CYBERSECURITY MONTH 2026
Make awareness a demonstrable programme, not a box to tick.
Under NIS2, training and cyber hygiene become risk management measures expected of essential and important entities. BlueSecure helps you structure, deploy, run and document your programme, and produce the evidence you need in case of an inspection.
- Leadership and users
- Continuous programme
- Exportable evidence
Two audiences targeted by NIS2
- LeadershipGet trained, approve and oversee the measures.
- All usersCyber hygiene and ongoing training.
Awareness now falls within risk management
NIS2 no longer treats awareness as an optional good practice. Two points directly concern training people.
Leadership accountability
Management bodies approve the risk management measures, oversee their implementation, and follow training to identify risks and assess risk management practices. Training employees is also required by the directive, as part of the minimum risk management measures.
Cyber hygiene and training
Basic cyber hygiene practices and cybersecurity training are among the minimum measures expected, appropriate and proportionate to the organization's risks.
- Article 20 (governance): members of management bodies are required to follow training to identify risks and assess cyber risk management practices.
- Article 21(2)(g): “basic cyber hygiene practices and cybersecurity training” are among the minimum measures required, for the whole organization.
A programme for every user, throughout their time with you
The expectation is an awareness programme for all users, with actions from arrival to departure. A recurring approach, adapted to risks and built into your governance, rather than an isolated annual training session.
Arrival and onboarding
In role · recurring campaigns
Changes · new risks
Departure
How BlueSecure meets each expectation
Raise awareness among all users
Learning Academy e-learning and micro-learning paths (over 100 modules), deployable across the whole organization, in 12 languages.
Act throughout the lifecycle
Onboarding paths, recurring campaigns and new content every month to anchor reflexes over time.
Adapt to each profile
Content for business roles, IT teams and developers (Red Code), sensitive functions and leadership, with a dedicated NIS2 module and the Blackout crisis exercise.
Track participation and progress
Real-time dashboards, completion tracking and the BlueSecure Risk Index, the score that follows the risk level over time.
Produce evidence
Attestations, certificates, PDF and Excel exports, API, and Smart Report reports sent automatically to your leadership.
Build a cyber culture
An approach through experience and play that goes beyond mere compliance.
The building blocks for the awareness requirements
Learning Academy
A catalogue of over 100 modules (cyber culture, phishing, GDPR, NIS2, DORA, social engineering, passwords, mobility), quizzes, badges and attestations, with dedicated NIS2 modules for employees and leadership.
Phishing 360
Simulations across eight channels: email, text message, USB key, QR code, physical mail, physical intrusion (building breach), vishing and deepfake, with retargeting based on the risk score.
Workshop
Talks for management bodies, a deepfake workshop, and the Blackout crisis exercise where each participant plays in turn the user, CISO, DPO, communications and leadership.
Risk Index · DataWatch · Smart Report
The BlueSecure Risk Index tracks the risk level by entity, DataWatch monitors data leaks, and Smart Report reports automatically send the indicators to your leadership, at the pace you choose.
Document what you do, prove it in case of an inspection
A one-off campaign is not enough: you need to show that the programme exists, reaches the right audiences, recurs and improves. BlueSecure keeps a history of actions, audiences, participation rates and results, and makes them exportable for your internal reviews, audits and stakeholders.
- PDF export
- Excel export
- API
- Attestations
- BlueSecure Risk Index
- Smart Report
In an audit, you show who was trained, on which topics, with which results, and how the programme improves over time, with the supporting documents.
Data that stays in France
A NIS2 programme is run on sensitive data. The platform is hosted in France, by an ISO 27001 certified hosting provider. Your data falls under no non-European jurisdiction and is not subject to extraterritorial laws such as the US CLOUD Act. If your context requires it, SecNumCloud, dedicated server or on-premise options are available.
NIS2 and awareness: your questions
- Does BlueSecure make me NIS2 compliant?
- BlueSecure helps implement and document the awareness and training part of the regulation. NIS2 compliance, however, covers a wider scope: governance, risk management, system security, incident handling, business continuity, supply chain, access control, monitoring and crisis management. Our module dedicated to leadership is an excellent starting point to raise the executive committee's awareness of the stakes and launch the actions needed for compliance.
- Which audiences are covered?
- All users, with paths adapted to business roles, IT teams, sensitive functions, contractors with access to the information system, and leadership.
- How do we prove our actions in case of an inspection or audit?
- Through the dashboards, the campaign history, attestations and certificates, PDF, Excel and API exports, and Smart Report reports that document the programme over time.
- Is leadership really concerned?
- Yes. NIS2 expects management bodies to get trained. BlueSecure offers suitable formats: talks, the Blackout crisis management exercise and an online path designed specifically for leadership.
Let's structure your NIS2 awareness programme.
Let's talk about your audiences, your risks and your evidence needs. We will show you how to deploy a continuous, documented programme.