Rojtar - Security Awareness and Phishing Simulation Platform for a Hospital Network

Dashboard, campaign list, campaign detail with 6 tabs, the reported messages queue with its message panel, and department results with a department panel.

Any group under 10 people is hidden or merged into "Other (small groups)" on every chart, table and export. In the demo, 3 of the 25 departments fall below the line.

No simulation lands during an ICU, emergency, theatre, labour ward or night shift, or within 2 hours after one. In the running campaign C-0031, 227 sends are held until after the shift.

25 departments across 3 hospitals and the outpatient clinics, 9 simulation templates, 22 reported messages (real and simulated) and 9 staff users in their programme roles.

Patient Safety Comes First

A practice email that reaches an emergency nurse at 03:00 is a distraction from patients. Sends have to avoid critical shifts, the rest period after them, blackout windows such as clinical system go-lives, and any major incident.

Results Are Staff Personal Data

Under Albania's Law No. 124/2024, simulation results are personal data. They need a lawful basis, a privacy notice, pseudonymised individual events, a retention period and a DPIA, and they cannot be used for discipline unless policy says so after DPO review.

Employee Representatives Must Agree

After the failed trial, Lisbardhë's own policy is that the programme plan and every campaign are reviewed by an employee representative and approved by management before any email is sent. A raised concern has to stop a campaign until it is answered.

Real Threats in the Same Inbox

Real phishing aimed at the hospital's Microsoft 365 accounts arrives alongside the practice emails. Every report has to be sorted into simulation, known bad or unknown, and real threats triaged fast, with evidence of staff awareness for the cyber security law.