KausalyticsKausalytics is the platform that makes security awareness measurable and shows which measures actually reduce your risk.
Participation rates in e-learning courses and click rates in phishing simulations do not tell us whether human risk in information security is actually decreasing. What remains is steering by gut feeling, which leads to the following problems:
Investments in the human factor have so far been justified only by activity metrics, such as participation rates in e-learning and click rates in phishing simulations. A robust cost-benefit case is still lacking.
If the impact remains invisible, security awareness becomes a tedious obligation for employees and loses its strategic relevance for management.
Technical risks can already be monitored and reduced with precision. However, a reliable basis for monitoring human risk is still missing.
Meaningful metrics quantify information security risk instead of simply estimating it ad hoc. To achieve this, we combine three sources: Usage data collected through integration with your existing IT systems, surveys that meet the highest scientific standards, and phishing risk measurement. This lets you implement measures in an evidence-based, targeted way.
Meaningful metrics quantify information security risk instead of simply estimating it ad hoc. To achieve this, we combine three sources: Usage data collected through integration with your existing IT systems, surveys that meet the highest scientific standards, and phishing risk measurement. This lets you implement measures in an evidence-based, targeted way.
The impact of awareness measures is proven in a scalable way according to scientific standards, not just claimed. Instead of counting click rates, you can see exactly which measure actually reduces risk and which does not.
Evidence of cost-effectiveness and risk metrics turn security questions into informed management decisions: You can prioritize measures based on their impact, allocate budgets efficiently, and back every decision with reliable data.
Hope is not a security strategy. Yet organizations invest heavily in security awareness without knowing whether it works. This blind spot is exactly where security incidents begin. We are changing that: We make the human factor measurable and provide causal evidence showing which measures actually strengthen the human side of information security.
Human risk becomes visible, comparable, and manageable. We are setting the standard for measuring information security: providing the evidence that NIS2, DORA, and the German IT-Grundschutz framework demand, but that no one can currently deliver.
Only when risk can be measured can it be managed. Budget, time, attention, and employee engagement are among the scarcest resources in information security. We direct them where they have measurable impact. This enables organizations to demonstrate the value of every investment to the board, auditors, and insurers.
Kausalytics GmbH is a spin-off from Justus Liebig University Giessen, originating from the Data and Application Security research group led by Prof. Dr. Luigi Lo Iacono. With funding from the German Federal Ministry of Research, Technology and Space and an excellent evaluation from the Cube 5 startup incubator (Max Planck Institute for Security and Privacy and Horst Görtz Institute), we put scientific research into practice.
Our methods are based on peer-reviewed research published at two of the leading international cybersecurity conferences: the ACM Conference on Computer and Communications Security and the IEEE Symposium on Security and Privacy. Our platform is backed by an interdisciplinary team with expertise in human-centered security, organizational psychology, sociology, machine learning, and statistics.
Scientific foundation
The PhD scientist and data analyst turns complex data into clear, well-founded decisions.
Technology and product
As an experienced project lead and software developer, he builds secure, user-friendly systems with an uncompromising commitment to privacy.
A validated, lightweight instrument for measuring security awareness in heterogeneous organizations.
A large-scale phishing study at a major German university hospital: which common measures reduce risky behavior and which barely help.
JLU Giessen presents the BMFTR-funded founding project behind Kausalytics: a platform that measures the effectiveness of awareness measures.
heise online on our hospital study and its sobering findings about everyday anti-phishing measures.
The university's press release on the hospital study: warning banners work, [EXTERN] tags largely do not.
Our method is ready to use, the platform is in development. In exclusive pilot projects, we help organizations measure the human factor reliably for the first time. Schedule a no-obligation introductory call today: