Technology stopsmost of it.Your team the rest.
What gets through the filter is well made and meets a person under time pressure. Conbool Awareness rehearses exactly that situation: with simulations built from real attacks and lessons you play instead of read.
Why the annual session changes nothing
Four reasons knowledge alone does not protect.
Once a year is too rare
A session in January has faded by March. Attack patterns change faster than an annual rhythm can follow.
Knowing is not behaving
Almost everyone knows phishing exists. What counts is whether someone pauses at half past five on the thirtieth message of the day.
Without evidence it does not count
An auditor does not ask whether you trained, but with what, when and to what effect. A paper attendance list is thin for that.
Done wrong it damages trust
A simulation that exposes individuals creates resentment instead of attention. After that the topic is burned for years.
A programme, not a campaign
Practise, explain, repeat.
1. Choose the audience
You pick departments, groups or the whole company. Evaluation stays at group level, nobody is listed individually.
2. Simulation spread over time
Test messages go out staggered so they are not recognised as a campaign and announced between colleagues.
3. Training right afterwards
Anyone who reacted gets a one-minute move straight away and then the matching lesson as a playable episode. Bo, the owl, guides through it and explains every find.
Choose the audience
Departments or the whole company.
Simulation
Staggered over time so it does not stand out as a campaign.
Training
First a one-minute move, then the lesson as an episode with Bo.
Next round
The report shows the development over time.
I am Bo and I guide through every lesson: look, find, decide. The person is never judged.
Four steps that repeat.
A programme keeps running for months without anyone chasing it. That is exactly where the development comes from that an audit wants to see.
Set it up once and it keeps running
Audience adjustable per round
Training follows the reaction immediately
The report grows with every round
What the programme delivers
Six points that survive an audit.
Realistic simulations
Templates based on common techniques and, with the Conbool gateway, on attacks that actually reached your company.
Training you play
31 lessons in seven seasons and three levels. Each is a short episode from a working day: check a message, sort cases, decide.
Repetition across months
A running programme assigns everyone the next lesson at a fixed rhythm, refreshers keep it alive. Nobody has to trigger it each time.
Reports for the audit
Progress per department and period, exportable for internal review, certification and management.
Group level evaluation
No ranking of individual employees, which makes the agreement with the works council far easier.
Operated in Germany or on your premises
Either from German data centres or entirely inside your own environment.
Programme versus annual session
Same effort, very different effect.
With Conbool | Annual mandatory session | |
|---|---|---|
| Repetition spread across the year | yes | no |
| Everyday reaction is measurable | yes | no |
| Training targeted at the observed weakness | yes | generic for everyone |
| Evidence per period and department | yes | attendance list |
| Without exposing individuals | yes | depends on the tool |
The comparison describes the common practice of an annual mandatory briefing, not a specific competing product.
Frequently asked questions
Does NIS2 really require training?
Is a phishing simulation mandatory?
Are individual employees exposed?
Does the works council have to be involved?
How often should we simulate?
Does it work without the Conbool spam filter?
Related solutions
NIS2 im Überblick
Richtlinie, Umsetzungsgesetz und Pflichten: wer betroffen ist und was gilt.
Phishing-Simulation
Den Ernstfall üben, ohne Einzelne vorzuführen.
NIS2-Schulungspflicht
Was die Richtlinie für Beschäftigte und Geschäftsleitung konkret verlangt.
Phishing-Schutz
Die technische Abwehr, bevor eine Nachricht den Menschen erreicht.
NIS-2 E-Mail-Sicherheit
Alle E-Mail-Anforderungen aus Art. 21 NIS2 im Überblick.
Set up the first round together
We configure the programme with you and go through the results after the first round.