COMPANY
Beacon Cymru
BUSINESS SIZE
Medium
INDUSTRY
Nonprofit
About Beacon Cymru
Beacon Cymru was formed in January 2025 from the merger of Coastal Housing and RHA. The newly combined organisation faced the challenge of uniting staff from two different cultures while keeping cyber awareness high. In the UK housing sector, cyber attacks have overtaken health and safety as the most frequently cited concern, with one in four housing associations reporting an attack in the past year. For Beacon Cymru, technology alone would not be enough to protect staff and residents.
Challenge
Director of IT and Transformation Andy Johnson needed to develop a cyber strategy from scratch. Staff knowledge varied widely and traditional annual e-learning was insufficient.
“If I trained somebody 11 months ago on cyber in e-learning, maybe ten percent of it sticks. When they are targeted by attacks, they cannot remember what they need to,” said Andy Johnson.
The organisation also faced a high-risk environment. “In our sector, we have had a few people targeted, one very recently. It is quite sobering when you see those things,” Andy Johnson explained.
Why Redflags Was the Perfect Fit
Beacon Cymru discovered Redflags at a cyber security show. The platform offered micro-campaigns, real-time nudges, and behavioural reinforcement that transformed awareness from a once-a-year exercise into an everyday habit.
“People are snowed because of all the work. It just makes you stop and think. That is very clever,” said Andy Johnson.
Redflags, added, “From our first conversation with Beacon Cymru, it was clear they wanted more than compliance training. They wanted something that could grow with them through change. That alignment made it easy for us to focus on the human side of security, not just the technology.“
Redflags also provides unique support in baselining staff behaviours, giving Beacon Cymru insight into knowledge levels across both legacy organisations. This helps identify where learning is needed most and ensures consistent awareness across the merged workforce.
Launching the First Campaign: Check the Sender
Beacon Cymru launched its first campaign, Check the Sender, to address one of the sector’s most prevalent threats: social engineering and fraudulent emails. Andy Johnson explained, “A lot of it boils down to social engineering and staff-based attacks. So I think that campaign will help to get really important messages across to our people.“
Check the Sender focuses on small, actionable behaviours. Staff are encouraged to pause before clicking links, verify email addresses, and think critically before responding to unexpected requests. The campaign also uses real-time prompts to interrupt autopilot behaviour. “These bad actors rely on you automatically going through doing the things you need to do. Check the Sender makes people stop and think before they act,” said Andy Johnson.
The campaign was integrated with other initiatives, such as cyber escape rooms and spotlight sessions, ensuring that awareness became part of daily work rather than a compliance checkbox. Andy Johnson emphasised the importance of repeated, bite-sized learning: “If we train staff and assume they remember everything from a year ago, we are in dangerous territory. Campaigns like this give them practical, timely steps to recognise threats.“
Redflags’ library of content and campaigns allows Beacon Cymru to deliver continuous learning across a range of topics. Microlearning modules provide timely, focused insights that reinforce awareness and build long-term behavioural change, ensuring all staff remain alert to evolving threats.
Next Steps
Redflags has already created measurable awareness and engagement, and Beacon Cymru is now looking ahead to the next phase, which revolves around introducing real-time Nudges, subtle prompts that reinforce secure behaviour in the flow of work.
“These bad actors rely on you automatically going through doing the things you need to do. Having those nudges pop up is subtle, but it stops you. It makes you think,” Andy Johnson explained.
By rolling out Nudges alongside ongoing campaigns, Beacon Cymru will continue to reinforce practical, in-the-moment behaviours that keep staff alert to evolving threats. Combined with Redflags’ library of content, microlearning campaigns, and behavioural baselining, the organisation is building a human firewall that will strengthen staff knowledge, engagement, and vigilance for the long term.
