Security Awareness The moment of decision.
Technology can be patched, people can't. We train the decision in the moment of the attack – measurable, repeatable and without singling anyone out.
- The question being answeredHow do your people decide in the moment of a real attack – and do they report it?
- Why it mattersThe reporting rate is the most meaningful metric of all: a reported attack is an attack that has been fended off.
- What you have afterwardsA baseline measurement, a short training session based on real cases and a comparison value after the second round.
A forged message designed to get you to do something – usually click a link and enter credentials. Modern variants are linguistically flawless and refer to real events in your organisation.
A supposed message from management with an urgent request for a transfer, often combined with a request for confidentiality. It is precisely this combination of urgency and secrecy that gives it away.
We send a harmless but realistic phishing email to your team ourselves. Nobody is harmed, nothing is installed. We measure how many click – and how many report it.
A reported attack is an attack fended off. That is why the most important number is not how few click, but how many speak up. Evaluation is always anonymous, never by name.
The same scam as phishing, just through a different channel: by text message or messenger (smishing) and by phone call (vishing). Both often work better than an email because nobody expects them – and because a call builds pressure that is harder to escape than a message you could simply ignore.
The one address or number to which anyone can send a suspicion without first wondering whether they are responsible. It must be known, reachable and free of consequences: anyone who reports a harmless email must not be mocked for it. A business without a working reporting channel only learns of an attack when it is already under way.
The moment of decision.
Tick-box awareness videos change nothing. What works is a real attempt followed by an explanation that doesn't embarrass anyone. Results go to management as a metric, never as a list of names.
- Evaluation as a metric, not a list of names
- Training materials to keep
- Comparison value after the second round
- Template for internal rules
How we work.
Baseline measurement
A realistic simulation tailored to your sector and your processes.
Training
Short, concrete, based on the real cases from the measurement – on site or remote.
Repetition
A second simulation after a few weeks. Only the comparison shows whether it worked.
Embedding
Short rules that hold up in everyday life, instead of a policy nobody reads.
What it looks like in practice.
Not a sales pitch, but what we actually do – with the techniques and tools behind it.
How a simulation is built
Everyone spots a test email full of spelling mistakes. It produces a nice result and no learning effect.
We build the scenarios on your real situation: a supposed message from the document system you actually use, a rescheduled appointment referring to an ongoing project, an invoice from a supplier you really work with.
The information needed for this comes from the same public research an attacker would carry out – not from internal documents.
Before the first message comes coordination. A simulation touches on co-determination and data protection, so we clarify with the employee representatives and the data protection officer beforehand what is collected and what explicitly is not. We also define what is off limits: we don't work with fake dismissals, invented deaths or supposed pay cuts. Such scenarios produce high click rates and damaged trust – the learning effect is zero.
The whole thing only becomes effective over several waves. A single mailing delivers a snapshot and little else. That is why we work with three to four waves over a year with increasing difficulty: from the recognisable mass message to the targeted letter that refers to a name, a role and a current tender. Only the trend shows whether anything has changed.
Measured in several stages
Who clicks is the familiar number. Who reports is the more important one.
We record who opens the message, who clicks the link, who actually enters data on the replica login page – and who reports the incident.
The evaluation is exclusively aggregated. Anyone who falls for it receives factual, private feedback explaining how the message could have been recognised. Management receives a metric, never a list of names.
The most meaningful metric is the time to the first report. A workforce in which someone speaks up after four minutes is far better placed than one with a low click rate and not a single report – because in an emergency what matters is not whether someone clicks, but how quickly IT finds out. That is why we measure reporting rate and reporting time on an equal footing with the click rate.
Just as important is what the numbers are not: a performance appraisal tool. We supply no ranking, no names to line managers and no evaluation by departments so small that individuals could be identified. As soon as a simulation is perceived as surveillance, the willingness to report drops – and with it precisely the value that matters.
Technical deep dive
On request we also simulate vishing calls: a supposed member of the IT department who helps with a setup and asks for a password or an MFA code in the process. This variant is becoming more relevant now that pure password attacks are made harder by two-factor authentication.
Training that holds up in everyday life
The measurement produces a handful of rules – not a list of abstract warning signs.
The training part is deliberately kept short and works with the cases from your own measurement. The result might be: payment instructions by email are always confirmed via a second channel, regardless of who sends them.
For this to hold, management must state this rule explicitly once. Otherwise nobody dares to ask back. We help prepare this point.
The format depends on the audience. In businesses, 45 to 60 minutes in person is the norm, split by area, because accounts and production see different attacks. In schools we work in single lessons per class, age-appropriate and with cases from the pupils' everyday lives. For distributed teams there is a shortened online version – it doesn't replace the in-person session, but bridges the gap between two sessions.
So that it doesn't fizzle out after a year, repetition is part of it: a short refresher each year and a session for new employees during onboarding. The second point is almost always overlooked – a business with ten per cent staff turnover has, after three years, a third of its workforce who have never seen the training, while the metric in the report still looks good.
What is included – and what explicitly is not.
So that you know what you are getting into before you commission us. The exact scope is defined in the intro call.
Typical scope
A phishing simulation plus training, either for the entire workforce or a selected group.
Duration
Simulation and evaluation within two weeks, training as a half day on site or as two shorter online sessions.
Prerequisite
Coordination with management and – where there is one – the works council, plus a list of the mailboxes to be addressed.
Not included
No evaluation by name, no passing on of individual results to line managers, no permanent monitoring of email traffic.
Awareness reduces the likelihood but does not replace technical safeguards. Without two-factor authentication, training alone achieves little.
What clients want to know beforehand.
No. Results go to management exclusively as an aggregated metric. Anyone who falls for a simulation receives private, friendly feedback – no list goes to line managers.
Especially there. Smaller institutions often have fewer technical safeguards, which makes the awareness of those involved all the more important.
As realistic as what actually lands in your inbox – based on current scams, not on generic test emails you can recognise at first glance.
No. The effect only shows when compared with a second simulation a few weeks later – which is why repetition is a fixed component, not optional.
A phishing simulation is processing of personal data and touches on performance monitoring – so we involve the employee representatives and the data protection officer before the first message, not afterwards. We provide a description of which data is collected, how long it is kept and who sees it. In businesses with a works council, a works agreement is the usual and cleanest route.
Yes. You receive confirmation of the training carried out with date, content, duration and number of participants – in a form that can be used as evidence for auditors, insurers or as part of a certification. On request also a named attendance list, provided your employee representatives agree.
What often goes with it.
We're standing in your server room.
We get into your building – with the same means as a real attacker, but with your signature in our pocket and a photo as proof.
From the outside, like a stranger.
We attack your systems in a controlled way: from the outside like an unknown party, from the inside like an employee whose access has already fallen into the wrong hands.
What is already out in the open.
We gather what can be found freely about your organisation before someone else does. Completely passive – we don't touch your systems.