Walk into a 3D lesson.Watch a learner go through the bar scenario, step by step.- Industries
- Public sector
Security awareness training for government and the public sector.
Public administrations hold citizens' data, run services nobody can do without, and are the sector state-backed groups target most for espionage in Europe. Cyberfrog trains officials, case workers and leadership with short lessons and realistic simulations, and keeps the records NIS2 and national laws ask for.
- Management training under NIS2
- Phishing, SMS and AI voice
- Hosted in Germany or on premises
- Records per person for audits
This is M. Vogel. I am travelling and need a word with you about the budget briefing before the committee meets. Please move to our secure channel, my office will send you an access code there. Keep this confidential for now.
Join secure-gov-chat.net- An unknown mobile number claiming to be a senior official
- Moves you off official channels to a private chat app
- Asks for confidentiality so you do not check with the office
Why public administrations are a first target.
Government bodies are trusted by default, handle sensitive records and often run on tight IT budgets. Attackers use that trust: they pose as authorities, as senior officials and as colleagues from another department.
- The most targeted sector in Europe
Public administration accounted for 38% of incidents and was the sector state-nexus actors targeted most for espionage. Ransomware hit municipalities in particular. ENISA Threat Landscape 2025
- Phishing and misdirected mail
In public administration, phishing is 20% of initial access and the human element is involved in 69% of breaches. Many internal incidents come from misdelivery. Verizon DBIR 2026
- AI voice messages from senior officials
Since April 2025, actors have sent texts and AI-generated voice messages posing as senior US officials. FBI PSA250515
- Calls supposedly from the authorities
Calls supposedly from the authorities made up 26% of almost 65,000 reports to the Swiss NCSC in 2025. Phishing was 19%. NCSC Switzerland, Week 52 2025
From the citizen counter to the leadership floor.
A case worker answering citizens, a procurement officer paying contractors and a department head accountable under NIS2 meet different attacks. Each group gets a path written for its work.
- Citizen services and front office
Callers posing as citizens, other authorities or the police, and requests to confirm personal data over the phone.
- Case workers and records staff
Misaddressed mail, file shares sent to the wrong person and fake document portals, with lessons on handling citizens' data.
- Procurement and finance
Contractor invoices with changed bank details and fake tender messages from look-alike domains.
- Leadership and elected officials
Texts and AI voice messages from senior officials, deepfake video, and the regular management training NIS2 and BSIG §38(3) require.
Practise on the lures officials really receive.
Simulations arrive in each person's language and at a sensible local time, so they fit an office day. Someone who falls for one gets a short lesson on that trick; someone who reports it is thanked on the spot.
- SMSThe State Secretary's text
A message from an unknown number asks a department head to continue on a private chat app.
- VoiceA call from central IT
An AI caller announces a mandatory security update and asks for the code that just arrived on the phone.
- EmailCitizen portal sign-in
A notice that the e-government portal password expires, with a cloned sign-in page on a look-alike domain.
- ClickFixThe council agenda
A shared meeting agenda asks the reader to paste a command to prove they are human.
Know which official logins are already in criminal hands.
Public servants register with their work address on conference sites, supplier portals and professional networks, and those services get breached. Cyberfrog checks your domains against Darknetsearch's breach and stealer-log data, as often as every hour, and raises one alert per person and leak.
Each exposed employee gets a factual notice, never a reprimand, saying what leaked, where and what to do now, plus the matching lesson. Managers see team totals only, with a minimum group of five, and passwords are shown only as much as your privacy settings allow.
What the rules ask of public administrations.
NIS2 brings central and, in many states, regional government into scope, and national laws add their own duties. Cyberfrog maps the frameworks it supports and keeps dated records per person for the others.
| Rule | What it asks for | How Cyberfrog helps |
|---|---|---|
| NIS2 Directive, Art. 20 and 21 (public administration, Annex I)Mapped in Cyberfrog | Training for members of management bodies, and basic cyber hygiene and cybersecurity training as a risk-management measure. | NIS2 mapping, a leadership briefing and coverage reports you can export. |
| Germany, BSIG §38(3) | Management of particularly important and important entities must attend training regularly to recognise and assess IT-security risks. | Management lessons and a dated attendance record for each leader. |
| BSI IT-Grundschutz, module ORP.3 | The module Sensibilisierung und Schulung describes how to run an awareness and training programme. | An annual programme with role paths and records to document your ORP.3 measures. |
| Swiss Information Security Act, Art. 74b(b) | Federal, cantonal and communal authorities must report cyberattacks to the NCSC within 24 hours. | Staff who spot and report early; the report button sends the original email to your SOC. |
| US CJIS Security Policy (awareness and training controls) | Security and privacy literacy training for everyone with access to criminal justice information. | Role paths and per-person completion records. Check the current policy version for timing. |
| US federal agencies, 5 CFR 930.301 (FISMA) | Agencies must provide information-security awareness training to their employees. | An annual programme with exportable records per employee. |
Summaries for orientation, not legal advice. Cyberfrog provides training records and coverage reports; it does not certify compliance.
Questions from public administrations.
Does NIS2 apply to municipalities?
NIS2 Annex I covers central government entities, and regional ones as each member state decides. Whether municipalities are in scope depends on national transposition, so check your country's implementing law. Where they are, management training and staff cyber-hygiene training are required.
What does BSIG §38(3) require of managers?
Germany's NIS2 implementation says that the management of particularly important and important entities must attend training regularly, so they can recognise and assess IT-security risks. Cyberfrog provides management lessons and keeps a dated record for each leader.
How often must CJIS training be completed?
The CJIS Security Policy requires security and privacy literacy training for everyone with access to criminal justice information. The timing is set in the current policy version, so check the FBI CJIS resource centre before planning your cycle.
Where is our data hosted?
Cyberfrog runs in German data centres, and an on-premises edition can run inside your own network, in the intranet or a DMZ. Roles separate the people who set policy from those who run campaigns, and every change is logged.
How do we involve the staff council?
A viewer account lets a works or staff council see every result without changing anything. Managers see team totals only, with a minimum group of five, and a supervisor can lock anonymisation so no admin can switch it off.
Related industries.
- IndustryHealthcare
Ransomware that postpones care, help-desk calls that reset MFA, and staff who share workstations between shifts.
Read more - IndustryEducation
Phishing in almost every reported breach, and impostors who write in the institution's own name.
Read more - IndustryLogistics
Fake load-board listings, remote-access tools that end in stolen cargo, and ransomware that stops transport.
Read more
Training for the people who keep public services running.
In a 30-minute demo we show the simulations, management lessons and records for public administrations, on your own domain.