69% reduction in phishing simulation interactions: how Evoriel built a shared cybersecurity culture across 3,500 employees

Real estate group Evoriel has made cybersecurity a shared reflex across its entire agency network, using a human-centric, gamified approach tailored to each employee’s role.

Phishing simulation click rate:

from 22% to 9% — a 59% reduction

Interaction rate with simulated phishing emails:

from 13% to 4% — a 69% reduction

210 agencies and 3,500 employees

engaged nationwide

Solutions deployed:

Cybersecurity awareness training (gamified e-learning)
Multichannel phishing simulations
Advanced customisation by brand and role
Sofie chatbot

Book a demo

A real estate group founded in 2024, already facing a major challenge

Evoriel is an independent real estate services group. Through its Lamy and Oralia agency networks for individual customers, and its Richardière and Terranae brands for institutional investors, the group now supports more than one million customers across 210 agencies throughout France.

But Evoriel, as it exists today, is still a young organisation. The group was formed in 2024 through the merger of several brands. From the outset, this presented Cyprien Fernandez, Chief Information Security Officer (CISO), with a major challenge: bringing together 3,500 employees with very different profiles, spread across a highly decentralised network, around a shared security culture.

“Our main challenge was to familiarise employees in the real estate sector with a topic they often perceived as purely technical: cybersecurity,” explains Cyprien Fernandez.

The challenge was twofold. On the one hand, Evoriel had 210 agencies operating under different brands, with widely varying levels of cybersecurity maturity between headquarters and local teams. On the other, many employees still saw IT security as something distant from their day-to-day work and largely reserved for technical experts.

For Cyprien Fernandez, it was clear that simply meeting compliance requirements would not be enough. Evoriel needed a genuine partner capable of helping build a long-term cybersecurity awareness strategy.

Neither a complex platform nor just a chatbot: finding the right balance

In a cybersecurity awareness market crowded with solutions, Cyprien Fernandez quickly identified a common limitation among the platforms he evaluated: many took an overly one-sided approach that did not reflect the reality of Evoriel’s organisation.

“The market often presented two opposite approaches: either traditional, heavyweight e-learning platforms or solutions built entirely around a chatbot. Neither really matched what we needed.”

What ultimately tipped the balance in SoSafe’s favour was its ability to avoid that binary choice. The platform combines gamified, interactive e-learning modules with Sofie, SoSafe’s conversational assistant, alongside automated phishing simulation campaigns and reporting tools that enable Evoriel to track employee participation and progress.

“SoSafe’s adaptability made all the difference: the ability to provide awareness content that is genuinely tailored to each person’s role within the organisation.”

Gamified content also transformed something fundamental: the way employees perceived cybersecurity.

“It was no longer seen as a constraint. It helped our employees engage far more easily with topics that can otherwise feel highly technical,” says Cyprien Fernandez.

Decentralised across the business, unified in its management

Rolling out a single cybersecurity awareness strategy across 210 agencies, each with its own brand and identity, is no small task. As with any deployment of this scale, the project required some initial adjustments, which the close collaboration between the two teams helped address without slowing momentum.

One of Evoriel’s strengths was its central Group IT organisation, which was able to coordinate the deployment across all subsidiaries despite differences in cybersecurity maturity from one agency to another.

This centralised management, combined with SoSafe’s advanced customisation capabilities, made it possible to tailor training to the branding and specific needs of each entity — Lamy, Oralia, Richardière, Terranae and others — significantly simplifying the group-wide rollout.

“This greatly facilitated the deployment of the campaign and helped us achieve a consistent level of cybersecurity maturity across our entire IT environment,” says Cyprien Fernandez.

Measurable results and a partnership built for the long term

One year after launch, the results are clear. Evoriel closely monitors the evolution of its key indicators:

The click rate on phishing simulations fell from 22% to 9%.
The interaction rate — the proportion of employees who go as far as entering information on a simulated phishing page — fell from 13% to 4%.

Beyond the numbers, Cyprien Fernandez particularly values the nature of the partnership:

“This type of collaboration is, in my view, the most relevant foundation for building a long-term relationship.”

Asked what he would say to another CISO who was still hesitating to take action, his answer is simple:

“The risk is waiting. The question isn’t which tool to choose, but when to start. My advice comes down to three words: launch, measure, adjust.”

At Evoriel, cybersecurity is no longer the responsibility of technical experts alone. It has become a shared reflex for 3,500 employees, from headquarters to every local agency.

It is a culture built step by step, agency by agency — and one that continues to grow stronger.