Compromised identity
Separate the person’s trustworthiness from the safety of a specific account, message or action.
SOCIAL ENGINEERING TRAINING
Practise the moment when the attacker looks trustworthy.
CoMaSy focuses on the decision pressure behind social engineering: urgency, authority, familiarity and requests that cut off independent verification. Employees rehearse what to do when the message, caller or account looks legitimate.
THE DECISION GAP
The difficult question is not ‘who is malicious?’ It is ‘what makes this action safe?’
A trusted colleague can have a compromised account. A supplier can be impersonated. A voice can sound familiar. CoMaSy trains evidence-first verification instead of teaching employees to distrust every unusual request.
Independent verification
Practise leaving the requester’s channel and checking through a known contact path, process or system.
Proportionate response
Choose containment or escalation without turning every uncertain request into unnecessary business disruption.
MEASUREMENT
A stronger outcome is a repeatable verification habit.
The CoMaSy measurement model looks for observable choices such as pausing, verifying independently and avoiding premature high-risk action.
Read the methodology →BUYER QUESTIONS
What to know before you pilot it.
Is this only about phishing emails?
No. The intended scope includes broader business workflows such as executive requests, supplier fraud, payment changes, account takeover and voice-based impersonation.
What is the H.A.C.K. framework?
H.A.C.K. groups pressure into Hurry, Authority, Comfort and Kill-Switch — the point where a requester pushes a consequential action while verification is being cut off.
Can CoMaSy simulate a real department workflow?
A pilot can be configured around selected workflows and risk themes. Broad custom-platform functionality is intentionally not a prerequisite for the first pilot.
What happens after the exercise?
Participants receive decision feedback and the organisation reviews defined cohort signals to decide whether further practice or scale is justified.
DEFINED COHORT. DEFINED METRICS. DEFINED DECISION POINT.