5.0 on Google & Clutch 96%LIVE of calls answered in under 60 seconds by our local Huntington Beach team

Security Awareness Training & Phishing Tests for Orange County Teams

Most breaches start with a person — a click, a reply or an approved sign-in they shouldn’t have. Training your team is one of the least expensive controls you can put in place, and insurers and auditors now ask for it. Every Managed Care plan includes security awareness training and simulated phishing for your whole team.

96%LIVE of calls answered in under 60 seconds by our local Huntington Beach team 24×7 NOC & SOC monitoring SOC 2 Type II all five Trust Services Criteria On-site support, included 5.0 on Google & Clutch

An employee working on a laptop with a secure connection turned on

Security awareness training · phishing tests

A team that reports the phish instead of clicking it.

Short annual training, quarterly simulated phishing and day-one enrollment for new hires. When something looks off, your staff report it and a real engineer checks it — and the results show leadership, auditors and your insurer the progress.

  • Annual online training for every user
  • Quarterly simulated phishing with an instant lesson
  • New hires enrolled when their account is set up
  • Completion and phishing results you can show your insurer
A phishing email, spotted and reported A fake invoice email from a look-alike address arrives. The suspicious link is spotted, the user presses Report and our help desk checks it. Beside it, clicks on simulated phishing emails fall quarter by quarter as training continues. Accounts Payablebilling@yourc0mpany.co Invoice overdue — pay today View invoice Suspicious link Report Our help desk checks ita real engineer picks up Test phish clickedsimulated phishing, by quarter Q1 Q2 Q3 Q4 Reported, not clicked ✓

Technology partners

The platforms behind Security Awareness Training

See our partners →
  • KnowBe4 logo
  • DefensX logo
  • Proofpoint logo
  • Microsoft logo

What your team gets

  • 01 · Train

    Annual training

    Short online modules on phishing, business email compromise, passwords and MFA, safe browsing and handling sensitive data.

    Online modules
  • 02 · Test

    Quarterly simulated phishing

    Realistic test emails — fake invoices, document shares, password resets — sent to every user, with an instant lesson for anyone who clicks.

    Phishing simulations
  • 03 · Onboard

    New-hire training

    New employees are enrolled when we set up their account, so nobody starts without the basics.

    Day-one enrollment
  • 04 · Report

    Reports you can show

    Completion rates and phishing results by person and over time, for your leadership, your auditors and your insurer.

    Quarterly report
  • 05 · Back up

    A help desk that picks up

    When someone isn’t sure about an email, they call us and a real engineer picks up — 96%LIVE of calls are answered in under 60 seconds.

    Real engineers
  • Try it

    Spot the Phish quiz

    Ten realistic emails and texts — decide which are scams, then see every red flag explained. A quick way to start the conversation.

    Spot the Phish

Why training matters

Business email compromise

Fake invoices and changed bank details are among the most expensive cybercrimes businesses face. A team that knows to call and verify stops it cold. Pair training with email security.

Stolen passwords

Fake sign-in pages are one of the most common ways attackers get into Microsoft 365 accounts. Training teaches people to spot them, and dark web monitoring catches the passwords that leak anyway.

Insurers and auditors ask

Cyber insurance applications, CMMC, SOC 2 and PCI DSS all expect regular training. Check your answers with the cyber insurance readiness check.

Measured over time

Quarterly phishing results show who’s improving and who needs a refresher, so training gets sharper every quarter.

See how a regular training program worked for a wholesale fuel distributor in our cybersecurity training case study.

Test your team’s eye

Try Spot the Phish, our free 12-question quiz built from real phishing emails and texts, and share it with your team. Training is part of our layered managed cybersecurity services.

Set up training for your team Try Spot the Phish

What sets us apart

Fast response, deep security, senior expertise and engineers on-site.

<60 sec to a live engineer

Response time you can measure

96%LIVE of calls are answered by an engineer in under 60 seconds, every ticket is assigned in under 10 minutes, and every email or portal ticket gets a real engineer within 20 minutes (Mon–Fri, 5 AM–6 PM). Calls never go to voicemail during service desk hours, and the same team is on call 24×7.

See the live numbers →

24×7 NOC & SOC MSSP-grade security

A security provider, not just an IT provider

We operate as a managed security service provider (MSSP): SentinelOne MxDR, a 24×7 NOC & SOC, managed SIEM, DefensX browser security, security awareness training, vulnerability management, penetration testing and CMMC support — run by a team audited for SOC 2 Type II across all five Trust Services Criteria.

Our security services →

55+ years of combined experience

Senior technical expertise behind every ticket

Led by hands-on co-founders Kevin Nichols and Joe Kemp, with 55+ years of combined IT experience. Every engineer passes a technical assessment, we staff above our workload, and nobody works on something they’ve never seen before without an experienced engineer alongside — no call center, no offshore tier.

Meet the founders →

On-site included, no trip fees

Engineers who come to you

When hands-on work is needed, a local engineer is dispatched from our Huntington Beach office. On-site support is included in Managed Care — no dispatch fees, trip charges or hourly on-site rates — from the same team that knows your environment.

Areas we serve →

We re-earn your business on every ticket. No contract ever replaces doing the work well. Every user who opens a ticket gets a satisfaction survey when it closes, and every score is visible to our whole team and leadership — the averages are published live for anyone to see.

See our survey results →

Best-of-breed, by design

Industry-leading tools, chosen and run by engineers

We’re technology agnostic: we don’t resell a single vendor’s bundle or push the platform with the best margin. Every tool we recommend is a best-of-breed industry leader — selected, tested and configured by our own engineers because it’s right for your business.

Our leadership team is highly technical. Our co-founders, Kevin Nichols and Joe Kemp, are hands-on engineers, not just managers, and they constantly re-evaluate our tools and service offering — retiring what falls behind and adding what keeps clients ahead. You get enterprise-class technology that keeps improving, without lifting a finger.

  • SentinelOneMxDR endpoint protection
  • Microsoft DefenderPlan 2 & Intune device management
  • QualysVulnerability management
  • LiongardConfiguration & change monitoring
  • NinjaOneRemote monitoring & patching
  • 24×7 NOC & SOCManaged SIEM & threat hunting
  • Veeam + AzureBackup & off-site replication
  • Azure Site RecoveryCloud disaster recovery

Just some of the technologies we use.

Security Awareness Training FAQs

Is security awareness training included in Managed Care?

Yes. Every Managed Care plan includes online security awareness training and simulated phishing for all of your users, set up and run by our team.

How often should employees be trained?

We recommend training every year, for new hires when they start, and a simulated phishing test every quarter. Short, regular practice works better than one long session.

What happens when someone clicks a simulated phish?

They see a short explanation of what they missed and a quick lesson — not a reprimand. The reports show trends over time, so training can focus on the people and the tricks that need it.

Does training count for compliance and insurance?

Yes. Completion records and phishing results are evidence for CMMC and NIST 800-171, SOC 2 and PCI DSS, and for the training questions on cyber insurance applications.

What should employees do with a suspicious email?

Don’t click, reply or forward it to colleagues — report it. Our help desk answers most calls in under 60 seconds and will check it for them.

Success stories

Rated 5.0 on Google and Clutch.

Real reviews from the businesses we support — not a curated quote wall.

★★★★★Google
“Knowledgeable and proactive group that partners with you to assure your objectives are met, along with planning for future needs. All balanced with supporting your business day in and day out with a friendly, responsive and competent help desk. Recommend and would select them again!”
Tom G
★★★★★Google
“CAL IT has been a game changer for us. They tackle issues quickly and efficiently for us. So grateful their expertise. I highly recommend their services.”
Kelli Foudy
★★★★★Google
“We have worked with Cal It for several years now, They are very responsive and professional. We would highly recommend them.”
Cathy Goff

Customer service first · we re-earn your business on every ticket

Obsessive about service. Relentless about the details.

CAL IT Group brings enterprise-class IT, cybersecurity and SOC 2 Type II–audited operational excellence to small and midsize businesses across Southern California — a customer service organization first and foremost, proven day in and day out for over 10 years.

Call 866.24.CALIT