From knowing about security to knowing what to do.
Awareness is where learning starts. Competence is where security improves. People need to recognise what is happening, understand why it matters, make appropriate decisions and know how to act within their role.
FLODISQ develops role-based security competence for boards, managers, security and privacy professionals, specialist teams and employees. We use real cases to move beyond theory, practise difficult decisions, expose the root causes behind stalled security programmes and prevent governance from becoming bureaucracy without better security.
Our goal is not to make people dependent on FLODISQ. It is to build the judgement, skills and reusable methods that make the organisation more capable without us.
Knowing the rule is not the same as knowing what to do.
Why security programmes get stuck
The problem is rarely a complete lack of policies, frameworks or controls.
More often, security initiatives struggle because responsibility is unclear, risk ownership is displaced, compliance becomes the objective, or security professionals take over decisions that belong in the business.
Knowledge without context
People know the rule but not the reason, trade-off or risk behind it.
Responsibility without ownership
Security is treated as the CISO or ISO team’s problem rather than a management responsibility.
Controls without decisions
More templates and approvals are introduced without making risk decisions clearer.
Awareness without action
Employees are told to be vigilant but are not given practical responses for difficult situations.
Compliance without security
The process creates evidence, while the underlying exposure remains.
We teach what sits behind the framework
Frameworks matter. But effective professionals and decision-makers must also understand how governance, incentives, authority, organisational behaviour and risk perception affect the outcome.
- The dynamics behind difficult information security programmes
- Root causes of stalled or ineffective implementation
- Governance, mandate and the Three Lines Model
- Risk ownership, decision-making and escalation
- The role and influence of the Information Security Officer
- How attackers exploit trust, urgency and organisational routines
- How to translate frameworks into proportionate action
- How to prevent compliance and process from becoming empty bureaucracy
Training for different roles
Each audience makes different security decisions. The content, cases and exercises follow the role.
Board and Management Workshops
For boards, directors and senior management
Responsibilities, risk appetite, decision-making, accountability, mandate, escalation and oversight. Participants work with realistic cases rather than generic cyber briefings.
Information Security & Privacy Team Development
For CISOs, ISOs, Privacy Officers, risk professionals and control functions
Deepens professional judgement, advisory skills, risk analysis, ISMS practice and the ability to challenge without taking over first-line ownership. Can include train-the-trainer materials.
Role-Specific Training
For procurement, HR, finance, data management, IT, research, facilities and other specialist functions
Connects security to actual processes, decisions and failure modes within the role. Scenarios are adapted to the organisation and sector.
Organisation-wide Security Competence
For employees who make security-relevant decisions in everyday work
Security awareness tells people that threats exist. We train people to recognise situations, verify requests, handle information, report concerns and respond effectively to manipulation. The objective is not simply to make employees more aware, but more capable.
Want to know how your organisation responds in practice? Social Engineering Testing →
CISO & Security Leadership Coaching
For CISOs, CPOs and senior security leaders
Senior security roles require more than technical expertise. FLODISQ provides an independent sounding board for difficult risk decisions, organisational dynamics, escalation, stakeholder management and executive reporting. Practical coaching for situations where the framework does not provide the answer.
Awareness has a role. It just is not the end goal.
Awareness helps people recognise that a risk exists. Competence enables them to respond effectively.
Where required, FLODISQ evaluates existing awareness programmes, improves campaigns and develops practical learning interventions. But our objective goes further: people should know what to do when security becomes part of a real decision.
- Aware
Recognise that a risk exists
- Understand
Know why it matters and what drives it
- Practise
Work through realistic cases and dilemmas
- Decide
Make proportionate choices within the role
- Act
Verify, escalate, report and respond
AwarenessCompetence
How FLODISQ training works
- 01
Understand
We clarify the audience, relevant decisions, existing programme and desired organisational outcome.
- 02
Design
We select cases, exercises and theory that match the participants’ roles and maturity.
- 03
Challenge
Participants examine assumptions, ownership, incentives and the root causes behind recurring security problems.
- 04
Practise
Cases, dilemmas and guided discussion turn concepts into decisions and usable language.
- 05
Apply
Every session ends with actions, decision checks or working methods participants can use immediately.
- 06
Embed
Where required, FLODISQ supplies reusable materials, train-the-trainer content and a broader learning roadmap.
Examples from our training practice
Who advises, who decides, who implements and who may accept residual risk?
How to influence, challenge and escalate without becoming the owner of every security problem.
How attackers exploit trust, urgency, pretexting, fragmented information and routine procedures.
How responsibilities, mandates and reporting create real control instead of administrative theatre.
How to move from frameworks and registers to proportionate decisions and measurable improvement.
CISO & Security Leadership Coaching
Leadership coaching can be delivered as a focused advisory engagement or an ongoing series of sessions. The focus is on judgement, not operational outsourcing.
Typical format: regular coaching sessions, tailored to the role and organisational context.
Discuss coaching- Difficult risk decisions
- Preparation for executive reporting
- Escalation
- Security cases
- Stakeholder dynamics
- Maintaining the boundary between advice and business ownership
Delivery formats
Start with an accessible briefing or workshop, then build deeper role development through a programme.
| Format | Typical scope | Best used for |
|---|---|---|
| Executive briefing | 60–90 minutes | Focused session for boards and leadership teams around responsibility, current threats and decisions. |
| Interactive workshop | Half or full day | Case-based workshop with role-specific dilemmas, discussion and practical outcomes. |
| Professional masterclass | 1–2 days | In-depth development for security, privacy, risk and control professionals. |
| Team development programme | 4–8 sessions | Structured learning programme combining theory, cases, practice, reflection and transfer. |
| Organisation-wide competence | Campaign or programme | Practical, role-relevant learning with scenarios, exercises and reusable decision and response guidance. |
| Train-the-trainer | Tailored | Materials, facilitator guidance and transfer to enable internal delivery and continuity. |
Clear starting points, room for tailoring
Training is scoped around audience, preparation, customisation, delivery and reusable materials. These starting prices make the service easy to buy while preserving room for meaningful tailoring.
Executive Briefing
Up to 90 minutes, intake, tailored cases and executive takeaways.
Discuss your training needsInteractive Workshop
Half-day workshop, preparation, role-specific cases and participant materials.
Discuss your training needsFull-Day Masterclass
Full day, in-depth content, applied exercises and reusable materials.
Discuss your training needsTeam Development Programme
Four-session programme including intake, design, delivery and evaluation.
Explore a tailored programmeSecurity Competence Programme
Current-state review, role and decision analysis, targeted learning, practical exercises and implementation roadmap.
Explore a tailored programmeExtended Learning Programme
Multi-audience or multi-month programme with management, professional and organisation-wide workstreams.
Explore a tailored programmePrices exclude VAT and travel. Final scope depends on participant numbers, degree of customisation, required preparation, delivery location and whether reusable or train-the-trainer materials are included.
Proven educational depth
FLODISQ contributes to the post-HBO Cybersecurity & Information Security programme delivered with Inholland Academy. The programme combines current frameworks and methods with assignments in the participant’s own organisation, including cyberattack analysis, risk analysis, maturity assessment and an actionable security roadmap.
That same principle shapes our organisational training: serious content, practical application and direct value for the organisation.
What participants take back to work
A clearer understanding of their own role and responsibility
Better questions for security and risk decisions
Practical ways to challenge, verify, escalate and report
A stronger link between frameworks and real organisational choices
Recognition of root causes behind recurring security problems
Actions that improve security without adding unnecessary bureaucracy
Awareness is where learning starts. Competence is where security improves.
Tell us where security decisions, ownership or behaviour are getting stuck. We will design training around the reality of your organisation.