complete what, and we follow up with your coordinator.

Will this satisfy our insurer, auditor or funder?

Requirements vary, so send us the wording and we will tell you plainly whether the program meets it before you sign. The written plan, dated attendance, knowledge-check results and final report are designed to be the evidence most of them ask for.

Do we have to be in British Columbia?

No. Sessions are delivered live online in your own meeting platform, so we work with organizations anywhere in Canada. In-person delivery in the Lower Mainland is available as an add-on.

Get started

One year. A team that knows what to do.

Start with a 30-minute fit call: tell us what prompted this, and we will tell you honestly whether the program is the right answer.

✓ Live, human-led training for your whole team

✓ One fixed fee, half on signing, half at completion

✓ Records ready for your board, auditor and insurer