Forgotten after 48 hours
Passively consumed training content is more than 70% gone after two days - that is not a failure of your employees, it is human cognition.
Security Awareness
Escape Desk - Information Security Through Play
Your team does not memorise a rulebook. It experiences information security live - as a puzzle, as a team challenge, as an experience that sticks. No training room. No projector. No click-through course.
Quote within 24 h (business days) · On-site or remote · GDPR-compliant
- 90%
- Engagement Rate
- 60 min.
- Play Duration
- 3-5
- Persons per Team
- 12+
- Scenarios
The Problem
Compliance training does not protect. Experience does.
Most organisations invest in mandatory training that nobody would do voluntarily. The result: high completion rates in the system, hardly any changed behaviour in practice. The reason is not a lack of motivation among your staff - it is the format.
No emotional anchor
What creates no emotion does not change behaviour. Theoretical knowledge about phishing helps little when the email in the inbox looks convincing.
Missing team dynamics
Security is a team task - yet traditional training addresses individuals. Collaboratively solving problems embeds knowledge more deeply and creates shared responsibility.
Low acceptance within the organisation
HR managers know it, IT managers know it: security training has an image problem. The Escape Desk solves that - participants look forward to it.
The Solution
Escape Room - without the room
The Escape Desk brings the escape room concept directly to the workplace. No locked room, no external venue, no logistical effort. Teams of 3 to 5 people solve real security scenarios at their desks within 60 minutes - using physical materials we deliver in advance.
The scenarios are based on real attack techniques: forged emails, social engineering situations, physical vulnerabilities. Anyone who has solved a puzzle together remembers it - long after the session.
No training feel
No slides, no learning objectives on a flipchart. Teams play, solve, discuss - and learn without perceiving it as training.
Real-world scenarios
All puzzles are based on real attack techniques and common mistakes from office life - no theoretical constructs.
Any company size
Whether 10 or 500 employees - through parallel sets the Escape Desk scales to any team size without loss of quality.
Process
How the Escape Desk works
From booking to debriefing - straightforward, well-prepared and lastingly effective.
Briefing & Scheduling
You give us a brief overview of the occasion - team size, setting and desired focus areas. We recommend the right scenario and schedule the session.
Materials Delivery & Setup
We ship all materials in advance - including setup plans and a short introduction. No complex technical setup, no separate moderation room required.
Session & Moderation
Teams solve real security scenarios at their desks in 60 minutes - with professional moderation by our awareness experts.
Debriefing & Transfer
Structured closing discussion: What did teams learn? How can insights be applied directly to everyday work? Includes a handout for all participants.
Learning Content
What your team takes away
Each scenario addresses a real risk from everyday work - scalable to your industry and internal policies.
Phishing & Email Security
Teams identify and analyse realistic phishing emails, spoofed sender addresses and manipulated links - using real-world examples from actual incidents.
Social Engineering
Manipulation through trust: how do attackers persuade employees to reveal sensitive information? Teams develop recognition criteria and defence strategies.
Password Security
Weak passwords, password reuse and insecure storage - teams solve puzzles that reflect typical mistakes from everyday work.
Clean Desk Policy
Which information may be visible on a desk? Scenario-based exercises on physical information security in the office.
USB & Physical Media
Found USB drives, unsecured printers, abandoned workstations - teams learn to recognise physical attack vectors and respond correctly.
Data Protection & GDPR
Which data needs protecting? When does a data breach occur? Practical scenarios that make data protection responsibilities tangible in daily work.
Why Gamification
Play is not a distraction - it is the method
Learning by doing is not a pedagogical trend. It is what the brain does best. When information is linked to an emotion or a decision-making situation, it is stored in long-term memory - and not erased after 48 hours.
- Higher retention rate
- 5x
- Actively experienced content is remembered up to five times longer than passively consumed training materials.
- Engagement rate
- 90%
- Nine out of ten participants rate the Escape Desk as significantly more motivating than conventional awareness training.
- Detection rate
- +68%
- Teams that have completed the Escape Desk identify significantly more attacks in subsequent phishing simulations.
Formats
On-site or digital - your choice
Recommended
On-Site
The classic Escape Desk with physical materials directly at your premises. Strongest impact through tactile experience - teams interact with real documents, artefacts and puzzles.
- Physical materials delivered in advance
- Moderated by AWARE7 experts
- No external venue required
- Parallel teams possible (incl. competition)
- Incl. structured debriefing & handout
Remote / Digital
Online
The digital version of the Escape Desk - browser-based, no installation. Ideal for distributed teams, remote employees or international locations. Same game mechanics, same content.
- Browser-based - no installation
- Compatible with Zoom, Teams, WebEx
- For distributed and international teams
- Pre-session technical check included
- Moderated by AWARE7 experts
Who benefits
Who benefits from the Escape Desk?
HR & People Development
A format employees voluntarily recommend - and that turns compliance obligations into real impact. Ideal for annual awareness plans.
IT Security Managers
Finally a measure that produces changed behaviour rather than just completion rates. Combinable with phishing simulation as a before-and-after measurement.
Management & Leaders
Sets a visible signal: information security is not an IT topic, it is corporate culture. Also suitable as an entry point for management workshops.
All Employees
From reception to accounting - no technical prerequisites required. The format is designed so that every person can join immediately.
New Joiners
Ideal as part of onboarding: security rules not as a document but as an experienced team event - building the right foundation from day one.
Critical Infrastructure & Regulated Industries
For organisations under NIS2, GDPR or ISO 27001: a verifiable, documentable awareness format for your compliance evidence.
References
Successful Awareness Projects
These case studies are available in German.
Why AWARE7 for Security Awareness
What sets us apart from other providers
Pure awareness platforms don't test systems. Pure consulting firms are too far removed. AWARE7 combines both: we hack your infrastructure and train your employees: tailored to mid-sized companies, personal, without enterprise overhead.
Research and teaching as our foundation
20 %Around 20% of our revenue comes from research projects for the BSI and the BMBF. Our studies, published at ACM and Springer conferences, analyse millions of websites and tens of thousands of phishing emails. Three of our executives are professors at German universities at the same time.
Digital sovereignty: no compromises
100 %From first contact to final report, your data is stored on our own servers in Germany - no US cloud providers, no third-country transfers. Our AI also runs on our own hardware in Germany - with locally operated open-source models. Client and project data never reach external AI services. All staff are permanently employed, covered by social insurance and bound by uniform legal obligations.
More on digital sovereigntyFixed price within 24h: predictable project timelines
24 hWithin 24 hours you receive a binding fixed-price quote without hourly rate risk. A well-practised team and standardised processes ensure a clear schedule with a defined start and end date.
Your dedicated contact
1:1A personal project manager accompanies you from the first meeting to the retest. You book appointments directly with your contact person and keep the same contact throughout the project.
Peer-reviewed publications
Different Seas, Different Phishes - Large-Scale Analysis of Phishing Simulations
ACM AsiaCCS 2025
Oskar Braun, Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
A Platform for Physiological and Behavioral Security
NSPW 2025
Jan Hörnemann
Privacy from 5 PM to 6 AM: Tracking and Transparency in the HbbTV Ecosystem
IEEE/IFIP DSN 2025
Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
Understanding Regional Filter Lists: Efficacy and Impact
PoPETS 2025
Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
Who is AWARE7 the right partner for?
Mid-sized companies with 50-2,000 employees
Companies that need real security, without paying for a DAX-corporation provider. Fixed price, clear scope, one point of contact.
IT managers & CISOs
Who have to argue convincingly in-house and need a report in boardroom language for that, not just technical findings.
Regulated industries
Critical infrastructure, healthcare, financial services: NIS-2, ISO 27001, DORA. We know the requirements and deliver evidence that auditors accept.
Next Steps
Embedding awareness for the long term
The Escape Desk is a powerful starting point. For lasting behavioural change we recommend these complementary measures:
Live Hacking Show
Experience threats live - for a larger audience. Ideal before or after the Escape Desk as a kick-off for your awareness programme.
Book Live Hacking Show →Phishing Simulation
Measure the impact of the Escape Desk with realistic phishing campaigns - as a before-and-after comparison or continuous programme.
Learn about Phishing Simulation →Security Training
For teams who want to go deeper: certified training courses on IT security fundamentals, security awareness and penetration testing.
View training calendar →Benefits & ROI
What the Escape Desk delivers for your organisation
Security awareness is not a compliance obligation - it is an investment. The Escape Desk delivers measurable results that you can demonstrate internally and to auditors.
- Demonstrable reduction in risk from phishing and social engineering
- Reduced liability exposure from data breaches through documented awareness measures
- Strong signal to employees: security is corporate culture, not an IT task
- Positive external perception for customers, partners and investors
- Measurable reduction in phishing click rate in subsequent simulations
- Documented evidence for ISO 27001, NIST CSF and NIS2 audits
- Increased reporting rate of suspicious incidents by sensitised employees
- Greater effectiveness of technical controls through informed users
- High acceptance: employees actively recommend the format
- Team-building side effect: cross-departmental collaboration is promoted
- Ideal for onboarding: new employees learn security culture from the start
- Positive ratings in internal employee feedback and employer branding
- No separate training room or external venue required
- Less time: 60 minutes instead of a half-day training block
- Up to five times higher retention rate compared to passive e-learning
- Scalable: same quality for 10 or 500 participants
Compliance & Evidence
Every session is audit-ready documentation
The Escape Desk does not just deliver impact - it delivers the evidence too. After each session you receive all documents you need for your next audit.
All documents are provided in digital form. On request we also provide a summary in English - for internationally oriented organisations or group audits.
Certificates of Participation
Individual certificates for each participant with date, topic and scope of the measure - ready for personnel files and audit documentation.
Process Documentation
Detailed execution report with scenario description, learning content and debriefing summary - suitable as an appendix for ISO 27001 and NIS2 audits.
Participant Handout
Structured take-away with the key insights, recommended actions and further resources - for all participants to take home.
Organisations that trust AWARE7
Your Moderators
Our awareness experts moderate the Escape Desk and ensure maximum learning impact.
Managing Director of AWARE7 GmbH with many years of expertise in information security, penetration testing and IT risk management. Graduate of the Internet Security master's program at Westfälische Hochschule (if(is), Prof. Norbert Pohlmann). Bestselling author with Wiley-VCH and lecturer at the ASW-Akademie. His assessments of cybersecurity and digital sovereignty have appeared in Welt am Sonntag, WDR, Deutschlandfunk and Handelsblatt, among others.
IT-Grundschutz-Praktiker (TÜV) IT Risk Manager (DGI) § 8a BSIG Prüfverfahrenskompetenz Ausbilderprüfung (IHK) T.I.S.P. Board-Mitglied
M.Sc. in Internet Security (if(is), Westfälische Hochschule). COO and authorized officer (Prokurist) with expertise in information security consulting and security awareness. Junior professor (Nachwuchsprofessur) for Cyber Security at FOM Hochschule, CISO lecturer at isits AG and doctoral candidate at the Graduierteninstitut NRW.
ISO 27001 Lead Auditor (PECB/TÜV) T.I.S.P. (TeleTrusT) ITIL 4 (PeopleCert) BSI IT-Grundschutz-Praktiker (DGI) Ext. ISB (TÜV) BSI CyberRisikoCheck CEH (EC-Council)
Frequently Asked Questions
Your questions about the Escape Desk
What exactly is the Escape Desk?
The Escape Desk is a desk-based, gamified awareness format. Teams of 3 to 5 people solve real security scenarios directly at their desks within 60 minutes - no escape room, no complex technology. The format combines the excitement of an escape room with practical information security content.
How does the Escape Desk differ from traditional training?
Classic e-learning and classroom training conveys knowledge passively - the Escape Desk actively engages teams. Collaboratively solving puzzles creates emotional anchor points that demonstrably improve retention. Studies show that actively experienced content stays in memory up to five times longer than passively consumed information.
How many people can participate at the same time?
Each Escape Desk set accommodates 3 to 5 people. For larger groups we provide multiple sets that are played in parallel. Teams can compete against each other - an internal competition further boosts motivation. We have run events with over 100 simultaneous participants.
Can the format also be run remotely or in a hybrid setting?
Yes. The digital version of the Escape Desk runs via a browser-based tool - no installation, no technical barriers. Participants receive an access link and play together via video conference. Moderation is provided by our experts, just as in the on-site format.
Which scenarios are available?
We offer over 12 scenarios on topics such as phishing, social engineering, password security, clean desk policy, USB security and data protection. On request we develop industry-specific or company-specific scenarios - for example incorporating your own internal policies or real attack patterns from your sector.
Do I need any special technical equipment?
No. For the on-site version a normal desk and the materials we deliver in advance are sufficient. For the remote version participants only need a computer with an internet connection and a video conferencing tool. We conduct a brief technical check in advance.
Can the Escape Desk be tailored to our industry or internal policies?
Yes. On request we develop company-specific scenarios that reflect your own security policies, your industry context or current attack patterns from your risk landscape. We recommend this customised version in particular for critical infrastructure operators, banks, healthcare organisations and public authorities. Developing a bespoke scenario typically takes two to three weeks.
Is the Escape Desk suitable for use as mandatory training under ISO 27001 or NIS2?
Yes. The Escape Desk is a verifiable, documentable awareness format that is recognised as part of an ISMS-compliant training programme. After each session we provide you with a certificate of participation and process documentation that you can use for your next audit. This satisfies the requirements of ISO/IEC 27001:2022, NIST CSF and NIS2 for documented employee security awareness.
How quickly can I book the Escape Desk and how much lead time do I need?
For standard scenarios we can typically offer a date within two weeks. For customised scenarios we recommend a lead time of four to six weeks. You will receive a quote and date confirmation within 24 hours of your enquiry. For large events with more than 50 simultaneous participants please allow three to four weeks.
Aus dem Blog
Weiterführende Artikel
Security Awareness
Phishing erkennen: Checkliste für Mitarbeiter (2026)
Phishing erkennen: Checkliste mit Erkennungsmerkmalen für E-Mail-Phishing, Smishing und Vishing - mit Sofortmaßnahmen nach dem Klick.
Oskar Braun Weiterlesen
Security Awareness
Security Awareness messen: Klickraten, Wissenstests und Metriken
Security Awareness messen: Phishing-Klickraten richtig interpretieren, Verhaltensmetriken, Wissenstests und ROI-Argumente für den Vorstand.
Oskar Braun Weiterlesen
Security Awareness
Was kostet ein Live Hacking? Preise und Pakete im Überblick
Ein Live Hacking ist eine gute Möglichkeit, Mitarbeiter zu sensibilisieren - doch was kostet ein Live Hacking?
Chris Wojzechowski Weiterlesen
Make security awareness an experience that lasts.
Tell us briefly about your team and the occasion - we recommend the right scenario and create an individual quote within 24 hours. Free and non-binding.
Free · 30 minutes · No obligation
