Compliant with § 30 paragraph 2 no. 7 and § 38 paragraph 3 BSIG
Phishing simulation for healthcare
Realistic phishing campaigns based on real-world scenarios from hospitals, clinics, medical care centers, care facilities, pharma, and medtech. Monthly cadence, measurable maturity, NIS2-compliant evidence — without a culture of blame.
HOW IT WORKS
From kickoff to proof in four steps.
We handle the planning, execution, and evaluation. You get a report that stands up to the board — and a culture in which employees report phishing instead of hiding it.
WHAT IS INCLUDED
More than a tool — a fully managed service.
Other providers sell you a software license and leave you to handle configuration, content, and reporting. We take care of everything — from the first campaign idea to a sign-off-ready audit report.
WHO IS IT SUITABLE FOR
For every healthcare facility — instead of generic providers.
Our phishing simulations are designed for organizations where cybersecurity directly affects patient care. No off-the-shelf templates — just scenarios that reflect your daily work.
Hospitals
Acute care, specialty clinics, university hospitals. Multi-site organizations with complex authorization structures, shift work, and high staff turnover. NIS2 is especially important.
Medical care centers & practice networks
Medical care centers, group practices, practice networks. From 50 employees, subject to NIS2 — an estimated 1,000 medical care centers affected for the first time. The training requirement is new; the threat landscape is not.
Private clinics
Affiliated hospitals, private clinics, specialized facilities. Often owner-managed with a pragmatic approach to security — training without overhead, audit-ready documentation without enterprise complexity.
Pharma & MedTech
Pharmaceutical companies, medical device manufacturers, and contract research organizations. IP protection is business-critical, supply chains are a target for attacks, and GxP/ISO 13485 audits review awareness programs as well.
Care facilities
Nursing homes and home care services. High staff turnover, mobile devices, sensitive patient data — and increasingly the target of targeted phishing attacks on billing systems.
Health Tech
Digital health platforms, telemedicine providers, DiGA manufacturers. High proportion of APIs and integrations, distributed teams, often targeted through customer service and partner communications.
OUR APPROACH
Simulations should prepare people — not embarrass them.
The Gießen clinic study showed not only that staff are vulnerable — but also that a significant proportion reacted to the simulation with fear, shame, and feelings of guilt. This is not only problematic on a human level; it is counterproductive: those who feel ashamed do not report. Those who do not report increase the risk.
No shaming
Our landing pages don’t lecture — they explain. Not “You failed,” but: “Here are the signs by which you could have recognized this email.” No personal reference in reports. No individual evaluation. No public shaming.
A culture of reporting instead of fear
We measure not only clicks, but also reports—and prioritize the latter. Anyone who reports a suspicious email, whether real or simulated, receives positive feedback. The result: a workforce that actively protects, instead of passively hoping.
Learn at the right moment
At the moment of the click, attention is at its highest. That’s exactly when we convey — in under 90 seconds — the specific warning signs. This has been proven to be more effective than annual mandatory e-learning courses.
"A significant portion of the surveyed employees reacted to the phishing simulation with feelings such as fear, shame, and guilt. These findings highlight the psychological challenges and underscore the need to weigh the emotional costs against the potential security benefits."
— Tolsdorf, Langer, Lo Iacono. "Phishing Susceptibility and the (In-)Effectiveness of Common Anti-Phishing Interventions in a Large University Hospital." Proceedings of ACM CCS '25.
Quick answers about phishing simulations, regulations, and a typical project workflow.