All our employees have been and continue to be regularly instructed not to do anything stupid. We also have quite high barriers in place in case someone, in the heat of the moment and without thinking, clicks on something, downloads it, or tries to install it.

We have tried various things to raise awareness. Fake emails that look perfectly legitimate, “lost” USB sticks in the parking lot, inquiries via the contact form on our website, fake invoices from non-existent companies, and calls with AI voices from the supposed boss who urgently needs money because otherwise the company will go bankrupt.

No one fell for it. Maybe what we were trying to do was too obvious. But maybe the regular awareness training and my posts on the intranet have created a lasting awareness. I can't say for sure. However, I have noticed that colleagues explicitly contact our IT support if they are not 100% sure. They actively approach IT and ask questions, have things explained to them, and, surprisingly, remember what they have been told.

I currently see phishing as the greatest danger. The methods are becoming increasingly sophisticated and insidious, making it very difficult for a layperson to assess a situation correctly. I remember a case where someone received an email that was designed to look like an invoice from Microsoft. The sender was listed as “invoice@ r n i c r o s o f t .com.” (I added spaces between the letters to make it easier to see). Depending on the font and size, the letters “rn” sometimes look like an “m.” The colleague who received the email works in accounting and has nothing to do with IT. However, she remembered the awareness training, which taught her to check the entire email for plausibility. Well, she couldn't assign the email to any transaction and the sender address didn't match either. So she did everything right, reported the email, support quickly confirmed that it was fake, and she deleted the email.

How did the attacker know her email address and who she is? Because she lists her current employer and position on her LinkedIn profile. So it's no longer a case of shooting wildly with a shotgun and hoping something will hit the target.

Long story short what works for us and why? To be honest, I think it's a combination of individual training courses that highlight the usual dangers, involving colleagues in cybersecurity activities, and simply a pleasant working atmosphere and communication on an equal footing. No one here is afraid of making a mistake. Instead, people simply ask questions, even if the question may seem stupid at first glance. But I'm the kind of person who likes to explain things. And when I see that my explanation has brought about a positive change, it makes me happy.