Business is serious enough, let’s have some fun together (this month). :-)
That’s our motto for Human Defense Month. This October, CYBERDISE is supporting Cybersecurity Awareness Month with free exercises and educational content that organisations can use with their teams. We’re starting with something for our and your office walls, meeting rooms and security team: 23 security awareness poster designs across five sets, each available in English and German.
Editable security awareness posters in English and German
Some are serious, some borrow from cinema and arcade games, and a few are deliberately ridiculous. Did your CEO really join OnlyFans? Probably a good moment to pause before following that link ;-)
The content is free to use and free to modify. Add your company logo, remove ours, adapt the wording or include your internal reporting contact. The posters come as PNGs and A3/A4 PDFs, with editable SVG layouts for changing the text and branding. Use whatever fits your organisation.
The poster ideas were sketched by hand and the files were built using AI. All poster files and their content have undergone a manual inspection using the four-eyes principle. Let us know if you spot an error, or fix it yourself when you edit the SVG file.
Set 1: Small actions that help us defend
Four everyday situations, including a reminder for security teams themselves.
- Looking real: Verify unusual requests through contact details you already trust.
- The CFO callback: Even an urgent payment request can wait for verification.
- Your report, our next move: Your warning helps the security team decide what happens next. Human signals matter in the age of AI!
- Thanks: Acknowledge employee reports, give feedback and keep people involved.

Set 2: Familiar visuals, updated messages
- Be a legend: Practise recognising, verifying and reporting, so the real thing is less likely to work.
- A link is not an order: Use your usual ‘app’ to check unexpected sign-in requests.
- Ruin their day: Report suspicious messages and calls so your security team can act.
- Cute bot: Check what work data you can share with AI.

Set 3: Horses, aliens and no end-level
A little nostalgia, one deliberately gloomy poster, and encouragement to keep practising.
- Trojan Trap: Check unexpected attachments with the sender through a known number.
- Ransomware: Use employee signals and feedback to prepare for the next wave.
- Phishing and smishing: Not every message comes in peace; report anything that feels suspicious.
- Keep calm: Already clicked? Tell your security team what happened and when.
- Pac-Man: Report suspicious messages before deleting them to help protect the next person.

Set 4: A little humour helps
Some curiosity, coffee and the occasional ‘bad’ word are part of the conversation.
- CEO on OnlyFans: Pause at curiosity bait; report suspicious messages instead of forwarding them.
- Free USB: That free USB stick could become surprisingly expensive; hand it to IT.
- Chatbot therapist: A good listener doesn’t need access to your work secrets.
- Before our first coffee: Your security team welcomes warnings, even before the caffeine kicks in.
- Oops in an exercise: Let’s practise, discuss what happened and improve together.

Set 5: Current attacks, practical responses
QR codes, ClickFix scenarios and familiar voices all deserve a closer look.
- Quishing: Unexpected QR payment or login request? Open the service through your usual app.
- ClickFix: A webpage asks you to run a command? Stop and contact IT.
- Sharing is caring: Check photos and screenshots for sensitive details before posting.
- AI can fake the voice: A familiar voice doesn’t replace a callback and the agreed approval process.
- Microsoft System Administrator: An impressive sender name isn’t proof; verify unexpected requests with IT.

A poster is a great supplementary measure (only)
A poster alone won’t change how an organisation responds to an attack. It can start a conversation, remind someone of a useful action or make it easier to ask for help. Put it alongside your Behavioral Defense Engineering (BDE) program and your awareness campaigns, discuss what happened and give people feedback when they report something suspicious.
That’s the spirit of Behavioral Defense Engineering: employees are part of the solution. We practise attacks, recognising, verifying and reporting together, and their warnings become useful signals for the people defending the organisation. The relationship between employees and the security team matters as much as the message on the wall.
All posters are available in CYBERDISE version 3.3, with a selection also available on our website.
Appendix: security awareness poster titles EN/DE
Set 1
- Looking real is part of the scam / Echt aussehen gehört zum Trick
- Your CFO can survive a 30-second callback / Dein Finanzchef überlebt einen 30-Sekunden-Rückruf
- Your report. Our next move. / Deine Meldung. Unser nächster Schritt
- Great defence starts also with “Thanks.” / Gute Abwehr beginnt auch mit «Danke».
Set 2
- Be a legend / Werde zur Legende
- A link is not an order / Ein Link ist kein Befehl
- Cybercriminals have a plan. Ruin their day. / Cyberkriminelle haben einen Plan. Versau ihnen den Tag.
- Cute bot. Keep your secrets. / Süsser Bot. Behalt deine Geheimnisse.
Set 3
- Nice horse. Who sent it? / Schönes Pferdchen. Wer hat’s geschickt?
- There’s no final level. Keep levelling up. / Es gibt kein letztes Level. Bleib in der Übung.
- Not every message comes in peace. / Nicht jede Nachricht kommt in Frieden.
- Keep calm. Even if you clicked. / Bleib ruhig. Auch wenn du geklickt hast.
- Don’t just ignore it. Report it. / Nicht nur ignorieren. Auch melden.
Set 4
- Did my CEO join OnlyFans? Really? / Echt jetzt? Ist mein CEO jetzt wirklich auf OnlyFans?
- Free USB stick. Potentially very expensive. / Gratis USB-Stick. Potenziell sehr teuer.
- Great listener. Still not your therapist. / Hört super zu. Ist trotzdem kein Therapeut.
- Yes, tell us. Even before our first coffee. / Ja, sag’s uns. Auch vor dem ersten Kaffee.
- Better an “oops” in an exercise than an “oh shit” in an incident. / Lieber «uups» in der Übung als «shit!» im Ernstfall.
Set 5
- Phishing. Now in square format. / Phishing. Jetzt auch quadratisch.
- That “fix” could be the problem. / Diese «Lösung» könnte das Problem sein.
- Sharing is caring. Scammers love that motto. / Sharing ist caring. Nicht bei Betrügern.
- AI can fake the voice. Our approval process still applies. / KI kann die Stimme fälschen. Unser Freigabeprozess gilt trotzdem.
- “Microsoft System Administrator.” Says who? / «Microsoft System Administrator». Sagt wer?




