Security awareness training for SMEs · training free, dashboard from €490 / year
NISG 2026: training obligation for management (§ 31) →

Security awareness & NIS2 training for SMEsYour team learns to recognise attacks.

Try it yourself first, then send it to your team. Two trainings, separately or combined, depending on what your company needs. Free for your employees, with certificate, no contract.

Security awareness training
For all employees

Recognise phishing and other attacks in everyday work. Part 1 and 2, with exercises.

Learn more →
NIS2 training
For companies under NIS2

For companies in scope of NIS2: one training for employees, one for management.

Learn more →
Try the training for free → See the sample dashboard →
Login by email code
No contract
Data in Frankfurt (EU)
For companies · from €490 / year

One dashboard with audit report for both trainings: who is trained, who is still missing, and the evidence for any reference date. Questions or orders: use the request form or email hello@webguardiola.com

Sample question · names invented

Not every phishing email is as easy as “check the sender and hover over the link”.

Inbox
RE: Invoice 2026-1187 – new bank details
Sabine Berger <buchhaltung@almtaler-kartonagen.at>
To: accounts@your-company.at · Today, 08:12
PDFInvoice_2026-1187.pdf84 KB

Good morning,

please find invoice 2026-1187 attached once more. Please note: we have changed banks. From now on, please transfer to our new account:

IBAN AT00 0000 0000 0000 0000

The invoice is due by Friday. Thanks and kind regards

Sabine Berger
Accounts · Almtaler Kartonagen GmbH
Tel. +43 000 000 00 00

On 12 Sep 2026, accounts@your-company.at wrote:
> Thanks, invoice 2026-1187 has arrived and will be paid on time.
Suited for Security awarenessISO 27001NISG 2026 / NIS2Customers & supply chainCyber insurance
Training content

Four trainings. Certificate. Free for everyone.

Interactive, with comic heroes, games and quizzes, so your team actually finishes. Runs on PC and smartphone, including for production, warehouse and field staff.

Screenshot from part 1 of the Webguardiola training: passwords, phishing and social media
Security awareness · Part 1

Foundations

Passwords · phishing & social engineering · social media & vishing. With an exercise: sort real and fake emails.

Screenshot from part 2 of the Webguardiola training: clean desk, mobile working, physical access and AI
Security awareness · Part 2

Safe everyday work

Clean desk · mobile working · physical access · AI & shadow IT.

Preview of the NIS2 Essentials training for all employees
NIS2 Essentials · all employees

NIS2 in daily work

Scope, minimum measures, incident reporting deadlines, supply chain, your own role. About 15 minutes, final quiz with 80 % pass mark.

Preview of the NIS2 training for management bodies
NIS2 Top Management · § 31 NISG

For management

Duties, liability, risk management, reporting obligations, supervision. 20–30 minutes, 10 questions, 80 % to pass. More on the management training →

Try the training for free → Login by email code, no contract
How it works

Try it yourself today, then invite your team.

Your team does not have to wait for a contract. Trainings completed before activation show up in the dashboard. Nobody has to repeat anything.

Step 1 · free

Try it yourself

Sign in with your email at training.webguardiola.com, confirm the code and look at a training. No setup.

Step 2 · free

Send the link to your team

Everyone signs in with their company email, login by code, no password. Everyone downloads their own certificate.

Step 3 · from €490

Activate the dashboard

Send us a short email and you receive the invoice. After payment we activate your dashboard for your email domain within one business day.

Step 4 · ongoing

Track and prove

Upload your employee list, remind open people, download the audit report for any reference date and pass it on.

The dashboard

Who is trained, who is missing, and the evidence for your audit.

Upload your employee list and see for each person which trainings are completed and which are still open. Download the audit report as a PDF for any reference date, for your auditor, customers or insurer.

Sample dashboard · fictitious Muster GmbH
Training evidence
Muster GmbH
Reference date 21 Sep 2026Employee list 48 people
Security Awareness Part 1
85 %
41 of 48 · 7 open
80 % target met
Security Awareness Part 2
69 %
33 of 48 · 15 open
below 80 % target
NIS2 Essentials
58 %
28 of 48 · 20 open
below 80 % target
NIS2 Top Management
2
managing directors trained
§ 31 NISG
Who has completed which training?
EmployeePart 1Part 2NIS2 EssentialsNIS2 Top Mgmt.
a.huber@muster-gmbh.at✓ 3 Sep 2026✓ 10 Sep 2026✓ 12 Sep 2026✓ 15 Sep 2026
m.gruber@muster-gmbh.at✓ 4 Sep 2026✓ 11 Sep 2026✓ 14 Sep 2026–
s.wagner@muster-gmbh.at✓ 4 Sep 2026open✓ 16 Sep 2026–
t.bauer@muster-gmbh.at✓ 5 Sep 2026✓ 12 Sep 2026open–
l.mayr@muster-gmbh.atopenopenopen–
k.pichler@muster-gmbh.at✓ 8 Sep 2026✓ 15 Sep 2026✓ 17 Sep 2026✓ 18 Sep 2026
j.moser@muster-gmbh.at✓ 9 Sep 2026openopen–
e.steiner@muster-gmbh.at✓ 10 Sep 2026✓ 17 Sep 2026✓ 19 Sep 2026–

Excerpt: 8 of 48 people. NIS2 Top Management applies to management only. The full list is available as CSV.

Audit report (PDF): dated evidence with report ID and checksum, for ISO 27001 and NIS2 audits, customers, suppliers or your cyber insurer.

Sample report (no personal data)Full version (with email addresses)CSV export
Also in the dashboard after purchase: knowledge before and after the training, self-assessment compared with results, phishing recognition from the exercise and an assessment with next steps. These figures appear only aggregated, from 5 people.

All figures are sample data of the fictitious "Muster GmbH". The sample files (PDF, CSV) are in German. The short version of the report contains no personal data and can be passed on directly.

Why not just collect certificates?

A certificate proves one person. The dashboard proves your company.

Everyone gets their certificate for free. With 30, 80 or 200 employees, though, collecting them quickly turns into a spreadsheet that is never up to date. And no certificate shows whether the training made a difference.

Free certificate
Dashboard & audit report
What it proves
One individual
Your entire employee list
Who is missing
Ask around and reconcile yourself
Open people live, filterable, as CSV
Knowledge before and after
Not visible
Knowledge and self-assessment before and after
Management (§ 31)
Individual certificate
Dedicated evidence in the report
For auditors and customers
Individual PDFs
One report per reference date, with report ID and checksum
Price
€0
from €490 per year
Pricing

Dashboard & audit report at a fixed price.

One annual price by company size, no per-seat pricing, no custom quotes. The trainings themselves stay free for everyone.

Package S · up to 25 employees
€490 / year

net · from €19.60 per person

Request package S →
Package M · up to 50 employees
€790 / year

net · from €15.80 per person

Request package M →
Package L · up to 100 employees
€1,490 / year

net · from €14.90 per person

Request package L →
Package XL · up to 250 employees
€2,990 / year

net · from €11.96 per person

Request package XL →

One package covers both trainings, security awareness and NIS2. What counts is the number of people on your employee list in the dashboard. Prices plus VAT where applicable.

Included in every package
  • Company dashboard for your email domain(s)
  • Maintain the employee list via Excel or manually
  • Completion status, open people, CSV export
  • Knowledge and self-assessment before and after training
  • Phishing recognition compared with the platform average
  • Audit report as PDF, with and without personal data
What the year brings
  • Add new employees to the list, their status appears automatically
  • Create a new report for any reference date, e.g. before an audit or a customer request
  • Content is updated continuously for new attack methods
  • Annual refresher, as audits usually expect

More than 250 employees or your own LMS (SCORM)? Write to us.

NISG 2026: am I in scope, and by when?

1 Oct 2026 entry into force, management training duty applies immediately · 31 Dec 2026 registration (§ 29) · 30 Sep 2027 self-declaration (§ 33).

Directly in scope are medium-sized and larger companies in 18 sectors (at least 50 employees, or more than €10m turnover and balance sheet total). Their suppliers and service providers are affected indirectly. In Germany NIS2 applies through the BSI Act, with a training duty for management (§ 38 BSIG). Overview without guarantee, not legal advice. More on NIS2 training →

About us

Built from research and practice.

Webguardiola is a company based in Upper Austria, founded by Fabian Hable. As a doctoral researcher at Vrije Universiteit Amsterdam he studies why people fall for phishing, and his day job is in security awareness in industry.

We develop the trainings ourselves. The before-and-after measurement in the dashboard comes straight from this research: most people overestimate how well they recognise attacks. The training makes this gap visible, and the measurement shows how it changes. We answer questions personally, no hotline.

Founder: Fabian HableDoctoral research on phishingSecurity awareness in practiceWebguardiola FlexCo · Upper Austria
FAQ

Frequently asked questions

Yes. All trainings including NIS2 and a personal certificate are free for everyone, privately or at work. Sign up, enter the code from the email, start. Companies only pay for the dashboard with audit report.
You can, and with a few people that is often enough. The dashboard saves you collecting and reconciling: you see live who on your employee list has finished and who hasn't, and you get one report per reference date instead of many single files. Plus what no certificate shows: how well your team was prepared and how it progressed through the training.
Yes. Once the dashboard is activated and your employee list is uploaded, trainings these people already completed appear. Nobody has to repeat anything.
The trainings support you with the training duties: training for employees as part of the risk management measures (§ 32) and the dedicated training for management (§ 31). The report documents who completed which training and when. Whether your training concept is sufficient overall is for your auditor or the authority to assess. Risk analysis, reporting processes or backups remain your company's own tasks.
Only the completion status (completed or open) for people on your uploaded list. Answers, knowledge and self-assessment are shown only aggregated, and only from 5 people. Data is stored in Frankfurt.
The dashboard keeps running: add new employees to the list and create the report for each new reference date, e.g. before the next audit. We update the content continuously for new attack methods. Audits usually expect an annual refresher, and the dashboard shows who has done it.
Often yes, through your customers. Companies in scope must ensure the security of their supply chain and ask suppliers whether their staff are trained. You can pass on the short version of the report without personal data. The NIS2 trainings can be hidden in the dashboard.
NIS2 Essentials takes about 15 minutes, NIS2 Top Management 20 to 30 minutes. Security Awareness Basics is split into short modules that can be paused at any time. Everything runs in the browser, including on smartphones.
The training runs fully on a smartphone, and login works with a code sent to the email address. For employees without a company email address we find a solution together when activating.
In Germany NIS2 is implemented through the BSI Act, and management must attend training regularly (§ 38 BSIG). The NIS2 trainings cover the EU directive; examples currently refer to Austria. NIS2 does not apply in Switzerland; there you mainly need the evidence for EU customers and ISO 27001.
Yes, as a SCORM 1.2 package, for example for SAP SuccessFactors or Moodle, on request. More on SCORM.
No. We don't test anyone secretly. No data on employee clicks is collected. Everyone practices recognizing phishing directly in the training, including a phishing recognition exercise.

For companies

Request dashboard & evidence

See at a glance who is done, who is still open – and what to show auditors. The training stays free for your employees.

  • Free and without obligation
  • We usually reply within 2 business days
  • Security awareness, NIS2 – or both

Please enter your company.

Please enter a valid email address.

Please choose a package or ‘Not sure yet’.

Interested in

Please choose an option.

We only use your details to handle your request and send you a confirmation of receipt. See our privacy policy.

Security Awareness · Newsletter

Understand threats before they reach your team.

Concise updates on current phishing tactics, awareness practice and new modules. No spam, unsubscribe anytime.