SoSafe and the art of the second thought

The dangerous email does not announce itself as a test of human psychology. It asks for something ordinary: approve this invoice, open this document, fix this account. The recipient may know every rule in the security handbook. The problem arrives in the few seconds when an apparently reasonable request meets a crowded working day.

That gap between knowledge and action is where SoSafe has built its business. The Cologne company says it serves more than 6,000 organizations. Its customers include Aldi Nord, Deutsche Telekom, WWF, and Scandinavian Airlines. These are very different workplaces, united by an inconvenient fact: people have to make security decisions while doing something else.

A psychologist walks into the inbox

SoSafe began in 2018 with three founders: psychologist Niklas Hellemann, business specialist Lukas Schaefer, and software specialist Felix Schürholz. Hellemann had worked at BCG. His interest was persuasion: how people can be induced to do things, and how the same understanding might help them resist.

In a 2025 interview, he recalled a friend’s grandmother losing a substantial six-figure sum to a scammer. The harm included shame and lost trust. Security, viewed from that angle, becomes a problem of human confidence as well as protected systems.

The founders tested their idea with the people who would buy it. Hellemann told Highland Europe that they spoke to security managers before writing code. Early revenue helped validate the approach. There is a useful lesson here for any software business: discover how the buyer’s day works before deciding what the product should do.

“Getting in front of customers early was the best investment we made.”Niklas Hellemann · founder interview

That people-centered argument also runs through SoSafe’s own organization. Its about page says more than 30% of the product team comes from social science or psychology. Hellemann describes a hybrid company that invests in off-sites and quarterly strategy weeks. The work of building a shared culture becomes more deliberate as the organization grows.

The rehearsal is the product

SoSafe packages security awareness into lessons lasting roughly one to eight minutes. Storytelling, quizzes, and gamification give people something to do with the information. Personalized learning adapts to existing knowledge and roles. The intention is repeated practice that fits around work.

Simulated attacks move that practice into recognizable situations. The platform adjusts frequency and difficulty according to behavior, with scenarios spanning email, SMS, and voice. A reporting button gives employees a direct route for flagging suspicious messages. For administrators, reports and analytics connect learning activity to observable responses.

Then there is Sofie, the AI copilot inside Teams, Slack, and email workflows. Organizations can supply internal policies so its answers reflect their rules. Sofie can distribute alerts and route complicated questions to internal support. The attraction is proximity: help appears in tools employees already use.

Introduced in May 2024, the Human Risk OS ties the wider system together. Behavioral signals feed the Human Security Index; an intervention layer helps teams decide where to act. The ambition is to make training part of an ongoing management process, with awareness, behavior, and culture all contributing information.

KnowBe4 and Hoxhunt compete in this territory, including adaptive training and human risk management. SoSafe’s case rests on the combination it offers: behavioral expertise, European privacy positioning, localized learning, and connected workflows. Those are purchasing criteria to investigate in a trial, rather than exclusive inventions.

Connections to other systems matter, too. A Vanta integration sends learning progress into compliance reporting. Organizations can deliver content through existing learning management systems, while identity integrations support user administration. For a security team already juggling several tools, the value depends partly on how much routine work disappears after deployment.

Seven tenants. One awkward problem.

Fellowmind, a European technology services business, supplies a useful example. Its security team had been managing phishing simulations and e-learning separately across regions. The arrangement complicated campaigns while certification work added pressure. A unified rollout put seven tenants in one environment, with monthly learning and country-level analysis.

In SoSafe’s published case study, Fellowmind reports a 74% reduction in interactions with simulated phishing emails and a 97% average training score. Some markets recorded click rates as low as 3.5%. These are customer-reported simulation and learning results. They do not establish an equivalent reduction in breaches.

The transferable part is the operating routine: consolidate administration, teach regularly, and examine differences between groups. A company-wide average can conceal the department that needs attention. Buying a platform still leaves someone responsible for acting on the findings.

The price of a second thought

SoSafe sells subscriptions directly and through partners. Its public starting price is €625 monthly, billed annually, including 50 seats: €7,500 over a year. The stated starting bundle includes onboarding, basic support, ready-made simulations, training, and reporting. Core and Advanced packages separate capabilities; buyers should establish which features their quote includes.

The company raised a $73 million Series B announced in January 2022, led by Highland Europe. It adopted the European SE legal form in January 2025. Later that year, an MSP platform extended its distribution through service providers, using a multi-tenant console developed with more than 70 beta partners.

The channel matters because smaller employers often buy security through an outside IT provider. SoSafe’s MSP offer uses a separate pricing model without a minimum purchase requirement. That gives providers a way to include training for customers whose headcounts would make a direct enterprise purchase awkward.

Make the safe action the easy action

Recent releases show how mundane constraints shape the product. In 2026, SoSafe introduced browser-based voice-phishing practice, avoiding the need to collect private employee phone numbers. Policy-to-Lesson converts policy documents into editable training. September’s Recreate Attack lets teams turn screenshots of actual phishing emails into simulations.

Browser-based practice also has a boundary: a scheduled lesson cannot reproduce every surprise of an unsolicited call. Buyers should ask how the program combines guided exercises with realistic scenarios, and how employees can escalate uncertainty afterward.

The practical lesson is to reduce the distance between the threat, the rehearsal, and the response. Success still needs participation, relevant scenarios, trustworthy data, and a team that follows up. If reporting leads to silence, or training becomes a punishment, the design has lost its purpose. A useful test for any buyer: can an uncertain employee get help, report a concern, and return to work with a better next move?