Security Awareness Training and Phishing Simulation, Built for Swedish Teams

Yes. Article 21.2g of NIS2, transposed into Sweden's Cybersäkerhetslagen (SFS 2025:1506), lists basic cyber hygiene and security awareness training as one of ten mandatory risk-management measures. Article 20 adds a separate duty to train the management body. Both have applied since the law took force on 15 January 2026.

Yes, when done correctly. Phishing simulation is lawful under legitimate interest (Article 6.1.f GDPR) if you publish a policy, forewarn staff that simulations happen, limit retention of individual results, and never use a single click as grounds for discipline. eBuilder builds the programme to meet these conditions from the start.

Run simulations at least quarterly for all staff, and monthly for higher-risk roles such as finance, IT administration, leadership and HR, alongside continuous microlearning. Frequency matters more than volume: a steady, progressively harder cadence builds reporting habits, while one annual test mainly measures a single day.

The global baseline phish-prone rate is 33.1%, falling to 4.1% after twelve months of training — an 86% reduction (KnowBe4 Phishing by Industry Benchmarking Report, 2025). New programmes commonly start in the 20% to 35% range. Use your own baseline as the comparison point, not a single industry average.

Reporting rate is the share of staff who actively report a simulated phishing email, and it is the metric that predicts real-world resilience. Proofpoint customers average around 18.65%, with financial services near 32% and education near 8%. eBuilder aims to get your reporting rate above 30% within twelve months.

Yes. NIS2 Article 20, transposed into Cybersäkerhetslagen, makes the management body personally accountable for security measures and obliges it to undergo training. eBuilder offers a fixed-scope board session mapped to Article 20, with an utbildningsbevis you can keep as evidence of oversight.

eBuilder's MDR is built on CrowdStrike Falcon or Cybereason, deployed through the device management you already run. CrowdStrike threat intelligence tracks more than 230 named adversary groups globally, and eBuilder's SOC layers Swedish and Nordic threat trends on top — so detection reflects the threats actually targeting Swedish organisations.

Yes. An existing CrowdStrike or Microsoft Defender deployment speeds onboarding because eBuilder connects to your existing telemetry instead of deploying new sensors. Integration with Microsoft Defender for Endpoint, Sentinel, and Entra ID is standard — and go-live is typically under 24 hours rather than the usual three days.

AIDR is eBuilder's AI detection-and-response layer that contains fast-moving threats autonomously in milliseconds — blocking lateral movement, credential stuffing, and prompt injection before they escalate. A human analyst then validates and runs the response. AIDR handles machine-speed attacks; the named analyst handles judgement — so nothing waits on a queue.

eBuilder's MDR directly satisfies the core NIS2 Article 21 obligations: continuous monitoring, incident detection and handling, and the documentation tied to MCF reporting. It does not alone cover supply-chain security, business continuity, or awareness training — eBuilder's advisory and Complorer training services complete the remaining Article 21 scope.

Reported emails can flow into eBuilder's SOC, where they are triaged alongside real alerts. A staff member who clicks can be auto-isolated by eBuilder's AI detection and response, and simulation data enriches the risk scoring your incident response already uses. Training stops being a silo.

Not their logos without permission, which raises trademark issues. eBuilder uses generic look-alikes and your own internal senders to build realistic Swedish scenarios — fake HR, payroll, BankID and delivery messages — keeping simulations legally clean while still mimicking the lures Swedish staff actually receive.

Keep the evidence a supervisor will ask for: course material, a dated attendance list, campaign results, your simulation policy, the management body's training record, and your role-based tracks. eBuilder produces these as standard output, so reporting to MCF, PTS or Finansinspektionen is a download, not a scramble.

Indirectly. The routes for public-sector buyers are Adda IT-konsulttjänster 2021 and Kammarkollegiet's IT-konsulttjänster för IT-säkerhet. eBuilder can be procured via underleverantör clauses, or for values under the direktupphandlingsgräns of 700 000 SEK exkl. moms, through direktupphandling.

Most programmes see meaningful change inside a quarter. KnowBe4 data shows a 40% drop in phish-prone rate after three months and 86% after twelve. The first signal to watch is reporting rate climbing — that means staff are not just avoiding the bait, they are actively flagging it for your team.

Yes, if scenarios are updated continuously. ENISA's Threat Landscape 2025 reports that AI-supported phishing made up more than 80% of observed social engineering by early 2025. eBuilder refreshes Swedish-language lures to match current AI-driven techniques, so staff train against the attacks they will actually face — not last year's templates.