Free security awareness training for your whole team

Why it works

Everyone knows what phishing is. People still click.

Clicks rarely happen out of ignorance. Whether someone falls for an email depends on overconfidence, a fitting context, distraction and time pressure. That is where the trainings start. The method comes from our founder's doctoral research on phishing susceptibility.

Overconfidence

"I would never fall for that." People who feel safe stop checking. The trainings measure this gap before and after learning and make it visible.

Fitting context

The invoice in accounting, the parcel notice in shipping: phishing works when it fits into daily work. So the trainings practise with real situations rather than checklists.

Distraction

Most clicks happen on the side, between two meetings, on the phone. Storytelling and repetition anchor the right behaviour so it works on autopilot too.

Time pressure

Under stress the brain takes shortcuts. Attackers exploit this with artificial urgency. The trainings show how to recognise it, even when things have to go fast.

The trainings

7 modules. Certificate. Free for everyone.

Short, interactive episodes with comic characters, games and quizzes, so your team enjoys finishing. Before and after each part there is a short knowledge check that shows what stuck.

Screenshot from part 1 of the Webguardiola training: passwords, phishing and social media

Part 1 · Foundations

Recognise the most common attacks

Passwords: strong passwords and password managers
Phishing & social engineering: spot fake emails, with an exercise on 6 real and fake emails
Social media & vishing: calls from fake colleagues and what is better not shared online

Screenshot from part 2 of the Webguardiola training: clean desk, mobile working, physical access and AI

Part 2 · Safe everyday work

Beyond the inbox

Clean desk: documents, screen and credentials at the workplace
Mobile working: on the road and in the home office
Physical access: strangers in the building
AI & shadow IT: using AI tools and unapproved apps safely

For companies in scope of NISG 2026 there are two additional NIS2 trainings, also free.

Start free now →

Reaching everyone

Security doesn't end at the desk.

Many trainings only reach the office. Attackers make no such distinction.

Production, warehouse, field staff

Employees without a company laptop often drop out of classic trainings. These trainings run entirely on a smartphone, and login works with a code sent to the email address.

Mobile-friendlyNo company laptop needed

Suppliers, partners, family

Because the trainings are free for everyone, you can pass them on to partner SMEs without their own security budget, or to your family. Security doesn't stop at the employment contract.

Free for everyoneSupply chain

For companies

The training is free. The overview starts at €490.

With the company dashboard you see who on your employee list has completed the training, how well your team was prepared and how it progressed. For audits and customers you download the report as PDF.

Sample dashboard · fictitious Muster GmbH

Knowledge and self-assessment before and after the training

Part 1Part 2

How it is measured: Before the training content, employees answer 9 multiple-choice questions (4 answers, one correct) and rate for each question how confident they feel (1 = very unsure, 7 = very sure). After the content come 9 different questions on the same material, again with a confidence rating.
Why: Most people overestimate how well they recognise attacks. The training aims to help employees better assess their own knowledge gaps and uncertainties. Webguardiola studies this approach in its own research. What is measured is knowledge and self-assessment, not behaviour in daily work. Aggregated only, from 5 people.

before trainingafter trainingPlatform average

Self-assessment vs. knowledge

Before training

76 % felt confident
58 % were correct

Overconfidence: 18 percentage points

After training

85 % felt confident
81 % were correct

Overconfidence: 4 percentage points

What this means: Before the training your employees felt 76 % confident but answered only 58 % of the questions correctly. After the training, feeling and knowledge match (85 % vs. 81 %). Platform average after training: 3 percentage points overconfidence.

Part 1: passwords, phishing, social media & vishing. n = 39 people who answered the pre- and post-survey. Felt confidence: scale 1–7, converted to 25–100 %, because 25 % equals the chance of guessing with 4 answer options.

Assessment for Muster GmbH

derived automatically from the figures · as of 21 Sep 2026

Part 1 is at 85 %: the foundation is in place. 7 people are still missing. A short reminder from their manager is usually enough.
Part 2 is at 69 %, 15 people open. Part 2 builds on part 1 (clean desk, mobile working, AI & apps). Recommendation: plan it as a goal for the next 4 weeks.
After the training, self-assessment and knowledge match (4 percentage points). Before the training, overconfidence was 18 percentage points. The results show how test scores and self-assessment change between the pre- and post-survey. Actual behaviour in daily work is not measured.
Only 67 % of genuine emails are recognised as genuine. Part of the workforce reports everything when in doubt. That is better than clicking, but it costs time. Tip: show 2–3 features of genuine emails in the next team meeting (known sender, expected context, no time pressure).
81 % of phishing emails are recognised, platform average 78 %. Good value. To keep it: once a quarter, discuss a real phishing email the company received, anonymised, in the team.
NIS2 Essentials is at 58 %. For companies in scope of NISG, training all employees is part of the risk management measures (§ 32). Recommendation: complete before the self-declaration.
2 members of management have completed NIS2 Top Management. Please check: does this cover all managing directors or board members? § 31 NISG 2026 obliges every member of the management body personally.

Completion rate per training, based on your employee list, with date and certificate ID per person
List of open people, filterable and as CSV, so you can send targeted reminders
Starting point and progress: knowledge and self-assessment before and after training
Phishing recognition from the exercise, compared with the platform average
Management under § 31 NISG 2026: who completed the dedicated training
Assessment with next steps, derived automatically from your figures

Sample audit report (PDF, German) → Full version with name list (PDF, German) → CSV export (German) ↓

The report is dated, carries a report ID and SHA-256 checksum and maps the content to NISG 2026 and ISO/IEC 27001:2022. The short version contains no personal data and can be passed on directly. All figures, including the platform average, are sample data of the fictitious "Muster GmbH". The sample files (PDF, CSV) are in German. Knowledge and self-assessment appear only aggregated, from 5 people.

Why not just collect certificates?

A certificate proves one person. The dashboard proves your company.

Everyone gets their certificate for free. With 30, 80 or 200 employees, though, collecting them quickly turns into a spreadsheet that is never up to date. And no certificate shows whether the training made a difference.

Free certificate

Dashboard & audit report

What it proves

One individual

Your entire employee list

Who is missing

Ask around and reconcile yourself

Open people live, filterable, as CSV

Knowledge before and after

Not visible

Knowledge and self-assessment before and after

Management (§ 31)

Individual certificate

Dedicated evidence in the report

For auditors and customers

Individual PDFs

One report per reference date, with report ID and checksum

Price

€0

from €490 per year

Pricing

Dashboard & audit report at a fixed price.

One annual price by company size, no per-seat pricing, no custom quotes. The trainings themselves stay free for everyone.

Package S · up to 25 employees

€490 / year

net · from €19.60 per person

Request package S →

Package M · up to 50 employees

€790 / year

net · from €15.80 per person

Request package M →

Package L · up to 100 employees

€1,490 / year

net · from €14.90 per person

Request package L →

Package XL · up to 250 employees

€2,990 / year

net · from €11.96 per person

Request package XL →

What counts is the number of people on your employee list in the dashboard. Prices plus VAT where applicable.

Included in every package

Company dashboard for your email domain(s)
Maintain the employee list via Excel or manually
Completion status, open people, CSV export
Knowledge and self-assessment before and after training
Phishing recognition compared with the platform average
Audit report as PDF, with and without personal data

What the year brings

Add new employees to the list, their status appears automatically
Create a new report for any reference date, e.g. before an audit or a customer request
Content is updated continuously for new attack methods
Annual refresher, as audits usually expect

More than 250 employees or your own LMS (SCORM)? Write to us.

FAQ

Frequently asked questions

Yes. All trainings including NIS2 and a personal certificate are free for everyone, privately or at work. Sign up, enter the code from the email, start. Companies only pay for the dashboard with audit report.

Part 1 covers passwords, phishing and social engineering as well as social media and vishing, with an exercise on real and fake emails. Part 2 covers clean desk, mobile working, physical access as well as AI and shadow IT. Before and after each part there is a short knowledge check.

You can, and with a few people that is often enough. The dashboard saves you collecting and reconciling: you see live who on your employee list has finished and who hasn't, and you get one report per reference date instead of many single files. Plus what no certificate shows: how well your team was prepared and how it progressed through the training.

NIS2 Essentials takes about 15 minutes, NIS2 Top Management 20 to 30 minutes. Security Awareness Basics is split into short modules that can be paused at any time. Everything runs in the browser, including on smartphones.

The training runs fully on a smartphone, and login works with a code sent to the email address. For employees without a company email address we find a solution together when activating.

Only the completion status (completed or open) for people on your uploaded list. Answers, knowledge and self-assessment are shown only aggregated, and only from 5 people. Data is stored in Frankfurt.

No. We don't test anyone secretly. No data on employee clicks is collected. Everyone practices recognizing phishing directly in the training, including a phishing recognition exercise.

Yes, as a SCORM 1.2 package, for example for SAP SuccessFactors or Moodle, on request. More on SCORM.

For companies

Request dashboard & evidence

See at a glance who is done, who is still open – and what to show auditors. The training stays free for your employees.

Free and without obligation
We usually reply within 2 business days
Security awareness, NIS2 – or both

Name (optional)

Company

Please enter your company.

Business email

Please enter a valid email address.

Package / company size

Please choose a package or ‘Not sure yet’.

Interested in Security awareness NIS2 training Both Not sure yet

Please choose an option.

Message (optional)

We only use your details to handle your request and send you a confirmation of receipt. See our privacy policy.

Everyone knows what phishing is. People still click.

Overconfidence

Fitting context

Distraction

Time pressure

7 modules. Certificate. Free for everyone.

Recognise the most common attacks

Beyond the inbox

Security doesn't end at the desk.

Production, warehouse, field staff

Suppliers, partners, family

The training is free. The overview starts at €490.

A certificate proves one person. The dashboard proves your company.

Dashboard & audit report at a fixed price.

Frequently asked questions

Request dashboard & evidence

Understand threats before they reach your team.