How much time does this cost my staff?

About 15 minutes a month for the online module, plus half a day twice a year for the workshop. The phishing simulations cost no extra time — they run in the normal inbox.

Are results attributed to individual employees?

Not if you prefer otherwise. By default we evaluate by department and role, not by person. This is not a formality: as soon as staff fear that a click goes on record, they report incidents late or not at all — and the programme loses precisely the effect it exists for. Works council involvement is settled before the start.

What happens if someone repeatedly falls for simulations?

That person receives additional, shorter units on the topic in question — no report to their manager. Someone who clicks repeatedly has a knowledge problem, not a discipline problem.

Is this enough as evidence for ISO 27001 or NIS2?

For the part concerning training and awareness: yes. Both require not only that training happened but evidence of its effectiveness, and the evaluations provide that. The programme does not cover the remaining requirements of those standards — that is what ISMS implementation is for.

Can we start with part of the organisation?

Yes, and that is the usual route. Often an area with elevated risk starts first — accounting, procurement, the board — and the programme is extended after the first cycle.

Packages & Subscriptions

Security Awareness Training Plus

The most expensive attacks of recent years rarely began with an unknown vulnerability. They began with an email somebody opened. Security Awareness Training Plus starts exactly there — not with one mandatory session a year, but with a programme that runs for twelve months.