For public authorities Awareness for public employees
Training and simulation tailored to everyday administrative life: official secrecy, record keeping and a public area where strangers are normal.
- The differenceIn public administration it's not about revenue but about official secrecy and citizens' data.
- The special featureWhere public visitors are part of everyday life, the usual vigilance towards strangers doesn't apply.
- What you have afterwardsA metric for the head of office and rules that are practicable at the counter.
Awareness for public employees
- Phishing simulation with scenarios from everyday administration
- Handling files, printouts and screens in the public area
- Official secrecy in conversations on the phone and at the counter
- What to do if a data protection incident is suspected, including the reporting channel
- Evaluation exclusively aggregated, never personal
How it works in practice.
Coordination
Which processes exist, which incidents have there been recently, how the reporting channel is organised.
Simulation
Realistic scenarios tailored to your specialist applications and processes.
Training
Short and concrete, based on the cases from your own measurement.
Embedding
A few rules that actually hold up at the counter.
A forged message designed to get you to do something – usually click a link and enter credentials. Modern variants are linguistically flawless and refer to real events in your organisation.
A supposed message from management with an urgent request for a transfer, often combined with a request for confidentiality. It is precisely this combination of urgency and secrecy that gives it away.
We send a harmless but realistic phishing email to your team ourselves. Nobody is harmed, nothing is installed. We measure how many click – and how many report it.
A reported attack is an attack fended off. That is why the most important number is not how few click, but how many speak up. Evaluation is always anonymous, never by name.
What is included – and what explicitly is not.
Typical scope
One office with 20 to 200 staff.
Duration
Simulation and training over around four weeks.
Prerequisite
Commission by the head of office, involvement of the staff representatives where required.
Not included
No individual evaluation, no permanent monitoring of email traffic.
Awareness reduces the likelihood but doesn't replace technical and structural measures.
What people ask beforehand.
That depends on your office's rules. Because the evaluation is exclusively aggregated and no conclusions can be drawn about individual staff, the hurdle is usually low. We provide the documents the staff representatives need for their assessment.
Non-disclosure agreement before the first meeting. On request we work exclusively with named contact persons and without subcontractors.
Yes, and it is the most effective combination: the access test shows how far someone gets beyond the public area – the training ensures that next time someone asks.
More offers for you.
Security assessment for public bodies
A technical assessment whose documentation is structured from the outset to stand up to an audit and a procurement procedure.
Access test in the public area
Public offices have a feature that hardly occurs elsewhere: strangers in the building are completely normal. That is exactly what we test.
Awareness for public employees
Training and simulation tailored to everyday administrative life: official secrecy, record keeping and a public area where strangers are normal.
What we encounter in assessments, before you encounter it.
Not a product newsletter. We write about attack paths that actually worked against Austrian businesses, authorities and schools – and what helps against them.
- About once a month, not every week
- Concrete attack paths from real assessments
- No tracking pixel, no sharing with advertisers
- Unsubscribe with one click in every email