Technical email filters stop many “bulk” attacks. However, targeted phishing (e.g., spear phishing, CEO fraud/BEC, social engineering) still reaches inboxes—this is where people make the difference. Webguardiola strengthens that last line of defense and turns employees into an active human firewall.

Yes. Our simulations contain no malware and no harmful attachments. A click leads only to a secured learning page (HTTPS). No code is executed on endpoints, and there is no access to company data or internal systems.

No. Webguardiola is built for learning, not punishment—with clear roles and transparency.

• Access & training: Employees get access via their company email address and complete trainings on the e-learning platform.

• Audit evidence (completion rate): A designated person in the company can receive manager permissions to see who has completed trainings (e.g., as audit/compliance evidence).

• Phishing training (optional, user-only): Each employee personally decides whether they want to use phishing challenges inside the training. Results are visible only to the individual user and are intended purely for personal learning—not for monitoring.

Very little. Webguardiola is a cloud solution (SaaS)—no software installation is required.

• Standard setup (e-learning): Typically, employees only need to register/log in with their company email address—passwordless via a magic link/one-time code (no password required).

• Optional email delivery / system emails: If needed, a quick allowlisting/whitelisting step (e.g., in Microsoft 365/Exchange) can help ensure invitations/notifications arrive reliably.

• Optional: running your own phishing campaigns: If you choose the option to send your own phishing emails internally, we provide a separate onboarding/training. After that, the responsible manager can run phishing campaigns independently within the company (including company-level reporting inside the dedicated tenant/tool).

With Webguardiola, this becomes a learning moment instead of damage: after the click, the user receives immediate, easy-to-understand feedback within the training (e.g., how to spot the fake: sender domain, suspicious URL, typical urgency patterns).

Important: Phishing challenges are opt-in—each person decides within the training whether they want to use this exercise. Results and feedback are visible only to the individual user. Optionally, anonymized overall metrics can be shown (e.g., the overall click rate across participants) so users can benchmark themselves—without personal reporting.

Yes. We provide, among other things, a data processing Yes. We provide a Data Processing Agreement (DPA/AVV), documented technical and organizational measures (TOMs), defined retention/deletion periods, and templates for GDPR Art. 13 information. Data is processed within the EU/EEA.