Why a provider comparison is important for DACH companies

Selecting security awareness training is no longer a purely technical decision for companies in the German-speaking region. With the NIS2 Directive, the KRITIS Regulation, and the increasing requirements of cyber insurance, the choice of provider is increasingly becoming a question of compliance: Can the platform deliver the required documentation? Is it designed for the DACH legal framework? And who is content-wise behind the training materials?

This comparison pits three providers against each other, representing different philosophies: DeeplySecure as a scientifically based, ZFU-certified solution for SMEs and KRITIS operators, SoSafe as a behavioral psychology-oriented platform from Cologne with a strong European focus, and KnowBe4 as the world's largest provider with the most extensive content library.

Compact comparison at a glance

DeeplySecure in detail

DeeplySecure is designed as a ZFU-certified continuing education course – a state certification that confirms the quality and seriousness of distance learning content in the German-speaking region. The content responsibility lies with Dr. iur. Dr. rer. pol. Fabian M. Teichmann, whose research on phishing, ransomware, and NIS2 compliance regularly appears in specialist journals such as the International Cybersecurity Law Review and the Zeitschrift für Rechtspolitik (Journal of Legal Policy). This combination of academic research and practical training is a unique selling point that neither of the two competitors offers in a comparable form.

The platform is specifically aimed at SMEs and operators of critical infrastructure in the DACH region. The training content is not translated from English but was originally developed for the German-speaking legal and linguistic area – including the regulatory peculiarities of NIS2, the KRITIS Regulation, and Swiss data protection law.

Strengths

Only provider with ZFU certification in comparison. Scientific foundation through peer-reviewed publications. NIS2/KRITIS reporting as an integral part, not as an add-on module. DACH-native content without loss of translation. Transparent fixed price model from €4,950/year.

Ideal for

SMEs with 20–500 employees, KRITIS operators in the energy sector, healthcare, or transport, companies with NIS2 documentation obligations that need a scientifically proven and certified solution.

SoSafe in detail

SoSafe is a provider founded in Cologne in 2018 that, according to its own statements, serves over 4,000 customers worldwide. The platform is based on a behavioral psychology approach: gamification elements, story-based learning experiences, and adaptive learning paths are intended to ensure that employees not only absorb knowledge but actually change their behavior. SoSafe advertises a 90 percent reduction in risky behavior and a 50 percent reduction in training time.

As a European company, SoSafe offers full GDPR compliance with EU data hosting and complies with the co-determination audits of European works councils. The platform is available in 34 languages, making it suitable for globally operating companies. SoSafe offers one-click exports for NIS2 and DORA audits.

Strengths

Strong behavioral psychology approach with demonstrable behavioral changes. Human Risk OS for real-time risk assessment. Full GDPR compliance, EU data hosting. 34 languages for global organizations. AI-powered, adaptive phishing simulations.

Limitations

No state certification (e.g. ZFU). No peer-reviewed scientific publication history behind the content. Prices not public; individual offer request required. Primarily designed for medium to larger organizations.

KnowBe4 in detail

KnowBe4, headquartered in Tampa, Florida, is the world's largest provider of security awareness training and, according to its own statements, serves over 70,000 customers. With the acquisition of the Darmstadt-based company IT-Seal in 2023, the DACH portfolio was strengthened. The platform has the largest content library in the industry, with over 1,000 training modules in more than 35 languages and over 25,000 phishing templates.

Since 2026, KnowBe4 has been increasingly relying on AI: the so-called AIDA (Artificial Intelligence Defense Agents) automate campaign management, dynamically adapt training frequency and difficulty to individual risk profiles, and deliver personalized training recommendations. KnowBe4 advertises that it can reduce the average Phish-prone percentage from 33.1 percent to 4.1 percent within 12 months.

Strengths

Largest content library worldwide (1,000+ modules, 25,000+ phishing templates). 15+ years of threat data as a knowledge base. AI-native platform (AIDA) with automated campaign control. Scalable for globally active corporations. Over 60 integrated reporting functions.

Limitations

US company, subject to the CLOUD Act – relevant for DACH compliance assessment. DACH-specific modules only since IT-Seal acquisition in 2023 – integration depth varies. No state certification (e.g. ZFU). High volume of content can be overwhelming for SMEs without an internal IT department. Pricing structure in US dollars; higher tiers (Diamond) hard to afford for SMEs.

Which provider fits which company profile?

Pricing comparison: What does security awareness training cost?

Pricing in the security awareness training market varies considerably – industry-wide estimates range from 2 to 8 euros per employee per month. For a company with 100 employees, this means an annual budget of between 2,400 and 9,600 euros – a range that requires careful evaluation.

Note: When evaluating total costs, implementation effort, ongoing administration, and any additional modules (e.g., compliance add-ons for KnowBe4) should be taken into account alongside the license. Transparent fixed-price models like DeeplySecure's simplify budget planning, while custom offers like SoSafe's provide flexibility for complex requirements.

Excursus: Why a scientific foundation is a mark of quality

Most awareness platforms rely on internal surveys, marketing studies, or aggregated threat data. DeeplySecure takes a different approach: the training content is based on research findings published in peer-reviewed journals – meaning they have been reviewed by independent experts and are permanently accessible in academic databases.

In concrete terms, this means: when DeeplySecure explains how spear-phishing works, this explanation is based on the study “Phishing Attacks: Risks and Challenges for Law Firms" (Teichmann & Boticiu, 2024, International Cybersecurity Law Review). When the platform outlines NIS2 reporting obligations, it follows the analysis “NIS-2 in the Energy Industry" (Teichmann, 2025, Zeitschrift für das gesamte Recht der Energiewirtschaft). Every core statement is sourced – a crucial criterion for companies that must document their awareness measures for supervisory authorities or insurers.

Frequently asked questions about provider comparison

Which security awareness provider is best for German SMEs?

That depends on the specific requirement profile. For SMEs with NIS2 obligations and a need for certified, DACH-native content, DeeplySecure offers the most suitable solution. For companies focusing primarily on behavioral psychology methods and gamification, SoSafe is a strong choice. For globally active organizations with existing security infrastructure, KnowBe4 is often the most scalable option.

What distinguishes DeeplySecure from SoSafe and KnowBe4?

DeeplySecure is the only provider in the comparison with ZFU certification and a peer-reviewed scientific foundation by Dr. Dr. Fabian Teichmann. The content was originally developed for the DACH legal framework – not translated – and NIS2/KRITIS reporting is an integral part of the platform.

Is KnowBe4 GDPR compliant?

KnowBe4 offers EU hosting and data processing agreements (DPA). However, as a US company, KnowBe4 is subject to the CLOUD Act, which under certain circumstances allows US authorities access to data – regardless of the storage location. For companies with high data protection requirements, this aspect should be factored into the evaluation.

What does security awareness training cost for a company with 100 employees?

Industry-wide estimates range from 2 to 8 euros per employee per month – which corresponds to 2,400 to 9,600 euros per year. DeeplySecure offers a transparent fixed-price model starting at 4,950 euros per year. With SoSafe and KnowBe4, the price depends on the scope of the package and contract duration.

Do I as an SME need an awareness platform at all, or are internal training courses enough?

Internal training sessions can lay a foundation, but they usually do not meet the documentation and proof requirements of NIS2 and KRITIS. A platform provides measurable key performance indicators (click rate, reporting rate), complete training logs, and audit-ready exports – elements that can make all the difference in an official audit or an insurance claim event.

What does ZFU certification mean in security awareness training?

The German State Central Office for Distance Learning (ZFU) audits and certifies distance learning offers in Germany. A ZFU certification confirms that the learning content is professionally correct, didactically prepared, and legally sound from a consumer protection standpoint. DeeplySecure is the only provider in this comparison with this certification.

Conclusion

All three providers have their justification – the best choice depends on the specific corporate context. For DACH SMEs and KRITIS operators looking for a scientifically established, state-certified, and regulatorily precise solution, DeeplySecure offers a profile that neither SoSafe nor KnowBe4 covers in this combination: ZFU certification, peer-reviewed research as a content basis, and NIS2/KRITIS compliance as a core element rather than an add-on module.

Sources and methodology

This comparison is based on publicly available information from the provider websites (deeplysecure.com, sosafe-awareness.com, knowbe4.com), review platforms (G2, OMR Reviews, GetApp, Capterra), independent industry analyses, as well as the scientific publications of Dr. Dr. Fabian Teichmann. All price indications are benchmark values (as of July 2026) and may vary depending on company size and negotiation.

Transparency note: DeeplySecure is an offering of Teichmann International (IT Solutions) AG, which publishes this comparison page. The presentation of competitors is based on publicly available facts and does not claim to be exhaustive.