Train. Document. Done – without extra effort.
You have to be able to prove training without turning the team against you. You need documentation that holds up in an audit, and an approach that is fair and respects co-determination. I deliver both – as a by-product of the training.
This is what it looks like in practice.
Cockpit, team report, certificate and proof of training for a fictitious company with twelve people. All names and results are made up; the layout is exactly what you will see yourself later.
Groups, registered people and the cost if everyone completes. From here you start training, an initial test or a repeat run.
The team’s click and data-entry rates, a comparison with all test runs, participation in training. Anonymised.
Results at a glance and protection level with a recommendation. The PDF carries an authenticity QR code and is suitable for audits, insurers and NIS2 documentation.
Name, course, dates of training and practical test, reference to standards, signature and a verifiable certificate number with QR code.
All training carried out, with time stamps and participation rates, mapped to the requirements. Also for ISO 27001, GDPR, the AI Act and cyber insurance.
Each person sees only their own result: reaction to each test email, how the scam could have been spotted, and what their device gave away.
This is how my training works.
Your goal is complete, fair proof – not a wagging finger. That is why I train first and document every step with a time stamp. The simulation always evaluates the team, never puts an individual in the pillory.
Three ways – you choose what suits you.
I train your team in person – on site or online, in conversation and with examples from your everyday work.
You run the training yourself: I provide the ready-made materials and you pass them on in-house – at your own pace.
Everyone learns online the way they prefer – by text or video, at their own pace, choosing the content.
Train first, then test – deliberately in that order.
-
Initial training
First I equip your team (or you do it with my materials). Everyone starts with the same basic knowledge.
-
Phishing test as a self-check
Only then does the simulated attack follow – not as an exam, but as a self-check: everyone sees whether what they learned holds up in everyday work.
-
A security culture, refreshed when needed
Training and testing grow into a constructive security culture in your business, which you simply repeat when the time comes.
Your status report is based on your team’s results after the training – it shows the level you set out to reach, not the unprotected starting point.
New team members can be added later with one click: they immediately receive the online training materials and a first self-test – and join the next joint session or training with the same prior knowledge.
The reverse order – and why I advise against it.
From a management perspective, it often seems logical to assess the situation with a test first and only then decide whether training is needed. Technically that works – I can set it up for you.
A test before any training produces exactly the “gotcha” data that the works council and data protection rightly reject – and that may be used against you if things go wrong. Training first means: you collect progress, not incriminating files. A test without prior training only measures the starting point at zero. My approach turns this around: equip first, then check.
No subscription, as and when you need it, and always with my personal support.
AI in HR is high-risk territory.
Summarising applications, pre-sorting candidates, drafting references: in HR, AI touches particularly sensitive data and can discriminate without anyone intending it. Systems that help decide on hiring or promotion are classed as high-risk under the EU AI Act. And since February 2025, everyone who uses AI has to be trained.
- No applicant data in freely available AI tools
- No AI decisions about people without genuine human review (Art. 22 GDPR, AGG – German General Equal Treatment Act)
- AI course with certificate and model AI policy
For proof & acceptance.
How the time-stamped certificate is created automatically and holds up in an audit.
Duties & standards →GDPR, ISO 27001 and NIS2 – which documentation duties this helps you meet.
Why nobody is singled out →How evaluation and data protection fit together – important for co-determination.
Frequently asked questions
Is this a subscription?
What does it cost?
Does the effect of a one-off training actually last?
Do I need an IT department for this?
How does training with you work?
Will anyone on our team be singled out or monitored?
Does this cover GDPR, NIS2, ISO 27001 or insurance requirements?
What happens when staff change?
Do I get proof of training or a certificate?
Does this also cover AI fraud and deepfakes?
Are schools and non-profit associations really free of charge?
How quickly can I start?
Your question is not listed?
Ask me directly. You only need to give an email address if you want to receive my answer.
Set up in an hour – no IT department needed.
Choose a course, add your team, get started. Proof of training is generated automatically along the way.