SMEs & Public Sector
Train your staff to recognise deepfake fraud, voice cloning and AI-enhanced phishing, and leave with verification steps that do not depend on recognising a face or a voice.
Finance teams authorise payments. Senior leaders are identifiable by voice and by face. Those are the targets.
In 2024, a finance employee at the engineering firm Arup was persuaded to transfer approximately £20 million to fraudulent accounts after a video call that appeared to show colleagues. Those colleagues were not present. The call used pre-recorded deepfakes. No system was compromised. The fraud succeeded through social engineering alone.
The National Cyber Security Centre (NCSC), in its assessment Impact of AI on Cyber Threat from Now to 2027 (7 May 2025), found that AI gives criminals a significant uplift in social engineering and will make attacks more frequent and harder to detect. The uplift is already present.
Any organisation that handles money, sensitive data or client relationships has staff who need this course. The highest-risk roles are finance teams, operations staff, IT managers and senior leaders. A local authority finance department processing grant payments or an NHS trust managing procurement faces the same exposure as a private-sector business.
| Right for you if | Not right for you if |
|---|---|
| Your finance team processes payments or clears invoices by phone or email | Your main concern is personal data handling and ICO compliance evidence (see Responsible AI and Data Protection) |
| Staff use tools like ChatGPT or Copilot without clear safe-use rules | You need AI policies and accountability structures built (see AI Governance for Organisations) |
| Your annual cyber training was written before AI-generated attacks existed | You want to build AI literacy foundations first (start with AI Fluency for Organisations) |
| You need documented evidence of training for your ICO accountability records | You are booking for a single person rather than a team |
| Your senior leadership is publicly identifiable by voice, image or video |
How AI-enabled fraud works and what verification habits stop it. Deepfake video and image fraud, voice cloning, AI-enhanced phishing, social engineering at scale, synthetic identity attacks, and the process controls that provide defence: out-of-band verification, dual authorisation on payments, and approval steps that do not depend on identifying a face or a voice.
What staff can and cannot do with tools like ChatGPT, Microsoft Copilot and similar platforms. Prompt injection, data leakage through AI queries, and the secure configuration and safe use of your approved AI tools. The NCSC has stated that prompt injection "may never be totally mitigated" (NCSC, 8 December 2025), which is why staff awareness sits alongside technical controls rather than below them.
A scoping call to understand your approved AI tools, sector, current policies and the specific roles attending. No two sessions cover the same scenarios.
Delivered in-house or online for groups of up to 15. Materials are written specifically for your organisation and sector. Larger teams are accommodated across multiple sessions.
Every participant receives documented evidence of training completion meeting the ICO audit framework's expectations. All session materials are shared with the client after the course.
The DSIT Code (31 January 2025, co-developed with the NCSC) is a voluntary code. Principle 1 states that an organisation's cyber security training "shall include AI security content". This course addresses both of Principle 1's requirements: the AI-specific threats staff face, and the safe use of AI tools within the organisation.
The accountability principle (Article 5(2)) requires organisations to demonstrate compliance with data protection law. The ICO's data protection audit framework expects all-staff training programmes with documented completion records. This course produces documented evidence meeting those expectations.
For organisations with EU exposure, Article 4 has been in force since 2 February 2025 and creates a direct obligation to ensure that staff involved in AI operations possess sufficient AI literacy. For UK-only organisations, it reflects the direction that UK regulatory expectations are moving toward.
For large organisations meeting at least two of three statutory thresholds (250+ employees, £36m+ turnover, £18m+ balance sheet), the Act's "failure to prevent fraud" offence makes staff training part of the reasonable procedures that form a defence.
Our co-founder Ben Sefton spent 18 years as a Senior Forensic Investigator with Greater Manchester Police, working alongside national law enforcement on major crime investigations. Insightful AI has delivered AI training and awareness briefings to the National Crime Agency, the National Police Chiefs' Council, the North West Regional Organised Crime Unit, City of London Police, Lancashire Constabulary and Greater Manchester Police, among others.
That background informs how this course is built: it shows staff how attacks are constructed and executed, not how they are described in a vendor threat summary. Insightful AI is listed on the UK Register of Learning Providers (UKPRN 10098807).
A 30-minute call. We will ask about your team, the tools you use and what you need to demonstrate for your records, then confirm whether this course is the right fit or whether another in the programme is the better starting point.
Book a free discovery call