Cyber incidents have been considered the world's biggest business risk for five years, and the vast majority of attacks target small and medium-sized enterprises (SMEs). The advancing digitalization and the increasing merger of IT and operational technology (OT) are further expanding the attack surface of production-related SMEs. At the same time, these companies often lack the personnel and technical know-how to build up an appropriate level of IT security. Many SMEs do not know their own risk profile and regularly overestimate their actual level of protection. As attackers increasingly shift their focus to humans as the weakest link in the IT security chain, technical protection measures alone are not enough. Existing training approaches address either IT or OT, but rarely cover both areas together in a realistic learning environment.