AFAS is one of the biggest names in Dutch HRM and payroll software, and security has always been something the company takes seriously.
The way AFAS and Guardey first came into contact, however, was a little unusual. A mutual customer was running a phishing simulation with Guardey and used a phishing template based on AFAS. Some employees who received the simulated phishing email did not report it to their own IT or security team. Instead, they contacted AFAS directly to warn them that suspicious emails were being sent in their name.
For AFAS, that initially looked like a real security incident.
That led to the first conversations between AFAS and Guardey and eventually to a way of working around the use of AFAS in phishing simulations. It also opened up a broader conversation about security awareness. Not long after, AFAS adopted Guardey’s security awareness program for its own organization.
Today, the program reaches all 700 employees at AFAS, from developers to colleagues in the kitchen and cleaning staff. But as Ignaece Bliekendaal, CISO at AFAS, and Rik ten Wolde, who works in marketing and internal communication, explain, rolling out a security awareness program is only the beginning. Getting people to participate, and giving them a reason to keep participating, takes active attention from the organization itself.
Moving beyond the annual security training
Before Guardey, AFAS had a security awareness setup that will sound familiar to a lot of companies: a mandatory training or webinar roughly once a year, supplemented by occasional updates when something relevant had happened.
“People are never really actively involved that way,” Ignaece explains. “In the moment they think, yes, security is important, you’re right. A week later that feeling has faded, and the next year you can almost tell the same story again.”
At that point, AFAS was already investing seriously in digital resilience. The company had put several technical layers of defense in place to limit the impact of human error. For example, employees were required to use a password manager and could only access company applications from systems managed by AFAS. Security awareness, however, had not yet received the attention it deserved.
As the company grew, that calculation started to change.
“You become a bigger target, more relevant to certain groups,” Ignaece says. “We even have to account for the possibility that state actors are interested in us. That changes the playing field, and it makes the case for really bringing your employees along on cybersecurity.”
That was what appealed to him about Guardey’s approach: rather than relying on one big annual training moment, employees encounter security topics repeatedly in short challenges.
“If you do something ten thousand times, you tend to get good at it. That’s true in professional sports, and I think it’s true here. Repetition is really the only way to build the habit.”
If you do something ten thousand times, you tend to get good at it. That's true in professional sports, and I think it's true here.
A launch built around how AFAS already communicates
AFAS did not introduce Guardey with just an email announcing that employees now had another training to complete. Instead, the company used its Culture Half Hour, an online program that AFAS records in its own studio and shares across the organization. That existing format became one of the main ways to introduce Guardey.
And instead of starting with an explanation of the platform, AFAS started with something that had actually happened. A newly hired developer had fallen for a phishing attempt. Despite being technically knowledgeable and thinking he would recognize something like this, it had happened to him too. He agreed to talk openly about the experience during the Culture Half Hour.
That gave AFAS a much more relatable way to introduce the program. Phishing was no longer an abstract security scenario. It was something that could happen to someone inside the company, including someone with technical knowledge.
AFAS reinforced the introduction through its intranet and other internal channels. The idea was simple: if security awareness was going to become part of people’s routines, employees first needed to understand why it mattered.
Finding an incentive employees actually cared about
Communication was only one part of the launch. AFAS also wanted to make use of Guardey’s competitive element to give employees an extra reason to participate. That raised a question that sounds simple but became central to their approach: what would people at AFAS actually want to win?
The team considered familiar incentives such as gift cards, AirPods and iPads. But a more expensive prize is not automatically a more motivating one.
“You don’t actually know if people are waiting for that,” Rik explains. “The prize can be expensive without being something people want.”
So instead of starting with a catalogue of prizes, AFAS looked at what people across the organization were already talking about. At the time, that was the upcoming annual company trip. Because AFAS had already booked an entire hotel for the trip, some rooms were naturally more luxurious than others. One of the nicer rooms, complete with a jacuzzi, became the main prize in the Guardey competition.
“It didn’t cost us anything extra,” Rik explains. “Those rooms were already part of the hotel we’d booked. We just had to decide to make one of them the prize instead of handing it out at random.”
The result was a launch participation rate of nearly 90%. The lesson for AFAS was not that every security awareness program needs a spectacular prize. It was that an incentive works best when it connects to something employees already care about.
Giving more people a reason to stay in the game
The first incentive worked well, but AFAS also discovered why engagement cannot be designed once and then left alone. After around ten weeks, participation began to soften. With one major prize on the line, employees who no longer thought they could reach the top had less reason to keep competing. So AFAS broadened the ways employees could be rewarded.
Instead of focusing only on whoever achieved the highest score, they introduced a team-based reward, with extra luggage allowance for the group with the strongest collective result. There were also rewards for consistency and for the employee who showed the biggest improvement between two seasons.
That last category was particularly important.
“We’re not really looking for the developer who’s already at the top of the ranking, because they’ll usually do well anyway,” Ignaece explains. “We’re trying to reach the other groups too.”
That includes colleagues in AFAS’s kitchen and cleaning teams, who have much less interaction with computers in their daily work and do not necessarily have access to sensitive systems. But that does not make security awareness irrelevant to them.
“This isn’t only about your work,” Ignaece tells employees who question whether a topic applies to their role. “It’s about you as a person too, about your own situation, and about being aware of how you handle things.”
This isn't only about your work. It's about you as a person too, about your own situation, and about being aware of how you handle things.
That philosophy was already part of how AFAS approached digital resilience before Guardey. Employees are not only expected to use a password manager professionally, for example, but are also given the opportunity to use it in their private lives. Security is treated as something employees can benefit from beyond the workplace too.
The Guardey program itself is mandatory, but AFAS deliberately chooses not to enforce participation through technical restrictions such as blocking access to systems until training has been completed.
“That would work, but it doesn’t fit our culture,” Ignaece says. “We’d rather get there in a positive way.”
Making the training recognizably AFAS
The same principle applies to the content itself. Guardey provides ready-made challenges, campaigns and communication templates, but AFAS’s advice to other organizations is not to simply take everything as it comes. Customize it.
“That’s the thing I’m still genuinely enthusiastic about, the ability to tailor every training to your own organization,” Ignaece says.
AFAS has replaced generic examples with its own software and swapped stock imagery for its own photography. Small changes, but ones that make the scenarios feel closer to employees’ actual environment.
“People don’t always see that a training is actually relevant to them,” Rik says. “Once you put your own sauce on it, they do.”
AFAS would like to do this even more consistently. Finding the internal time to customize content has not always been easy, but both Ignaece and Rik see it as an important way to make awareness feel relevant rather than generic.
The same applies to Guardey’s communication templates, ambassador programs and campaign ideas. They can provide a starting point, but the organization still has to decide how those ideas fit its own culture.
“Take the ideas, take the templates,” Ignaece says, “but make them your own. Apply them to what actually works inside your organization, not what worked inside ours.”
People don't always see that a training is actually relevant to them. Once you put your own sauce on it, they do.
Security awareness does not run itself
With its first seasons behind it, AFAS is continuing to look at what will keep employees involved next. The company trip provided a strong hook for the launch, but it was relevant because of what was happening inside AFAS at that particular moment. The next incentive may need to be completely different.
And that is perhaps the most useful lesson from AFAS’s experience so far. Gamification, competition and short recurring challenges can give organizations the mechanics to make security awareness more engaging. Templates and ready-made campaigns can make implementation easier. But none of those things remove the need to understand your own employees.
AFAS used a real employee story because it made the risk tangible. It introduced the program through channels people already paid attention to. It connected the competition to something employees were already excited about. And when one way of rewarding participation could no longer motivate everyone, it created new ways for people and teams to succeed.
There is no single incentive, launch campaign or communication template that will keep every employee engaged forever. The organizations that get the most out of security awareness are the ones that keep asking the same question AFAS does:
What will work for our people now?
We are always there for you, promise!
Register now for free and never stress about cyber crime again.
Start 14-day free trial
