kommunit

In addition to technical security measures, raising employee awareness also plays a critical role.

The Need to Strengthen Security Awareness in the Public Sector

kommunit had already implemented security awareness training but found that the content and learning formats of the previous product were not ideally suited to the specific needs of municipal administrations.

In addition, the organization needed to establish a training program that:

• Provides regularly updated content
• Can be flexibly integrated into employees’ daily work routines
• Remains scalable for numerous affiliated municipal administrations

Flexible Security Awareness Training Achieved with KnowBe4

When searching for a new product, kommunit evaluated several providers. Following a public tender process, the municipal IT association selected KnowBe4.

Key factors in the decision were the wide variety of learning formats and the continuously updated content. The training program includes short micro learning modules, videos, as well as interactive elements and games. Employees responded particularly positively to the security awareness series “The Inside Man.” The new training formats led to noticeably higher engagement among employees.

“After we launched The Inside Man, the first question we heard was: ‘When is the next episode coming?’” Jeß says.

In addition to traditional training modules, kommunit also uses phishing simulations and the Phish Alert Button. This enables employees to report suspicious emails directly from their inbox.

Another advantage is the high level of flexibility. Employees can complete the training independently and on their own schedule, including on mobile devices via the KnowBe4 Learner App.

Implementing an Awareness Program for Thousands of Employees

kommunit operates the platform in a multi-tenant structure, allowing multiple organizations to use it securely. In addition to its own employees, numerous affiliated municipal administrations also benefit from the awareness training. The implementation process was quick and required minimal effort from the team.

“The rollout was surprisingly fast. Once the environment was set up, we were able to import the users and start the training immediately,” Jeß says.

The awareness program extends well beyond kommunit’s own organization. In addition to the approximately 300 kommunit employees, numerous affiliated municipal administrations also benefit from the training. Altogether, the program now reaches several thousand employees across the municipal sector.

The training program follows a clear structure: over the course of the year, employees complete around 10 training sessions, each lasting approximately 30 minutes.

The goal is to regularly raise employees’ awareness of cyber risks through manageable training modules. Instead of relying on one-off training sessions, kommunit deliberately focuses on continuous learning with KnowBe4. The short training modules can be easily integrated into employees’ daily routines, helping ensure that security knowledge remains top of mind.

New content is first tested internally and then rolled out to the affiliated municipal administrations.

However, with KnowBe4, kommunit was able to significantly improve employees’ security awareness compared to the previous vendor.

The impact of the training is clearly reflected in the results of the security assessments. The employees’ average awareness score increased from 58% at the start of the program to 69%.

Security awareness also improved significantly across individual knowledge areas. The most notable gains were seen in the areas of passwords and authentication, mobile devices and social media.

The results show that regular awareness training not only increases employees’ understanding of cyber risks but also positively influences their behavior in their day-to-day work. With each round of training, employees’ security awareness continues to grow.

In addition to training, kommunit regularly runs phishing simulation campaigns to assess how employees respond to realistic attack scenarios.

In a recent campaign, 1,110 phishing emails were sent to employees:

• 716 emails opened
• 9 clicks on phishing links
• 2 QR codes scanned
• 672 suspicious emails reported

The improvements are clearly reflected in measurable results and data. The high number of reports shows that many employees are able to recognize potential attacks and actively contribute to the organization’s security.

“It’s not just a feeling — we have the proof. Our employees’ security awareness has measurably improved,” Jeß says.