Do your phishing tests only measure clicks, or also whether and how quickly an attack is reported?
A security awareness test reveals whether employees notice and report phishing attempts and unauthorized individuals in the building, and whether the report reaches the responsible department. We use standardized phishing emails that replicate the T1566 technique from MITRE ATT&CK, and on-site scenarios, evaluated based on click-through, input, and reporting rates. The time until the first report and until it is processed is measured.
Whether someone clicks on a link is only half the story. For defense, what matters is whether an attack is reported and how quickly the report arrives. Those required to provide proof of NIS2 cybersecurity training can demonstrate its effectiveness with a metric such as the reporting rate.
We review reporting channels and escalation chains for phishing and unauthorized access. Handling a genuine security incident, such as forensic investigations, is not part of our work. In these cases, what matters is not how far an attacker gets, but whether someone notices them and whether the report triggers any action. The extent of an attacker's progress is determined by their performance. Social Engineering & Phishing.
Standardized emails without personalization measure the baseline: clicks, entries, and messages serve as a reliable benchmark.
We record how many employees report an attack, via which channel, and how quickly.
An unauthorized person is moving around the building. We are observing whether reception, staff, and managers notice, speak to, or report them.
We monitor whether reports reach the responsible authority, are processed there, and trigger the desired responses.
A security awareness test uses standardized phishing emails and on-site scenarios to measure whether employees report an attack and how the report reaches the responsible department. It is intended for companies that want to document their awareness measures and reporting channels. Social engineering and other techniques demonstrate how far a targeted attacker can get. Physical infiltrationA later repetition makes progress visible; if necessary, a realistic campaign follows.
We define scenarios, target groups, locations and time windows and coordinate the test with management, data protection and the works council.
We conduct the phishing campaign, the on-site test, or both in a controlled manner, with an escalation contact person available at all times.
We analyze aggregated data: key figures on clicks, reports and response times, without exposing any individuals.
We will discuss the results with you and provide specific recommendations on reporting channels, escalation, and awareness measures.
First, the results from the phishing campaign and on-site test, then the overall picture presented in key performance indicators, followed by recommendations and an action plan, and, upon request, documentation for third parties. A management summary is not included in this individual review.
Click, input and report rates from the phishing campaign and the documented reactions to unauthorized on-site presence, each with time and reporting method.
Aggregated key figures as a reliable baseline, without exposing individuals, as a basis for awareness measures in the specialist departments.
Specific improvements to reporting channels, responsibilities and escalation, and the appropriate time for repeat measurements.
Confirmation of the completed awareness test, without disclosing individuals or details. For ISMS audits and your cyber insurance.
"Thank you very much for your support in making our IT more secure and raising awareness among our employees about the risks of different cyberattack possibilities!"
Wolfgang Schlags, owner, Reichskronen-Apotheke Dr. Schlags
This test measures detection and reporting using standardized scenarios. It deliberately does not show how far a targeted attacker can get. That is what the following tests provide.
Once the baseline is established and you want to know how far a personalized campaign will go, Social Engineering & Phishing comes into play.
Regarding the performanceThis can be combined as soon as the effectiveness of your access controls is just as important as your reaction to strangers.
Regarding the performanceWhen reports arrive at the security team, the Purple Team exercise shows whether the technical traces of the attack are also detected there.
Regarding the performanceBriefly describe what it's about. We'll work out the details with you during the scoping process. For the consultation, we need...
You don't need to prepare; we'll guide you expertly step by step. Based on your business processes and IT systems, we'll work together to determine the right testing concept.
These are the questions we most frequently receive regarding this service. We'd be happy to clarify anything that's missing in a personal consultation.
No. The evaluation is aggregated. Because phishing tools can link data to individual people, we coordinate the test in advance with the works council or staff council and data protection officer. We summarize reactions on-site, for example at reception, according to function.
If you have a works council, it should generally be involved beforehand. Tests that record employee behavior may be subject to co-determination under Section 87 Paragraph 1 No. 6 of the German Works Constitution Act (BetrVG). An aggregated evaluation does not preclude this if the tool can attribute the data to individual persons. We describe the process, data collected, and evaluation in such a way that the works council and data protection officer can review them in advance.
Typically, up to eight hours of active testing time. We will agree on the duration of a phishing campaign during the scoping phase.
No. The phishing simulation under Social Engineering & Phishing uses realistic, even personalized campaigns to demonstrate how far an attacker can get by manipulating human behavior. The security awareness test uses standardized emails without personalization and primarily measures whether reports are filed and how quickly those reports are processed. This provides a comparable baseline for your awareness measures.
A follow-up assessment is advisable once measures regarding reporting channels or training have been implemented. Only a comparison with the baseline will reveal whether any changes have occurred. We will determine the interval during the scoping phase, tailored to your specific measures.
We only collect what is necessary for aggregated analysis: clicks, entries, reports, and timestamps. We will coordinate the scope of logging, handling of entries, and deletion periods with you, your data protection officer, and, if necessary, the works council in advance.
No, otherwise the reaction couldn't be measured. Only a small group of people, designated by you, are privy to this information and can intervene in an emergency. The test subject carries written authorization confirming their assignment.
No. The check verifies whether an attack is detected, reported, and processed by the responsible authority – that is, the reporting process up to the first response. Managing a genuine security incident, including forensics and recovery, is not part of the scope.
