The next attack on your company starts with a single click

• Phishing in the name of Skatturinn

  Spoofed emails posing as the tax authority, Landspítalinn or local banks, often very convincing, funnel staff onto lookalike sites and harvest credentials in seconds.

• AI voice cloning over the phone

  Attackers use AI to mimic a CEO's or partner's voice and demand a transfer 'right now'. Five seconds of voice from social media is enough to build a convincing copy.

• Ransomware against small businesses

  Small and mid-sized firms have become a preferred target precisely because their defences are thinner than enterprise. One click on the wrong attachment can shut a business down for weeks.

• Kennitala scams and fake government sites

  Fake portals impersonating vehicle registration, driving licence renewal or Þjóðskrá harvest kennitölur and bank details that later get used for identity theft.

What these attacks have in common: they breach through people, not through systems. You cannot buy your way out of this problem with another firewall.

1. 1

   NIS2 is coming

   NIS2 demands far more than the old rules on cybersecurity, staff training and management accountability, and many more companies are in scope. In the EU the directive is already in force; in Iceland implementation is being prepared through amendments to the cybersecurity act. A company that gets regular, documented training running now is ready when the requirements take effect here, and towards EU customers who already operate under them.

2. 2

   Cyber insurance requires it

   Cyber insurance premiums have risen sharply, and insurers increasingly ask about staff security training in application and renewal processes. Documented training strengthens the company's position in that conversation.

3. 3

   Your customers are asking

   Large customers now send security questionnaires with their RFPs. 'What security training does your staff receive?' is a standard question. If you can't answer it, you lose the contract.

Read more about NIS2 Or keep reading. The rest of this page walks through the solution.

1. 1

   It's in English. Staff skim half the words. One might pass the quiz, but behaviour doesn't change.

2. 2

   Each course is an hour long. Nobody finishes them. The ones who do forget them a week later.

3. 3

   Training happens once a year. The attacker shows up in October and the people you trained in January have already forgotten.

4. 4

   No measurement. You don't know who completed, who failed, who's overdue. Any serious audit request can't be answered.

5. 5

   Priced for US enterprises. Smaller companies either pay absurd prices for something they don't use, or give up and do nothing.

• In Icelandic, with real examples

  Phishing in Skatturinn's name, kennitala fraud, AI voice cloning in Icelandic. Content staff recognise from their own inbox.

• Five minutes, once a month

  Each module is five minutes, ending in a short quiz. Total time per year: one hour. That's the time a staff member is willing to give, and the repetition is what does the training.

• Reminders and audit reports run themselves

  The system nudges staff when a module is due, issues certificates automatically when they pass, and produces a monthly audit report for leadership. Nothing to track in a spreadsheet.

• Three minutes to set up

  Sign in with Microsoft, Google or an email link, type the company name, share a sign-up link in Teams. Staff get themselves in, so you don't have to send invites to 50 people.

• Language

  Conventional training

  English, often a poor translation

  Varhugi

  Icelandic, English and Polish, with realistic Icelandic examples

• Time

  Conventional training

  1+ hour once a year

  Varhugi

  5 minutes a month, same total time, far better retention

• Setup

  Conventional training

  Onboarding call, hours of configuration

  Varhugi

  Self-serve, ready in 3 minutes

• Audit reports

  Conventional training

  An afterthought, in Excel if at all

  Varhugi

  Automatic monthly report, NIS2-ready

• Pricing

  Conventional training

  Per-seat in dollars, minimum contracts

  Varhugi

  Fair flat pricing, free for a single user

• An accountant gets an email from the 'CEO' at 16:45 on a Friday

  Without Varhugi

  'Anna, can you approve this transfer before the bank closes? Confidential, don't ask anyone else.' Anna sends 1.2 million ISK to an account that turns out to be in the Bahamas.

  With Varhugi

  Anna remembers last month's module on CEO fraud. She calls the CEO on the number she knows, confirms he sent nothing, and tells IT. Loss: zero.

• A staff member accidentally uploads a loan contract to a 'free PDF converter'

  Without Varhugi

  He finds a site on Google, uploads the document with kennitölur, financial details and contract text. The site keeps everything for a year and resells it to marketing firms. The GDPR data is in Singapore by the time the breach is discovered.

  With Varhugi

  Last month's module on shadow IT told him to use the Microsoft 365 tool the company already pays for. Takes 30 seconds longer. Nothing leaves the EEA.

• The sales phone rings and 'Microsoft IT' asks for an MFA code

  Without Varhugi

  The salesperson reads out the code. The attacker gets into the company's Microsoft 365 account, blasts phishing email to every customer from that account, and uses the contact lists to target partners.

  With Varhugi

  The salesperson remembers that no legitimate IT desk asks for an MFA code over the phone. Hangs up, calls IT on the known number to report it. The account is still safe.

1. Today, three minutes

   You sign in with Microsoft, Google or an email link, enter the company name and copy a sign-up link.

2. Days 1 to 3

   You send a ready-made announcement in Teams or email. Staff click, sign in and the first module is waiting: five minutes with a short quiz.

3. Weeks 2 to 4

   Reminders go out by themselves to whoever is behind. You see the status on the dashboard, who is late and who needs follow-up.

4. Month 1

   The first monthly report is ready: who completed, when, with certificates anyone can verify. The next module is scheduled automatically.

• Executive management

  A single incident can halt operations, damage reputation and cost many times more than every defence combined. The vast majority of attacks start with staff, so training them is the investment that cuts the most risk for the least money.

  • Costs a fraction of the damage from one incident
  • One hour per employee per year, no disruption to operations
  • Answers customer security questionnaires and lowers cyber-insurance premiums

• Security manager and IT

  The training runs itself and the evidence is produced automatically. The dashboard shows in real time who has completed training, where the weak spots are and who needs follow-up, with nothing to track in Excel.

  • Automatic reminders, certificates and a one-click audit report
  • A dashboard with status, weakest topics and people who need attention
  • Sign-in with Microsoft or Google, no new passwords and no implementation project

• The board

  NIS2 places the accountability on the board: it approves the security measures, oversees them and undergoes training itself. Neglect can carry personal liability for board members. Documented training is the proof that the oversight duty is being met.

  • Handles the Article 21 training element of NIS2 and documents it
  • The board can take the same training as the staff
  • Training status always ready for board meetings and audits

We have an IT provider that handles security.

Good, they protect the systems. Varhugi protects the people, which is where most attacks start. The two complement each other: a firewall does not stop an employee giving their password away over the phone.

Our staff won't do it.

Five minutes a month is a request people say yes to. The system sends reminders itself, the dashboard shows who is behind and a department manager sees their own team. You send one ready-made announcement and let the system do the follow-up.

Is this enough for NIS2?

For the training obligation, yes: regular, documented training with certificates, a monthly report and a mapping to the directive's requirements, article by article. NIS2 also demands other things, on risk management, incident reporting and more, which Varhugi does not solve and does not claim to.

What happens to our data?

Names, emails and training results, hosted in the EEA. The Data Processing Agreement applies automatically, subprocessors are published, and if you leave the data is returned or deleted within 30 days.

Is it expensive?

Lite is 9,900 ISK a month for up to 25 people, under 400 ISK per employee per month when the seats are used. The training itself takes one hour per employee per year. One incident costs many times the whole year.

We have a security policy and held a lecture.

One lecture gets forgotten; that is exactly the problem this page describes above. You can put the policy into Varhugi and have every employee confirm they have read it, with a date that appears in the report.

Read about the NIS2 obligationsSecurity and data protectionSee pricing