“If the project has proven successful, the credit undoubtedly goes to the expertise, professionalism and commitment demonstrated by the Var Group Suisse team. The collaboration has remained excellent throughout the operational phase as well, with consistently timely support and a high level of availability whenever needed.”
- Medical
- Case Study
Clinica Hildebrand Rehabilitation Center Brissago
ABOUT
Clinica Hildebrand Rehabilitation Center Brissago is one of Switzerland’s leading centres of expertise in the field of rehabilitation medicine. Its origins date back to the 1950s: the Hildebrand Foundation, a non-profit organisation serving the public interest, was established in 1955, and in 1963 it opened the Brissago Clinic on the shores of Lake Maggiore. Today, Clinica Hildebrand Rehabilitation Center Brissago is a leading referral centre in Italian-speaking Switzerland for neurological and cardiac rehabilitation, with services that also include musculoskeletal and geriatric rehabilitation.
Challenge
For Clinica Hildebrand Rehabilitation Center Brissago, security awareness was not a new topic. The organisation had already invested in training its 420 employees, but the challenge was to evolve the existing model by making it more continuous, integrated and measurable. In fact, training was based on a platform separate from the tools used on a daily basis, requiring dedicated access and credentials. Phishing simulations were also carried out only occasionally and were not fully integrated into the training programme.
The need was therefore to go beyond a simple technology replacement and transform security awareness into an ongoing, managed process capable of bringing training closer to employees and using the results to guide subsequent activities.
Explaining the decision to undertake this evolution together with Var Group Suisse, Simone Torelli, Head of ICT Services at Clinica Hildebrand Rehabilitation Center Brissago, says: “Var Group has been a trusted partner for many years across several ICT-related areas. Extending our partnership to security awareness therefore represents a natural evolution of an already well-established relationship, characterised by effective and productive collaboration.”
Solution
Var Group Suisse’s response was to change the model, not simply the platform. The project began with an analysis of the Clinic’s needs and a PoC before full implementation: “The customised PoC and the subsequent trial period confirmed the quality of the proposed solution and its ability to meet our needs,” comments Torelli.
With the Managed Security Awareness service, Clinica Hildebrand Rehabilitation Center Brissago has moved to an ongoing programme in which training, phishing simulations, analysis and remediation are no longer separate activities, but part of a single managed process. From the initial assessment to the definition of the training plan, from campaign management to results monitoring, each phase feeds into the next and enables the programme to be progressively adapted based on the insights that emerge.
The learning experience has also changed. Content is delivered through the tools employees use every day, such as Microsoft Teams, through short modules, quizzes and realistic scenarios. An AI-powered chatbot allows users to explore questions in greater depth and engage with realistic situations, while Studio makes it possible to transform the Clinic’s own documents and materials into customised interactive learning paths, extending training to policies, procedures and onboarding as well.
The same approach applies to phishing simulations, where campaign results are analysed to identify the areas of greatest vulnerability and activate targeted training and remediation initiatives. Dashboards, KPIs and executive reporting make it possible to track progress over time, turning the data collected into concrete guidance for subsequent activities.
Torelli concludes: “Integration with the Clinic’s ICT ecosystem has made it possible to optimise management processes, reducing the operational impact on the ICT Service.” The integration was also quick to become fully operational: “I was positively surprised by the speed with which the infrastructure and the related integrations were implemented,” Torelli adds.
Results
The first results show how the new model has transformed security awareness from a mainly periodic activity into a continuous and measurable process, capable of engaging people and progressively improving on the basis of the data collected.
Employee participation at Clinica Hildebrand Rehabilitation Center Brissago provides a first concrete indicator: more than 90% complete both standard training and remediation training within the required timeframe following phishing simulations. This high level of participation is also matched by strong appreciation of the learning experience: out of 532 ratings collected, 97% were positive, with 52% in the highest satisfaction category and 45% in the next highest.
The impact goes beyond participation. The continuity between training, simulations and remediation makes it possible to focus on the areas requiring the greatest attention and to monitor how behaviours evolve over time, resulting in a significant improvement in the vulnerability rate from one campaign to the next. Measurement therefore becomes an integral part of the process: the insights generated by one campaign help shape the next.
The change also brings organisational benefits. Employees can access training more easily and in a way that is closer to their everyday working environment, while management and the ICT Service maintain visibility over the programme’s progress without increasing the operational workload. This result has also been supported by close collaboration between the teams, which continued from the project phase into the ongoing management of the service.
The experience has also helped strengthen a broader view of security awareness within the Clinic: “Continuous employee training is now one of the key elements of a robust corporate security strategy. Cybersecurity is not regarded simply as a cost, but as a critical enabler for protecting the organisation’s assets and ensuring service continuity.”
From training to be delivered to a security culture to be built, measured and continuously improved.