What is included in Kaspersky Automated Security Awareness Platform Base?

Cloud training portal – Browser-based platform, no servers or agents to install.
Main course – Core topics split into rising complexity levels per employee.
Express course – Short audio-video lessons for a quick refresher round.
Phishing simulator – Simulated attacks sent automatically before, during and after training.
Own content upload – Add internal policies as SCORM modules or PDF files.
Important – No endpoint protection included; this is a training platform only.

What are the main benefits of Kaspersky Automated Security Awareness Platform Base?

Kaspersky Automated Security Awareness Platform, also listed as KASAP, is a cloud-hosted training platform that builds cyber-hygiene skills through lessons, tests and simulated phishing attacks. Administrators run everything from one web console, and Base is the initial licence type, so no existing licence of this product is required.

Automated learning paths – The platform re-assigns levels employees failed to complete.
Measurable phishing rate – Click results show which departments need another round.
Fast user import – Add staff manually, from XLSX, or via Active Directory.
Single sign-on – SAML and SCIM connect the portal to existing identities.
Multi-company management – One account covers subsidiaries or several managed customers.
Selectable data location – Choose the storage region when registering the platform.

Best antivirus? Why Windows Defender alone is not enough
Explains where purely technical protection stops working and why the person at the keyboard decides the outcome.

Which company size is Kaspersky Automated Security Awareness Platform Base suitable for?

Regulatory exposure and customer pressure decide more than headcount. A ten-person firm gets value from the express course and one phishing round, while a 500-person organisation needs directory sync, group rules and per-department reporting to run training without maintaining employee lists by hand.

Does Kaspersky Automated Security Awareness Platform Base meet the requirements of Swiss cybersecurity legislation?

The Swiss reporting obligation applies to operators of critical infrastructure, not to every company. Since 1 April 2025, organisations covered by the revised Information Security Act must report a cyberattack to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery, with a further 14 days to complete the report. Kaspersky ASAP supports this indirectly: staff who recognise a phishing mail and raise it internally shorten the gap between attack and discovery, and per-group completion reporting documents that an awareness programme exists and is being followed. It does not detect, log or escalate an incident, it does not generate the report to BACS, and it collects no technical telemetry, so detection and reporting still have to come from endpoint, mail and log tooling. Training records evidence a measure; they do not prove the measure worked. This text is not legal advice, and whether your organisation falls under the reporting obligation should be clarified with qualified legal counsel.

Does Kaspersky Automated Security Awareness Platform Base meet the requirements of European cybersecurity legislation?

No software product makes an organisation NIS 2 compliant. The directive requires entities in scope to take risk management measures covering areas such as incident handling, business continuity, supply chain security, access control, cryptography, and basic cyber hygiene practices together with cybersecurity training. Kaspersky ASAP addresses the training and cyber hygiene category directly, and its completion reporting per user and group gives management a record that the measure is running rather than merely planned. It contributes nothing to incident handling, continuity, supply chain assessment, access control or cryptography, and it produces no notifications for supervisory bodies. Buyers in scope should treat it as one measure inside a wider management system, not as a NIS 2 project in itself.

What should you know about official assessments of Kaspersky?

Germany's Federal Office for Information Security (BSI) has warned against the manufacturer's virus protection software since 15 March 2022 and confirmed in 2026 that the warning still stands. In June 2024 the US Department of Commerce issued a Final Determination prohibiting the supply of Kaspersky cybersecurity products to US persons, with updates for existing installations ending on 29 September 2024; that prohibition remains in force. Kaspersky rejects both assessments, describes them as driven by the geopolitical situation rather than technical findings, and points to its Global Transparency Initiative, including data storage and a transparency centre in Switzerland. Swiss authorities have taken a different line: the Federal Office for Cybersecurity issues no product recommendations, has stated that no misuse of Kaspersky software in Switzerland has been reported to it, and has no directive restricting the products. Two details matter when you weigh this up: the BSI warning is directed at virus protection software with deep system access, whereas this product is a browser-based training platform with no endpoint agent, and independent laboratory testing covers the vendor's antivirus engines rather than this platform, so no test result speaks to it either way. In practice the restrictions bite for buyers with US entities or US customers, for public sector contracts, and for supply chain questionnaires that ask about vendor country of origin; for a Swiss or EU company without those requirements it is a procurement decision, not a legal obstacle.

Norton vs. Kaspersky – Which antivirus program offers the best protection in 2025?
A side-by-side look at both vendors for readers weighing manufacturer choice before committing to one supplier.

Does Kaspersky Automated Security Awareness Platform Base help with security questionnaires from large customers?

Yes, for one specific block of questions. Questionnaires from large customers typically ask whether staff receive regular security awareness training, at what interval, whether phishing simulations are carried out, and whether completion is documented per employee. Kaspersky ASAP answers all four: it records completion per user and group, runs simulated phishing campaigns with click statistics, and lets you attach internal policies as SCORM modules or PDF files so your own rules form part of the training record. It answers none of the questions on endpoint protection, patch status, laptop encryption, backup and restore testing, access reviews, log retention, incident response times or supplier management, which is usually the larger part of the form. If several of those blocks are open, adding an endpoint product from the same vendor family, so protection and training evidence come from one supplier, is normally faster to document and cheaper than combining a training platform from one vendor with endpoint tooling from another.

What is the difference between ASAP cloud and ASAP On-premise?

The decisive difference is where the platform runs and who holds the training data. The standard platform is a cloud service reached through a browser, with the data storage region chosen during registration, while ASAP On-premise, introduced in May 2024, is installed on the customer's own servers and can operate without internet access. The training content is the same in both, but the on-premises route adds server requirements, an installation project and Microsoft Exchange configuration for phishing simulations. Organisations whose policy rules out cloud-hosted training portals need the on-premises product; everyone else avoids the infrastructure work entirely with the cloud platform.

Which limitations should you know before buying?

Availability is restricted in one market: the US prohibition on Kaspersky cybersecurity products means the platform cannot be supplied to US persons or US entities, which matters for groups with American subsidiaries or American customers. The standard product is cloud-only, and moving training into your own data centre means buying the separate on-premises product rather than reconfiguring this one. Phishing simulations usually need mail flow adjustments, and the vendor documents additional Microsoft Exchange settings for exactly this purpose, so plan a short mail-admin task before the first campaign rather than after it. The platform trains people but blocks nothing: no malware detection, no gateway URL filtering, no mail quarantine, so a click that does get through still needs endpoint or mail security to stop it, which is the most common follow-up purchase after an awareness project.

Test: Antivirus program: Best antivirus programs for Windows 2025
Useful for choosing the protection layer that has to catch what training does not prevent.

Frequently asked questions about Kaspersky Automated Security Awareness Platform Base

In how many languages is the training available?

Kaspersky states that the platform is available in 25 languages, with text and visuals adapted to local context rather than only translated. That matters for organisations with staff across several countries, because completion rates drop when employees have to train in a second language.

Does the platform connect to other Kaspersky products?

Yes. ASAP integrates with Kaspersky KUMA and the vendor's XDR platform, so an administrator who sees an event in XDR can assign the matching training to the user involved, and incident cards can be enriched with that user's current training level.