Phishing Tests and Firewalls: Why Staff Awareness Is Now the Front Line in Cyber Defence

Almost 700 public-sector employees were surveyed for the "Cybersicherheit in Kommunen" (cybersecurity in municipalities) study by G DATA CyberDefense, Statista and brand eins — and 62 percent of the municipalities they represent now run awareness training for their staff.

That figure sits alongside a broader shift in spending plans. Some 43 percent of administrations intend to put more money into IT security, up from 28 percent a year earlier. Three in five respondents said they had revised their security processes, 46 percent had brought in new security solutions and the same share had reworked their emergency plans, while 43 percent said IT security now carries greater priority in management.

The private sector is moving on a similar track. In the "Secure Data Report 2026" from FTAPI and techconsult, which polled 200 IT and security officers, 67 percent said they provide training for their workforce.

Standards in use

Among the security and compliance frameworks these organisations follow, the BSI IT-Grundschutz — Germany's federal baseline for IT security — leads at 72 percent, with the ISO 27001 standard at 68 percent and the European NIS-2 directive at 56 percent.

Firewalls and antivirus software no longer suffice on their own to keep networks safe, according to a report from industry portal autohaus.de dated 19 October 2026. People are considered the biggest risk factor for cyberattacks. Employees increasingly find themselves targeted through phishing, fraudulent phone calls and manipulated requests, so the protection of modern IT infrastructure depends heavily on how alert and well prepared staff are.

Short sessions, clear responsibilities

To arm workers against sophisticated scams, autohaus.de recommends regular short learning units, vivid practical examples and simulated phishing tests. Clear lines of responsibility are needed too, along with an IT emergency plan that is documented and rehearsed in the business.

Leadership carries particular weight here: management must actively model cybersecurity, make sufficient resources available and establish an open culture around mistakes.

Specialists make the same point about training — it cannot be treated as a one-off project. As attacks generated with artificial intelligence become ever harder to spot, people form the first line of defence. Yet in day-to-day operations, budgets still often flow one-sidedly into technical barriers and network protection.

Research also highlights behavioural obstacles: even after training, emotional, cognitive and situational influences can lead staff to fall for deception. Continuous, hands-on training concepts, gamification approaches and avoiding overconfidence are therefore gaining importance.

Gaps in monitoring and records

The surveys also expose considerable holes in security management. Under the FTAPI study, 85 percent of respondents want control over internal data flows, but only 15 percent actually monitor data exchange with technical tools.

Meanwhile 58 percent rate audit-compliant documentation as a high or very high burden, and just two percent have automated the process. When IT outages hit, 72 percent resort to insecure channels, while 20 percent face an immediate halt to operations.

Careful evidence management matters for financial protection as well. As specialist portal tsecurity.de reports, missing or incomplete training records can cost policyholders their insurance claims under cyber policies. Anyone wanting to minimise liability risks and put IT security on a lasting footing must therefore document awareness measures without gaps.