Your people are your
most important security system.

Security awareness refers to measures that educate employees about cyber threats and enable them to correctly identify and respond to security-relevant situations. According to IBM research, over 90% of all successful cyberattacks begin with human error - whether clicking a phishing link, using weak passwords, or opening unknown attachments. Technical controls alone are not enough: people must be understood as an active part of the security strategy.

Many organisations send a one-off test phishing email and consider a low click-rate a success. Professional managed phishing simulations go much further: we vary scenarios, tailor lures to current events within your organisation, combine phishing with vishing (phone-based attacks), and measure not just click rates but also reporting behaviour, response times, and improvement potential per department. You receive a detailed analysis with industry benchmarks and a prioritised action roadmap.

One-off training sessions are largely ineffective - the forgetting curve sets in within weeks. Best practice is a continuous programme: monthly micro-learnings (3-5 minutes), quarterly phishing simulations, and annual in-depth activities such as live hacking shows or escape desk sessions. NIS-2 affected organisations must demonstrate that awareness training is conducted regularly - our managed approach automatically generates audit-ready reports.

Costs depend on participant numbers, format, and intensity. A phishing simulation for up to 100 employees starts from approximately EUR 1,200; a live hacking show (up to 100 participants, 90 minutes) from approximately EUR 2,500. The Escape Desk is priced as a workshop format. For organisations booking a full-year managed programme, we offer flat rates. Contact us for an individual quote - you will receive a response within 24 hours.

Yes, directly. NIS-2 explicitly requires affected organisations to train employees in cybersecurity matters. ISO 27001 lists awareness measures as a core component of an ISMS (Annex A, control 6.3). Our measures are fully documented and provide audit-ready evidence - for internal audits as well as regulatory requests.

Absolutely - and this is particularly important. CEO fraud, spear-phishing, and social engineering attacks deliberately target decision-makers. Our live hacking shows and executive workshops are specifically designed for senior leaders: less technical, more focused on business risks and real-world attack scenarios. Many of our clients combine a board presentation with a company-wide awareness campaign for all employees.

We recommend combining a live hacking show as a kickoff event (creates emotional impact and attention) with subsequent monthly phishing simulations (trains the learned behaviour). The Escape Desk works excellently as a refresher after 6-12 months. In the free initial consultation we develop a tailored plan for your organisation.

Our primary language is German. Phishing simulations can also be conducted in English. Live hacking shows are available in both German and English. For international teams we create multilingual campaigns with unified reporting.

A phishing simulation can be set up within 5-10 business days. For a live hacking show we typically plan 2-4 weeks of lead time. The Escape Desk requires approximately 3 weeks of preparation. In urgent cases (e.g. following a security incident) we can also respond at shorter notice.