Walk into a 3D lesson.Watch a learner go through the bar scenario, step by step.- Industries
- Logistics
Security awareness training for logistics, freight and transport.
Logistics runs on fast replies: a load to confirm, a driver at the gate, a customs fee to pay. Criminals copy all three. Cyberfrog trains drivers, depots, dispatch and finance with mobile-first lessons and the lures your people really get, and gives you the evidence NIS2 asks for.
- Mobile-first lessons for drivers
- Load-board and customs lures
- SMS and dispatcher vishing tests
- NIS2 transport and courier mapping
Your bid on load TB-48812 has been accepted. Download the rate confirmation and carrier packet to secure the booking. The document viewer installs automatically. Loads not confirmed within 2 hours are released to the next carrier.
Download rate confirmation- A load nobody in dispatch remembers bidding on
- A 'document viewer' that installs software, which is how remote-access tools get in
- A two-hour deadline that stops you checking with the shipper
What attackers send to logistics teams.
A freight business is a chain of carriers, brokers, depots and customers that trust each other's emails. Attackers use that chain to steal money, data and sometimes the cargo itself.
- Phishing that steals the cargo
Criminals compromise carriers and brokers with phishing and fake load-board listings, install remote-management tools such as ScreenConnect or SimpleHelp, then bid on loads and steal the cargo. Proofpoint threat research, November 2025
- Ransomware that stops transport
Ransomware was 83.9% of cybercrime incidents against EU transport. An Akira-linked incident at Split Airport led to a temporary suspension of flights. ENISA Threat Landscape 2025
- State-backed interest in freight
ENISA reports China-nexus actors focusing on maritime, shipping and logistics, and Russia-nexus APT28 on air transport, logistics and freight. ENISA Threat Landscape 2025
- Stolen logins
In transportation, credentials are 27% of compromised data. System intrusion, basic web application attacks and the 'everything else' category make up 89% of breaches. Verizon DBIR 2026
- Diverted freight payments
Business email compromise, the scheme behind fake bank-detail changes on invoices, caused USD 3.05 billion in losses reported to the FBI in 2025. FBI IC3 Report 2025
From the cab to the customs desk.
A driver with only a phone, a dispatcher booking loads and a freight accountant paying carriers meet different scams. Cyberfrog trains each of them on the device and channel they actually use.
- Drivers and delivery crews
Texts about changed delivery slots, gate codes and proof-of-delivery uploads, with lessons sized for a phone during a break.
- Depot and warehouse teams
QR codes on dock notices, shared terminal logins and visitors who claim to collect for a carrier.
- Dispatch, brokerage and load planning
Load-board messages, rate confirmations that install software and calls from 'carriers' who want to change a pickup.
- Customs, finance and freight accounts
Fake customs fees, invoices with new bank details and look-alike domains of known carriers and shippers.
- IT, operations and management
Help-desk reset requests and the management training NIS2 asks of transport and courier companies.
The load, the slot, the customs fee.
Each simulation copies a moment from a normal shift, by email, SMS or phone. Every mistake leads to a short lesson on that trick the same day.
- EmailRate confirmation with a 'viewer'
A booking from a fake load board asks a dispatcher to download a file that would install a remote-access tool.
- SMSDelivery slot changed
A driver gets a text with a new gate code and a link to upload proof of delivery.
- WebCustoms fee to release a shipment
A clearance notice sends a customs clerk to a cloned payment page for a small fee.
- VoiceThe haulier who changed banks
An AI caller posing as a regular haulier asks freight accounts to update bank details before Friday's payment run.
Find the accounts attackers can log in with.
Credentials are more than a quarter of the data compromised in transport breaches, and logistics staff sign in to many portals: load boards, carrier and customs systems, shared depot terminals. Cyberfrog checks your domains against Darknetsearch's breach and stealer-log data and shows who is exposed.
Exposed staff get a personal notice and a lesson on how the login leaked, and their risk score reflects it. Passwords are shown only as much as your privacy settings allow. Look-alike domain defense also finds domains that copy your company's name, so you can reserve or monitor them.
What the rules ask of transport and logistics.
Transport and courier companies sit in the NIS2 annexes, aviation has Part-IS and US ports have a Coast Guard cyber rule. Cyberfrog maps training topics and keeps records per person and per team.
| Rule | What it asks for | How Cyberfrog helps |
|---|---|---|
| NIS2 Directive, Annex I (transport) and Annex II (postal and courier)Mapped in Cyberfrog | Air, rail, water and road transport, and postal and courier services, are in scope. The management and staff training duties of Art. 20 and 21 apply. | NIS2 mapping, the leadership course and evidence reports for each audit. |
| Swiss Information Security Act, Art. 74b(n)-(q) | Registered postal providers, public transport companies, licensed civil aviation, and Rhine shipping and Port of Basel operators must report cyberattacks within 24 hours. | Drivers and office staff who report suspicious messages in one click, straight to your SOC. |
| EU Part-IS, Reg. (EU) 2023/203 and 2022/1645 | Information-security management rules for aviation organisations, applying from 16 October 2025 or 22 February 2026, depending on the organisation. | Awareness records for ground, operations and office staff as part of your information-security management. |
| US Coast Guard MTS cyber rule, 33 CFR 101.650 | Cybersecurity training for personnel, with initial training by 12 January 2026 and then every year. | An annual programme with completion records per person for port and terminal staff. |
| IMO cyber risk management, MSC.428(98) | Cyber risks must be addressed in ship safety management systems. | Training for shore and office staff as one part of that risk management. It is not STCW certification. |
Summaries for orientation, not legal advice. Cyberfrog provides training records and coverage reports; it does not certify compliance.
Questions from logistics teams.
How do cybercriminals steal cargo with phishing?
Proofpoint describes the method: criminals send phishing emails or post fake load-board listings to carriers and brokers, get them to install remote-management software, then use that access to bid on real loads and steal the freight.
Does NIS2 apply to logistics and courier companies?
Often, yes. Annex I covers air, rail, water and road transport, and Annex II covers postal and courier services. Size thresholds and national law decide the final scope. Companies in scope must train their management and include cybersecurity training in their risk-management measures.
What training does the US Coast Guard cyber rule require?
The rule in 33 CFR 101 Subpart F took effect on 16 July 2025. Section 101.650 requires cybersecurity training for personnel, with initial training due by 12 January 2026 and annual training after that.
How do you train drivers who rarely use email?
On their phone. Lessons run in the browser on any device, simulations can arrive by SMS or voice call, and QR posters reach depot teams where they work.
What is supply chain phishing?
Phishing that abuses the trust between companies that work together: a message that appears to come from a known carrier, shipper or supplier, or really does, from a compromised account. Checking every payment or booking change through a contact you already know is the key habit.
Related industries.
- IndustryRetail
Service-desk calls that end in ransomware, seasonal staff on shared tills and QR codes that copy trusted brands.
Read more - IndustryManufacturing
Ransomware that stops the line, supplier invoices with new bank details and a supply chain attackers use as the way in.
Read more - IndustryHospitality
Fake guest messages from booking platforms that lead to ClickFix pages and stolen extranet logins.
Read more
Training that travels with your drivers.
In a 30-minute demo we show the load-board, driver SMS and customs simulations and the mobile lessons, on your own domain.