A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →Security awareness training is the ongoing education that teaches staff to recognize and resist the attacks aimed at them, chiefly phishing and social engineering, and to handle data safely. It is both a genuine risk reduction, because people remain the most targeted path in, and a control that frameworks expect. SOC 2 and ISO 27001 both look for evidence that it happens on a schedule.
The measurable part is phishing simulation. A baseline click rate, training, and a falling rate over time is a far stronger story for an auditor or board than a stack of completion certificates.
Content should fit the audience. Engineers, finance staff, and executives face different attacks, and training that speaks to the threats each group actually sees lands better than one generic module for everyone.
traztech delivers security awareness training for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
Awareness training shows up as a control an auditor checks: did staff complete it, was it recent, and can you prove it. The evidence is completion records and, increasingly, the results of simulated phishing, not a slide deck sitting in a shared drive. We deliver this as security awareness training.
The version that changes behaviour is short, regular, and relevant, not an annual two-hour module everyone clicks through. A phishing simulation that produces a real click rate tells you far more than a completion certificate does.
Both expect it. SOC 2 treats it as part of the control environment and ISO 27001 names it directly, and in each case the auditor wants evidence it happened on a cadence, not just a policy saying it should.
At onboarding and at least annually, with shorter touches in between. Regular simulated phishing alongside the training is what actually moves behaviour and gives you a trend to show.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.