Fake login pages
A deceptively real sign-in page for email or cloud services is enough to steal a password and session – and with adversary-in-the-middle techniques, now even despite traditional MFA.
Security Services
Security Awareness Training & Phishing Simulation
Turning the human risk factor into a success factor
No firewall stops a call from a fake IT support agent. With security awareness training and realistic phishing simulations, we turn your employees into an alert line of defense – practical, measurable, and without blame.
- Fixed price after scoping
- Quote within 24 hours
- Anonymized reporting
Definition
What is security awareness?
Security awareness means that employees recognize attacks, respond correctly, and report suspicious incidents quickly. An effective security awareness training program combines three elements: knowledge from training sessions, practice in realistic phishing simulations, and a culture in which mistakes are addressed openly rather than hidden.
Social engineering attacks don’t target technical vulnerabilities but human behavior patterns: respect for authority, helpfulness, curiosity, or the tendency to act hastily under time pressure. No update can counter these levers – but a team can: one that knows the typical scams, asks questions when in doubt, and would rather report something once too often than once too rarely. This turns the supposed human risk factor into a success factor for your information security.
Why simulations? Knowledge alone doesn’t change behavior. Only practice under realistic conditions makes the right response routine – much like a fire drill. Phishing simulations show where your team stands today and make progress measurable over time.
For many organizations, training is also mandatory: the EU NIS2 Directive explicitly lists it as a risk-management measure and requires management bodies to take part themselves. ISO/IEC 27001:2022 requires awareness of information security in clause 7.3 and provides for awareness, education, and training with control A.6.3. The GDPR counts raising staff awareness among the tasks of the data protection officer (Art. 39), and DORA (the EU Digital Operational Resilience Act) requires financial entities to run ICT security awareness programs that apply to all employees.
Our approach
How we build your awareness program
It starts with an honest baseline: an initial phishing simulation and a look at past incidents show which scams work in your organization and how reliably suspicious incidents are reported. Building on this, we put together a program of campaigns, training sessions, and communication measures that fits your risks, your industry, and your corporate culture.
Our content comes from practice: in social engineering pentests, we experience which tricks actually work – and those are exactly the ones we show in training sessions and simulations. Instead of endless slide decks, we rely on live demos, real examples from everyday work, and short, recurring learning units that stick.
Typical risks
Where a lack of security awareness gets expensive
Invoice and CEO fraud
Fake payment instructions from senior management or “changed bank details” from suppliers lead to transfers into fraudsters’ accounts.
MFA fatigue
Push requests every minute until someone gets annoyed and taps “Approve” – or a caller who politely asks for the code currently displayed.
Malware via attachments
Supposed invoices, job applications, or delivery notes as Office documents or ZIP archives bring ransomware into the network.
Weak and reused passwords
Anyone who reuses a personal password at work risks exposing their company account as well after a data breach at an online service.
Insecure mobile working
Public Wi-Fi, overheard phone calls on the train, unlocked laptops when working from home, or unprotected personal devices.
Lack of a reporting culture
Anyone who fears consequences keeps quiet about a wrong click – and wastes the minutes in which IT could still stop an attack.
Everyday data protection mishaps
Personal data sent to the wrong distribution list or left lying on the printer can trigger notification obligations to the supervisory authority under Art. 33 GDPR.
Our training topics
- Recognizing phishing, spear phishing, and CEO fraud
- Strong passwords, password managers, and multi-factor authentication
- Social engineering by phone, text message, and in person
- Working securely from home and on the go
- Data protection in everyday work under the GDPR
- Handling USB drives, QR codes, and unknown attachments
- Ransomware and the right response in an emergency
- Clean desk and physical security in the office
- AI-powered scams such as deepfakes and voice clones
- Reporting channels: What to do after a wrong click?
Options to fit your needs
The right starting point for your organization
No rigid packages – the following options show typical starting points. During scoping, we put together the scope to fit your organization.
Getting started
Baseline assessment
A phishing simulation with analysis and a management briefing – ideal for understanding the status quo and setting priorities.
- Baseline measurement with a realistic scenario
- Anonymized analysis by department
- Recommendations for next steps
Ongoing
Awareness program
An annual program of recurring simulations, training sessions, and campaigns that makes progress measurable.
- Multiple campaigns with increasing difficulty
- On-site, online, and e-learning formats
- Regular reporting to management
Deep dive
Target group training
Specialized training for executives and particularly exposed roles, using real attack patterns from your industry.
- Management briefing on accountability and NIS2
- Workshops for accounting, HR, and service desk
- Optionally with targeted vishing exercises
Process
How your awareness program works
Lasting awareness takes planning, repetition, and a culture in which mistakes are reported rather than hidden – which is why we plan it as carefully as all our security services.
-
01
Initial consultation & scoping
We clarify goals, target groups, sites, languages, and previous measures. After scoping, you receive a fixed-price quote within 24 hours (on business days).
-
02
Alignment & approval
We define scenarios, schedule, and communication together. In coordination with you, we involve the works or staff council and your data protection officer early on and provide the necessary information. For the data processing, we conclude a data processing agreement with you under Art. 28 GDPR as standard.
-
03
Baseline measurement
An initial phishing campaign shows the starting point – without specific advance notice, but with transparent communication afterward.
-
04
Training & campaigns
On-site, online, and e-learning formats on the topics that the simulation has shown to be urgent.
-
05
Follow-up campaigns
Recurring simulations with changing scenarios make progress visible – especially in the reporting rate.
-
06
Reporting & adjustments
Anonymized analysis, a management report, and adaptation of the program to new scams.
Analysis
Metrics that show progress – not culprits
After each campaign, you receive an analysis that management, IT, and data protection can all understand. It shows which scenarios worked, how quickly suspicious incidents were reported, and which training content promises the greatest effect. We summarize results at the level of departments or sites; for small groups, we aggregate further so that no conclusions about individuals are possible.
- Executive summary showing the trend across all campaigns
- Click, submission, and reporting rates by scenario and department
- Time to the first report to IT or the security team
- Analysis of which warning signs were missed
- Concrete recommendations for training, processes, and technology
- Documentation of measures as evidence for auditors and supervisory authorities, for example for ISO/IEC 27001 or NIS2
Strengthen the human factor in your organization
Whether it’s a first phishing simulation or an ongoing awareness program – we advise you without obligation and prepare a fixed-price quote within 24 hours of scoping (on business days).
FAQ
Frequently asked questions about security awareness and phishing simulation
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
How does a phishing simulation differ from a social engineering pentest?
A phishing simulation is a training measure: through recurring campaigns, it measures and improves your workforce’s behavior. The social engineering pentest is a security assessment that shows whether a determined attacker could actually reach their goal via people, processes, and physical access – including phone and on-site scenarios. The two complement each other perfectly.
Are phishing simulations compatible with the GDPR and the works council?
Yes, if they are set up correctly. By default, we process only the necessary data, don’t store any entered passwords, and analyze results anonymously or in aggregate. Because employee behavior is recorded, the works council may have co-determination rights; the works or staff council and your data protection officer should therefore be involved from the start. We support you with all the necessary information – in practice, this often results in a works agreement or, in the public sector, a service agreement.
Are employees who fall for a simulation exposed?
No. Anyone who clicks immediately sees a short learning page with the warning signs they missed. By default, we don’t pass individual results on to supervisors. That way, the simulation remains a learning opportunity and doesn’t become a control instrument.
Which metric matters more: click rate or reporting rate?
The reporting rate. A click rate of zero is unrealistic – sooner or later, someone clicks. What matters is how quickly your team recognizes and reports an attack so that IT can respond. That’s why we measure both and show how they develop over time.
How often should phishing simulations take place?
Several campaigns per year have proven effective – for example, quarterly – with changing scenarios and difficulty levels. One-off campaigns quickly fizzle out; repetition makes the right response a habit. New employees should also receive training as early as onboarding.
Do you offer training on site or online?
Both. We deliver on-site training with live demos at your premises – in Germany and internationally. Online training is ideal for distributed teams and multiple sites, and short e-learning units keep knowledge fresh between sessions.
Do executives and managers have to take part as well?
Absolutely. Executives are the focus of many attacks, their identity is misused in CEO fraud – and they play a key role in shaping the security culture. The NIS2 Directive also explicitly requires the management bodies of entities in scope to take part in training. For this, we offer compact management briefings.
What determines the effort?
Mainly the number of employees and sites, the number of campaigns, the desired training formats and languages, and the degree of customization. After scoping, you receive a fixed-price quote – with no hidden costs for the agreed scope.
Related pages
Let’s talk about your awareness program
Give us a brief overview of your situation – number of employees, sites, and previous measures. We’ll get back to you with a proposal for the right starting point.