Not a package you buy.A programme we run.
The human risk factor is not a training task. It belongs in management. We take it on for you, with a named person in charge and with numbers that mean something.
A campaign has an end date. Your risk does not.
The market sells awareness in campaigns. A kick-off, a round of simulations, a training package, a final report. Then the budget is spent and the organisation returns to the state it was in before. What remains are activity figures.
Participation rates, completion rates, the click rate of the last round. These figures prove effort. They do not answer the question your executive management asks: are we safer than a year ago, and how do we know?
A click rate of 12 percent says little as long as it is unclear what kind of attack was measured against. The click rate mainly measures how difficult the test was.
Phishing at the service provider, training in the learning system, physical tests in the audit report, policies on the intranet. Nobody sees the whole picture.
Many organisations are solid on email and completely unprotected on calls, visitors and suppliers. Attackers know that.
Awareness is usually half a job for someone who actually does something else. Without a responsible person, a programme becomes a series of isolated measures.
Anyone who believes their organisation is secure without having tested it is mistaken. The question is not whether your organisation will be targeted, but when.
Not a package you buy. A programme we run.
Human Risk Management is our answer to the awareness campaign. We take on the human risk factor of your organisation as an ongoing task: with a dedicated Human Risk Manager, with services you assemble yourself, and with a measurement layer that shows whether the whole thing works.
One person in charge
You do not simply get portal access, you get a person with a name. They plan your programme, run it, evaluate it and are there for you.
Every attack vector
Email, phone, physical access and your critical processes. We measure where your risk sits, not where measuring is easiest.
Flexible across the year
Your needs change, and your programme changes with them. Support volume that is not needed flows into services you need instead.
Proven, not claimed
Every measure contributes to metrics that remain traceable down to the individual data point. For your reporting, for audits, for NIS2, DORA, ISO 27001 and TISAX.
A self-service licence, an e-learning catalogue or a dashboard that stays empty after three months. You do not have to fill in, configure or evaluate anything.
Reducing the click rate to zero is not an achievable goal.
Over a sufficiently long period, everyone clicks at some point, security professionals included. Accordingly, large independent studies of recent years show only small effects of classic awareness training on actual behaviour.
That is why we work with a different guiding question. It leads to a clear order of measures, and that order applies even when it means less business for us.
- Not:
- How do we prevent every click?
- But:
- How do we make sure a mistake has no consequences and is reported within minutes?
Technology
Technology that makes stolen credentials worthless is more effective than any training.
Process
Processes that catch a wrong decision are more effective than individual vigilance.
Training
Works where people are the last line of defence. Then it has to be realistic, short and regular. Not as a substitute for the two levels above.
We may recommend less training than you expected. If the picture shows that your biggest risk is an unprotected helpdesk process, we will say so, even if a training licence would be the easier business for us.
A programme needs someone to run it.
The Human Risk Manager makes the difference between a service catalogue and a programme. We provide them, you book a time allocation sized to fit your organisation. They remain your point of contact for the entire term.
What we need from you
- A visible sponsor from senior management. A reporting culture is not created in the IT department.
- A fixed point of contact in IT and security.
- Access to the owners of the critical processes for the assessment.
- The willingness to change processes, not just to train people.
The booked time allocation is not an administration fee, it is your budget. What is not needed for management flows into services you need instead.
Eleven building blocks. Your combination.
Your attack surface results from your industry, your payment processes, your tool landscape and your roles. A bank with mass payment transactions, an insurer with health data and a critical infrastructure operator with OT remote access need different priorities. That is why we have no standard package, but a combination.
We measure behaviour, not knowledge.
Continuous phishing simulationRealistic email simulations with increasing difficulty, complete tracking and a connected reporting channel.per participant
We bring the complete campaign suite and handle implementation from draft to reporting. You install, configure and operate nothing; only the whitelisting in your filter landscape is set up once by you. The complete attack chain is measured with timestamps: sent, opened, clicked, visited, entered, downloaded, reported. Anyone who clicks but enters nothing has reacted correctly, and we make that visible. We never store passwords; they are replaced by a marker before every transmission. On request, an alert centre is added that turns real reports from your employees into usable threat information.
Continuous vishing awareness campaignPhone attacks with an immediate training conversation, spread over 50 training weeks.per participant
Over 50 training weeks our specialists call your employees and simulate a realistic attack, evenly spread across the year. Every call ends in the same conversation with an individual training talk. A call cannot be clicked away: 98 percent of employees take part actively.
Digital behavioural assessmentsHandling phishing, USB devices, home office, passwords, visitors and data protection.per participant
Short, recurring surveys on concrete situations. How do your employees handle a found USB stick, an unknown visitor, confidential documents in the home office, an approval request under time pressure? You receive a score per topic, broken down by site and department.
Ad-hoc physical pentestingPhysical social engineering pentest for individual sites, from access to escalation.as needed
93 percent of our pentesters got into the building unnoticed, 82 percent reached security-critical areas. In the programme you book individual sites specifically when the data points there. After gaining access, we show what damage an attacker could actually have done.
Security analysesReview of the processes where damage occurs and of the technical status.as needed
We review the processes where damage actually occurs, plus the technical status: authentication methods, email authentication, filter landscape and the existing reporting channel.
- Payment approval
- Changes to bank details
- Password and MFA reset
- On- and offboarding
- Visitor and supplier management
Enabling means practising, not lecturing.
Continuous e-learningAll relevant cyber topics in short units, at a fixed rhythm.per participant
Short units at a fixed rhythm instead of a mandatory annual training. All relevant topics in units of a few minutes, told in an entertaining way and immediately applicable. Plus role paths for accounting, IT support, assistants, development and senior management.
On-site workshopsClassroom training, role training for critical functions, tabletop exercises for leadership and IT.as needed
Presence works where discussion is needed. We offer awareness live training for the workforce, role training for critical functions and the tabletop exercise for leadership and IT. The latter answers the question of what actually happens in the first 60 minutes after a report.
Flyers and noticesPhysical communication materials for sites, reception and production.as needed
Not every message belongs in an email. For reception, production, workshops and all areas without a fixed workstation we produce physical communication materials in your design: behaviour cards at reception, notices on visitor rules, quick guides for the reporting channel.
Company-specific contentScenarios, examples and materials that look like your everyday work.as needed
Scenarios have to look like your everyday work, at every site and in every language. We build your tool landscape, your senders, your processes and your real incidents into the content, on request right up to your own video formats.
Reworking policiesA 40-page document becomes a rule that can be applied in everyday work.as needed
A policy nobody reads protects nobody. We translate your rulebooks into short, binding work instructions and bring them to where the decision is made.
- Mandatory call-back for every change of bank details, via an independently researched number.
- Four-eyes principle above defined thresholds.
- Identity verification in IT support before password and MFA resets.
- A clear escalation path for suspected incidents.
Establish processes and train specifically: first the process that catches a wrong decision, then the training on it: a realistic situation from your everyday work, a decision under time pressure, immediate resolution. About one third legitimate examples, otherwise you train reflexive distrust instead of judgement. In this way, protection against phishing is first anchored technically and procedurally and then practised realistically.
Most programmes start with two to four building blocks plus management and grow along the data.
The expensive incidents are almost never a click. It is a bank transfer. Or an encryption.
Since AI-generated messages, spelling mistakes are no longer an indicator. Instead, we teach the structure behind it and one rule: check back via a second channel of your own choosing.
Your dashboard.
The visual centrepiece of the programme.
The human risk factor of your organisation: measured, put into context and shown in one metric you can trust.
Four metrics from one shared data basis.
Seven data sources flow into the platform. Four metrics are derived from them, and beneath them every single data point remains visible.
Demo mockup to illustrate the structure. All values are examples; the actual dashboard differs in layout and values.
Four numbers for executive management, everything beneath them for your security team. Every metric can be traced back to the raw value, so the statement remains verifiable at all times.
Seven data sources for one overall picture.
The human risk factor does not show up in a single place. That is why the platform measures it in seven.
The drill-down
Beneath the four metrics lies the complete KPI catalogue, categorised by activity, conversion, time and segmentation. You see not only that a value has changed, but where: by site, by department, by survey period.
Which areas do your measures reach, and which need a different approach?
Every metric can be traced back to the individual data point.
The resilience score measures behaviour, not knowledge.
The resilience score reflects exclusively real, measured risk: what your employees did when they faced a real attack attempt, and not what they know about it.
- Covertly executed attack simulations
- Credentials actually disclosed
- Access actually granted
- Actions actually carried out
- Quiz and test results
- Self-assessments by the workforce
- Training and participation rates
- Documented declarations of intent
From the number to the consequence
A score on its own remains abstract. The platform therefore translates it into its practical meaning: how successful would a real attack have been given this measured behaviour, and what would the attacker have gained access to?
Of 1,860 messages sent, 391 led to a click and 71 to the entry of credentials. With identical behaviour in a real attack, the attacker would have obtained 71 valid accounts, including mailboxes with access to invoicing and approval processes. In parallel, 19 of 48 access attempts gained physical access to office floors.
Illustration based on an example survey period. The actual derivation is based on your own measurements and your system landscape.
Three metrics that put the score into context.
A single number can mislead. That is why the resilience score never stands alone.
Risk indicator
Where is it heading?The score reflects what has already happened. The risk indicator captures the early indicators: how quickly are suspicious events reported? How many people report at all? How do sites and departments differ? These values tip earlier than the score and give you lead time before a trend becomes an incident.
Programme maturity
How well are we set up?Rated according to the SANS maturity model in five levels. What counts here is not the measurements but the maturity of your measures and processes: is there a binding programme? Who is responsible for it? Are incidents systematically followed up? A good score with low programme maturity is a chance result, not a reliable state.
Measurement maturity
How reliable is the data?Not every number deserves the same trust. Measurement maturity rates how realistically data was collected, from self-reporting to covert real simulation, and how current and broad the data basis is. It weights the resilience score and makes transparent when you should follow it.
Score: it happened. · Indicator: it is coming. · Maturity: how much we trust the numbers.
Three perspectives on the same data basis.
Executive management and board
A reliable statement on the human risk factor that can be reported: where you stand, where it is heading and what a real attack would mean given this behaviour. The development compared with the previous period is included.
Information security and IT
A management instrument instead of a collection of individual reports. You see which areas need attention, which measures have worked and where incidents repeat, segmented by site, department and period.
Data protection and co-determination
The platform is designed as a management instrument for the organisation, not as an evaluation instrument for individuals. Evaluations are aggregated, segmentations are bound to minimum group sizes. The set-up is defined and documented together with your data protection officer and employee representatives before the project starts.
It replaces neither training nor a training programme. It is the measurement layer above them and shows whether your measures work. That gives you the basis to direct budget to where it demonstrably changes something.
Managed for you, not filled in by you.
The platform is maintained by us. We connect your existing data sources, keep the metrics up to date and interpret the development for you. You get a managed programme, not a dashboard that stays empty after three months.
A budget that moves to where it works.
The programme consists of three parts. Two of them can be calculated in advance, the third remains flexible because your needs change over the course of the year.
Flat rate per participant
Everything that scales with headcount is billed per participant and year: phishing simulation, vishing awareness campaign, e-learning, digital behavioural assessments and access to the platform. Licence costs, delivery, evaluation and reporting are included.
Human Risk Manager time allocation
A fixed monthly volume for management, evaluation, interpretation and your questions. How large it needs to be depends on your size, the number of your sites and your maturity level.
Individually calculated services
What does not work per head we agree in advance and bill per engagement: physical pentests, on-site workshops, security analyses, policy work and more elaborate content production.
Unused allocation does not expire.
Your time allocation is not an administrative item, it is your budget. If it is not fully needed for ongoing management, you decide together with your Human Risk Manager where it goes instead.
Your programme is running stably, and for pure management 2,600 euros remain in the quarter. Instead of billing this amount, you put it into additional vishing calls for reception at three sites, a flyer series on the new visitor rules or a workshop for the accounts department. You decide, we deliver.
The reverse applies just the same: if the picture shows acute need, you increase the allocation, without a new contract and without a new procurement round.
Your first programme year
After the assessment the programme runs without your involvement. You name points of contact, approve scope and scenarios and take part in the quarterly review. We take care of everything else. We build capability, not dependency.
The rules are set before we start.
Co-determination is not a formality. Programmes that skip this point lose the trust of the workforce and with it the reporting rate on which everything is built. We involve data protection and employee representatives before the start and provide the templates for information and participation.
Aggregated, not personal
Standard evaluations for leadership are aggregated, segmentations are bound to minimum group sizes. There is no evaluation of individual employees by name.
No performance monitoring
We commit in writing that this data does not feed into performance appraisals or employment law measures. The programme is a learning offer, not behavioural monitoring.
Data-minimising from the start
Passwords are never stored; they are replaced by a marker before every transmission. Captured data is AES-256-GCM encrypted. We do not record vishing calls. The basis is a data processing agreement under the GDPR.
No endangering of people
We analyse every engagement in advance; risks are identified and minimised. Hardware used is non-functional. Customer systems and sensitive data remain untouched.
Click-rate rankings between departments, naming and shaming, passing individual results to line managers as a performance indicator.
In almost every organisation, a large part of the residual risk sits with a small group. With us, these people get more protection, not less trust: tailored micro-units, a short personal conversation about the cause and additional technical measures for the role. We look for the point where technology or process lets the person down, not for the fault in the person.
We are very satisfied with our ongoing awareness campaign. [...] Mariani also supported us beyond the actual scope of the engagement. [...] We are curious to see how the KPIs develop.
We thought we had it covered. Posters, e-learning, mandatory phishing modules — the whole catalogue. Now we know better. [...] Thank you, Mike & Team.
What surprised me was not the result. It was how my people reacted afterwards. One accountant said: “I double-checked every call for a week.” [...] That is exactly what I wanted. Not a rulebook. But people thinking for themselves when nobody is watching.
Robust protection for your corporate security
Frequently asked questions
Why don’t you call it an awareness campaign?
Because a campaign has an end date and your risk does not. Awareness also describes what people should know. Human Risk Management describes what you manage: a risk factor with metrics, an owner and a budget, like any other.
We already have an e-learning tool. Do you replace it?
Not necessarily. If your existing solution holds up in terms of content, we connect it as a data source and add what it lacks. We will not sell you a licence you already have.
Do we have to book all eleven building blocks?
No. Most programmes start with two to four building blocks plus management and then grow along the data. Your Human Risk Manager tells you which building block brings the most next.
What happens to the allocation if we do not need it?
It is reallocated. In the quarterly review you decide which service the remaining volume flows into. It does not expire and is not silently billed.
How quickly do we see results?
The first reliable picture is available after the baseline, usually six to eight weeks after the start. Behavioural change takes longer. In the follow-up after the first vishing training, the risk of compromise falls by up to 70 percent; a stable trend across all channels shows from the second quarter.
Is this enough for NIS2, DORA, ISO 27001 or TISAX?
Your industry and regulation determine evidence obligations and documentation depth. We align data collection and documentation with them from the start. Your evidence then emerges in the ongoing programme, not shortly before the audit.
Does this also work for small companies?
Yes. Our Human Risk Management scales from 50 to 50,000 employees. The fixed price per employee makes the costs predictable, regardless of company size.
How it starts
In an initial consultation we clarify your starting point, the sensible set-up and the right size for your programme. Without obligation and without any preparation on your part. A first conversation to get to know each other, clarify questions and get a first impression.
- Step 01 Initial consultation Clarify starting point, goals and set-up.
- Step 02 Proposal With building blocks, allocation and term.
- Step 03 Assessment And coordination with data protection and co-determination.
- Step 04 Baseline And programme start.
- Step 05 Quarterly review With metrics and measures.
Get personal advice
A first conversation: no obligation, confidential, and as equals. Together we work out where your biggest risks lie.