7 min read<\/p>\n
84 percent of German companies hit by a cyberattack in 2025 report phishing as the attack vector. Yet only 24 percent train their entire workforce. The rest skimp exactly where attackers wield their sharpest tools. Since 6 December 2025 this is no longer merely negligent\u2014it is illegal: the NIS2 Implementation Act makes awareness training mandatory for around 30,000 companies in Germany. Failure to train risks fines up to \u20ac10 million.<\/strong><\/p>\n NIS2 awareness training is mandatory in 2025 because the topic directly determines cyber resilience, security operations and regulatory compliance. The article shows, using synaforce as an example, which requirements, KPIs and operational steps matter in practice.<\/p>\n The firewall is configured, MFA is enabled, endpoint protection is deployed. Then an employee clicks a link in a deceptively genuine Microsoft 365 email and enters their credentials. The BSI Situation Report 2025 documents 950 reported ransomware attacks in the reporting period, 80 percent of them at small and medium-sized enterprises. 119 new vulnerabilities per day, up 24 percent year-over-year.<\/p>\n Yet the numbers tell only half the story. The Verizon Data Breach Investigations Report 2025 finds that 60 percent of confirmed global security breaches involved a human element. No exploit, no zero-day\u2014just a person clicking a link, sharing credentials or sending sensitive data to the wrong address.<\/p>\n The problem is not that companies lack technology. The problem is that the best technology fails when the human in front of it does not think twice. And that is where the gap yawns: according to BSI, 79 percent of companies train staff on IT-security topics. Sounds good. But only 24 percent train every employee. Fifty-five percent train only selected roles. And one in five companies skips training altogether.<\/p>\n Since 6 December 2025, Germany\u2019s NIS2 Implementation Act has been in force. It affects around 30,000 companies with at least 50 employees or annual revenues of 10 million Euro across 18 sectors. Registration with the BSI has been mandatory since 6 January 2026.<\/p>\n Two paragraphs are pivotal for awareness requirements. \u00a7 30 paragraph 2 BSIG obliges affected companies to provide cyber-security training and awareness-raising as part of mandatory risk-mitigation measures. \u00a7 38 paragraph 3 BSIG goes further: senior management must attend regular training themselves and demonstrate adequate risk-assessment knowledge. In September 2025 the BSI published guidance on NIS2 executive training, including concrete content.<\/p>\n Fines are steep. For essential entities: up to 10 million Euro or 2 % of global annual turnover, whichever is higher. For important entities: up to 7 million Euro or 1.4 %. There is no grace period; measures apply immediately from entry into force.<\/p>\n Yet the 2025 T\u00dcV Cybersecurity Study found only 50 % of affected companies are even aware of the NIS2 Directive\u2014and half of those do not realise they are in scope.<\/p>\n The old-fashioned phishing e-mail with typos and dodgy senders is dead. KnowBe4 reports that 82.6 % of phishing mails now embed AI elements: grammatically flawless copy, personalised greetings, context-aware content. AI-generated phishing achieves a 54 % click-through rate\u2014roughly 4.5 times higher than conventional attempts.<\/p>\n Even more alarming is the surge in deepfake vishing. Deepfake voice-cloning attacks jumped more than 1,600 % in Q1 2025 versus the prior quarter. The headline case: a finance employee at UK engineering firm Arup wired 25 million US-Dollar after joining a fake video call populated by AI-generated deepfake avatars of the CFO and executives. The T\u00dcV study confirms 51 % of German IT-security professionals already see AI-assisted cyber-attacks; among large enterprises the figure is 81 %.<\/p>\n At the same time, only 10 % of German companies use AI for their own defence. Attackers are adopting AI faster than defenders, widening the awareness gap: staff trained to spot typos and odd sender addresses are powerless against AI-crafted lures.<\/p>\n \u201c91 % of companies rate their cyber-security as good or excellent, yet one in seven was successfully breached last year. This perception gap is one of the biggest risks.\u201d The typical security training: a 45-minute online session in January, a mandatory check, and forgotten by next January. The click rate on phishing emails drops briefly but returns to its original level within three months. One-off training doesn\u2019t change behavior. Behavioral change requires repetition, relevance, and feedback.<\/p>\n The KnowBe4 Phishing Industry Benchmarking Report 2025 provides the largest data set to date on this topic: 14.5 million users across 62,400 organizations, 67.7 million simulated phishing tests. The result is clear. Before training, the average phishing click rate is 33.1 percent\u2014one in three employees clicks a dangerous link. After 90 days of continuous training, the rate drops by more than 40 percent. After twelve months, it stands at 4.1 percent. That\u2019s an 86 percent reduction.<\/p>\n What these programs share: they use phishing simulations (monthly, progressive difficulty), micro-learning modules (3 to 5 minutes, weekly or after specific events), gamification (leaderboards for departments, badges, team challenges), and a simple report button in Outlook or Gmail. The goal isn\u2019t training compliance\u2014it\u2019s a security culture where employees report suspicious emails before they click.<\/p>\n The key indicator isn\u2019t the click rate\u2014it\u2019s the report rate: how many employees actively report suspicious emails? Mature programs achieve report rates above 70 percent. That means seven out of ten employees spot a phishing attempt and report it before damage occurs.<\/p>\n Today, anyone taking out or renewing cyber insurance quickly learns: awareness training is no longer a nice-to-have\u2014it\u2019s an underwriting criterion. Allianz explicitly lists awareness training among its twelve core criteria for policyholders. AXA offers six months of free awareness portal with every cyber policy. The GDV risk questionnaire for cyber includes explicit questions about training measures.<\/p>\n Without proof, companies face higher premiums or exclusions for phishing damages. With average phishing attack costs in Germany at \u20ac4.15 million, this is a risk no CFO should take.<\/p>\n The math is straightforward. For a mid-sized company with 200 employees, an awareness program costs between \u20ac10,000 and \u20ac20,000 per year. KnowBe4 starts at $18 per user per year, Proofpoint at $25. Add 2 to 4 hours of internal admin time each month.<\/p>\n Against that stand average phishing incident costs of \u20ac4.15 million. Reducing click rates from 33 to 4 percent cuts the risk of a successful phishing attack by 86 percent. Even with conservative risk estimates: if the program prevents just one successful attack over ten years, it pays for itself many times over.<\/p>\n The equation has shifted. Before NIS2, awareness training was an optional measure\u2014some companies took it seriously, most treated it as a box-ticking exercise. Since December 2025 it\u2019s the law. The executive board is personally liable. Cyber insurers now demand it. And attackers are raising the bar with AI-powered phishing and deepfake vishing.<\/p>\n The good news: it works. An 86 percent drop in click-through rates after twelve months isn\u2019t a marketing claim\u2014it\u2019s the real-world data from 14.5 million users. The tools are mature, the costs are manageable, and the ROI is clear. What\u2019s missing in many organisations is simply the decision to start.<\/p>\n Yes. \u00a7 30 paragraph 2 BSIG obliges affected companies to provide cyber-security training and awareness. \u00a7 38 paragraph 3 BSIG goes further: the executive board itself must participate in training on a regular basis. Roughly 30,000 companies in Germany with 50 or more employees or annual turnover above \u20ac10 million are affected.<\/p>\n<\/details>\n Monthly is the sweet spot. More often leads to fatigue; less often loses training impact. Difficulty should rise progressively and cover different attack types: CEO fraud, Microsoft login, parcel notification, HR notice. Trigger immediate micro-learning modules after any clicked simulations.<\/p>\n<\/details>\n KnowBe4: from $18 per user per year. Proofpoint Security Awareness: from $25 per user per year. For a 200-person company that\u2019s $3,600\u2013$5,000 per year. Add internal effort: 2\u20134 hours per month for administration and evaluation.<\/p>\n<\/details>\n No. Punishment drives under-reporting. Instead: immediate learning module after the click, positive framing, and a focus on improvement. The goal is a reporting culture, not a culture of fear. Organisations that take a purely educational approach reach report rates above 70 percent.<\/p>\n<\/details>\n It\u2019s not a statutory obligation, but it is a standard underwriting criterion. Allianz lists awareness among 12 core criteria. The GDV risk questionnaire for cyber explicitly asks about it. Without documented proof, expect higher premiums or exclusions for phishing-related claims.<\/p>\n<\/details>\n Classic red flags like spelling errors no longer work. Instead, train staff to watch for behavioural anomalies: unexpected urgency, unusual senders, deviations from normal business processes. Layer on technical controls: DMARC\/DKIM for email authentication, AI-based email filters, and dual-channel verification for financial transactions.<\/p>\n<\/details>\n Featured-image source: Pexels \/ Pavel Danilyuk (px:8761533)<\/em><\/p>\n Further insights, services and practical examples are compiled by synaforce under Managed Security and Compliance<\/a>.<\/p>\n The firewall is configured, MFA is enabled, and endpoint protection is deployed. Then an employee clicks on a link in a deceptively authentic email.<\/p>\n","protected":false},"author":205,"featured_media":97072,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_focuskw":"NIS2 Awareness Training Requirement","_yoast_wpseo_title":"Cybersecurity Awareness: Why Technology Alone Isn't Enough","_yoast_wpseo_metadesc":"Most breaches start with human error. Discover why cybersecurity awareness training is critical \u2014 and how to build a security-first culture in your organization.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"featured_post_sortierung":0,"featured_post":0,"pre_headline":"","bildquelle":"","teasertext":"","language":"de","_evm_slot_owner":"","_evm_translation_lang":"","_wp_old_slug":[],"footnotes":""},"categories":[1152],"tags":[1316,1562],"class_list":["post-97010","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it-tech","tag-digital-transformation-en","tag-prozessoptimierung-en","entry"],"evm_reading_time_minutes":11,"wpml_language":"en","wpml_translation_of":87988,"acf":[],"yoast_head":"\nKey Takeaways<\/h2>\n
\n
What is NIS2 Awareness Training Mandatory?<\/h2>\n
The Gap Between Technology and Human Behavior<\/h2>\n
NIS2 turns awareness into a legal obligation<\/h2>\n
AI is reshaping the attack surface<\/h2>\n
\n
\n T\u00dcV Cybersecurity Study 2025 (506 companies, Ipsos survey)<\/cite>\n <\/p>\n<\/blockquote>\nWhat Works: From Mandatory Training to Behavioral Change<\/h2>\n
Cyber Insurance: Awareness as a Contract Condition<\/h2>\n
The ROI of an Awareness Program<\/h2>\n
Bottom line: Train or pay<\/h2>\n
Frequently Asked Questions<\/h2>\n
Does NIS2 explicitly require awareness training?<\/strong><\/summary>\n
How often should phishing simulations be run?<\/strong><\/summary>\n
What does an awareness programme cost?<\/strong><\/summary>\n
Should employees be punished for clicking phishing links?<\/strong><\/summary>\n
Do cyber insurers require awareness training?<\/strong><\/summary>\n
How do you defend against AI-powered phishing?<\/strong><\/summary>\n
Editor\u2019s Reading Picks<\/h2>\n
\n
More from the MBF Media Network<\/h2>\n
\n
More on this synaforce topic<\/h2>\n
\n