Games
Short rounds in which employees sort messages, defend a company account or make decisions in an attack scenario.
- 3–5 minutes per round
- Points, badges and a department leaderboard
- Mistakes come back in a review
Akademia ZeroLayer, remote security awareness training
Cybersecurity training for employees that actually sticks
Short games, quizzes, video micro-lessons and phishing simulations, all online. We write the scenarios based on attacks we see every day in our work. Employees learn a few minutes at a time, and your report shows who completed the training and when.
Work in local government? Training with documentation for the KSC Act
- Built from real attacksScenarios based on what we see every day in our work.
- Polish contextCourier scams, KSeF e-invoices, a call “from your bank”.
- Training reportWho, when and with what score. Ready for NIS2 and KSC.
Inbox0/4 red flags
From:Marek Nowak, Board
To:accounts@yourcompany.com
Subject:
Good morning,
I’m in a meeting with an investor and can’t talk. Please pay the new supplier’s invoice today, the details are in the document below.
Thank you,
Marek
Invoice_0923.pdf
This email has just landed in your accounting team’s inbox. Click the parts that should worry the recipient.
An attack usually starts with a single click
The best technical safeguards won’t help if someone types their password into a fake form or approves a transfer after a phone call from “the CEO”. Criminals know this, so they target people.
- of data breaches involved the human element
- 62%
- of data breaches involved the human element
- Verizon DBIR 2026
- of the 260,783 incidents handled by CERT Polska in 2025 were computer fraud, mainly phishing
- 97%
- of the 260,783 incidents handled by CERT Polska in 2025 were computer fraud, mainly phishing
- CERT Polska, Annual Report 2025
- People forget. What they learned in an hour-long presentation fades within weeks, and an attack can come in any month.
- Slides don’t train reactions. An employee knows what phishing is and still clicks, because the email looks like an invoice from a familiar supplier.
- The content is generic. Examples from American banks look nothing like a text message asking for an extra parcel fee.
- No evidence. An attendance list doesn’t tell an auditor whether anyone understood anything.
One training, three perspectives
You launch a campaign, for example on phishing. The employee watches a short lesson, takes a quiz, plays a game and gets a certificate. You see the results for the whole company. Click through each of these views.
Campaign assigned by the IT department, deadline: 7 days
Phishing and fake invoices
0:004:00
Fake invoices and board impersonation
Micro-lesson, 4 minutes. Polish subtitles, works on a phone.
- 1What a fake invoice looks like
- 2CEO impersonation
- 3What to do after clicking
Book a 30-minute presentation
We’ll show you the dashboard, paths for the roles in your company and scenarios from your industry.
Four formats, one goal: reflexes, not rules
Online training works when it is short, specific and repeated. That is why we mix formats and spread them over time instead of locking people in a room with an hour-long presentation.
Quizzes
Questions based on situations at work, not definitions. Every answer comes with a short explanation of why it is right or wrong.
- On desktop and mobile
- Questions tailored to the role
- Scores go into the report
Video micro-lessons
Videos a few minutes long, covering one threat at a time. Easy to watch between meetings, with subtitles.
- 2–6 minutes
- Polish subtitles
- New episodes when a new attack appears
Phishing simulations
Controlled emails and text messages that look like real attacks. Anyone who clicks gets a short lesson straight away.
- Email, SMS and phone
- Templates from real campaigns
- No shaming of employees
Five questions. Would you have fallen for it?
This is what a quiz in the Academy looks like: everyday situations at work and a short explanation after every answer. It takes two minutes.
You get an email from “the CEO”: he’s travelling and asks for an urgent transfer to a new supplier. What do you do?
Training programme: what your people will learn
Every role gets its own path. Accounting practises spotting fake invoices, the board practises decisions in a crisis, and everyone learns the basics of cyber hygiene.
Employees
- Phishing, text messages and fake invoices
- Passwords, MFA and password managers
- How and where to report an incident
Managers and the board
- Board duties under the KSC Act and NIS2
- CEO impersonation and deepfakes
- Decisions in the first hours of an incident
Finance, HR and administration
- Bank account change requests and BEC fraud
- Personal data protection (GDPR)
- Verifying payment requests
IT and administrators
- Social engineering aimed at the helpdesk
- Secure permissions and remote access
- First response and preserving evidence
Topic library
Email, phone and social engineering
- Phishing and fake invoices
- Social engineering and vishing
- Voice and video deepfakes
- Social media and what your company reveals online
Passwords, accounts and devices
- Passwords and password managers
- Multi-factor authentication (MFA)
- Phones and mobile devices
- Physical security and USB drives
Data and law
- GDPR and data protection
- Sharing files securely
- Using AI safely
- Board duties under the KSC Act and NIS2
Remote work and incidents
- Remote work and public Wi-Fi
- Ransomware
- Reporting incidents
- Decisions in the first hours of an incident
plus new modules after every major campaign
NIS2 and KSC training: you see progress, the auditor sees evidence
The amended Polish National Cybersecurity System Act (ustawa o krajowym systemie cyberbezpieczeństwa, KSC; Dz.U. 2026 poz. 252, in force since 3 April 2026) requires staff education and cyber hygiene rules. The head of an essential or important entity completes documented training once a year (Art. 8e) and is personally responsible for cybersecurity (Art. 8c).
If the head of the entity is not trained, they face a fine of up to 300% of their salary (Art. 73a), which can be imposed from 3 April 2028. The obligations must be implemented by 3 April 2027.
Let’s talk about board trainingOne-click report
Date, scope and score of every training session, broken down by department. Export to PDF and CSV, including for the board.
Numbered certificates
Every certificate has a unique number that can be verified.
Automatic reminders
The platform itself reminds people who haven’t finished their training on time.
Annual training for the head of the entity
A separate path and a separate report for the board, to meet the documentation requirement of Art. 8e(3).
The training also supports GDPR and ISO/IEC 27001 requirements. The Academy provides the training and its documentation. Assessing the compliance of the whole organisation is the auditor’s job and also covers other areas, such as risk analysis and incident handling.
Does the KSC Act apply to my organisation?
Essential or important entity status arises by operation of law, and you determine it yourself. Answer two or three questions and we’ll show you what it means for training.
This test is indicative only and does not replace legal analysis. Among other things, it does not cover entities subject to the Act regardless of size, or designation as an essential or important entity by the authority.
Materials to download
Free of charge, download after entering your email.
What kind of organisation do you represent?
From the first call to the first report in a month
You don’t need your own team to run the platform. We run the rollout and the first campaigns together with you.
- 1
Call and programme selection
We ask about your industry, headcount and audit requirements, then put together a training plan for the first year.
- 2
Accounts for your team
We add employees from a file or from your company directory. Invitations go out automatically.
- 3
Kick-off campaign
A first phishing simulation shows your starting point, then the first training path begins.
- 4
Report after 30 days
We show you what has changed, which departments need support and what we do next.
Security awareness from people who respond to incidents
The Academy is built by the same team that secures Polish companies and institutions every day and runs phishing tests for them.
We teach what we see every day
Every day we secure companies and institutions and respond to incidents. The Academy’s scenarios come from real attack attempts we encounter in that work, not from a textbook.
Polish language and Polish context
The fake courier, the extra parcel fee, the call “from your bank”, KSeF. Employees recognise situations they know from their own inbox.
Training combined with testing
We combine the Academy with our phishing and deepfake tests, so you see not only who completed the course but also who recognised the attack. See our phishing tests.
Experts, not just a platform
The Academy is backed by incident response people. When something really happens, you know who to call.
Who the Academy is for
Companies and SMEs
From 10 to several thousand employees. We run the rollout together with you.
Book a presentationLocal government and the public sector
Municipalities, counties and subordinate units. Training for officials with documentation for the KSC Act, including as part of projects such as Cyberbezpieczny Samorząd.
For local governmentEssential and important entities
Energy, transport, healthcare, manufacturing, digital services. A programme in line with NIS2 requirements.
Check if the KSC Act applies to youOptions: from a pilot to the whole organisation
Every option starts with a free presentation.
Pilot
Free, one department, 30 days
- A phishing simulation to start with
- A selected training path
- Results report after 30 days
Academy
Whole company, annual licence
- All formats and topics
- Role-based paths and onboarding
- Dashboard, reports and certificates
- Phishing simulations all year round
Academy + Tests
For NIS2 and KSC entities
- Everything in the Academy plan
- Social engineering tests with deepfakes and vishing
- Annual board training
- A dedicated contact from the ZeroLayer team
From the Academy blog
Guides for people who organise training in companies and public offices.
Guide
MFA and two-step verification: what it is and what every employee needs to know
What is MFA and how is it different from 2FA? Methods from SMS to passkeys, attacker tricks like push bombing and fake bank calls, and rules for all staff.
13 min read
Guide
AI training for employees: how to use AI safely at work
What to teach your team about safe use of ChatGPT and other AI tools at work: which data to protect, shadow AI, hallucinations, prompt injection and AI policy.
11 min read
Guide
Secure passwords at work: how to create a strong password and what rules to give employees
How to create a strong password, what length CERT Polska, NASK and NIST recommend, and what to put in a password policy for employees. With a team exercise.
12 min read
Frequently asked questions
Don’t see your question? Ask it during the presentation or write to us.
Is cybersecurity training for employees mandatory?
Yes, in essential and important entities. The amended KSC Act, in force since 3 April 2026, requires staff education and cyber hygiene rules (Art. 8), and the head of the entity must complete documented training once a year (Art. 8e). Other companies have no such obligation, but training is often required by GDPR, ISO 27001, insurers and clients.
How long does online training take?
A few minutes a week. Modules last 3 to 10 minutes and can be completed between meetings, including on a phone. Instead of one long session once a year, employees get short lessons spread over the whole year, so nobody is away from work for half a day and the knowledge stays longer.
Does the Academy meet the requirements of NIS2 and the KSC Act?
The Academy provides the training and documentation the Act requires for staff education and training of the head of the entity. Reports include the date, scope and score of each training session. Compliance of the whole organisation also covers other obligations, such as risk analysis and incident handling, which we support separately through audits and vCISO services.
Do employees get a certificate?
Yes. After completing a path, the employee receives a certificate with their full name, the date, the topics covered and a unique number. A copy goes to the admin panel and into the report you present to the auditor or the board.
How is security awareness different from phishing tests?
Security awareness is learning: lessons, quizzes and games that build habits. A phishing test checks whether those habits work when a realistic email arrives. In the Academy we combine the two: anyone who clicks in a simulation gets a short lesson straight away, and you see the change over the following campaigns.
Won’t phishing simulations put employees off?
Not if they are run well. Someone who clicks gets a short lesson, not a reprimand. The simulations don’t collect passwords. Before a campaign, we help prepare a message for employees and agree the rules with HR and the data protection officer.
How quickly can we start?
We usually launch the first campaign within a week. We add employees from a file or your company directory and start with a phishing simulation that shows your starting point. Based on that, we plan training for the whole year.
Book a 30-minute Academy presentation
We’ll show you the platform, paths for your roles and a sample report. The call takes about 30 minutes, with no obligation. You can also start with a free pilot for one department.
- A presentation using scenarios from your industry
- A training plan for the first year
- A free pilot for one department