Which skills tests should you use when hiring for AI and cybersecurity? It depends on who you hire. For specialists such as security engineers or AI developers, combine a short knowledge test with a hands-on technical assessment and a structured interview. For everyone else, test baseline security awareness and safe use of AI tools, because most incidents start with one person clicking, pasting or trusting the wrong thing.
AI and cybersecurity used to be a topic for the IT department. Now it is a hiring question for almost every role. A paralegal pastes a client file into a chatbot. A finance assistant approves a payment after a call from someone who sounds like the CFO. A marketer publishes an AI-written claim nobody checked. None of these people are security specialists, and all of them handle data that matters.
This guide explains which tests fit which roles, what a knowledge test can and cannot tell you, and how to build AI and security checks into a selection process in the Netherlands. It is written by Selection Lab, so our own tests are in it. We also say where a hands-on technical platform is the better fit.
Two things changed. First, the attack surface moved to people. Phishing from a lookalike domain, a deepfake voice of a manager, a fake invoice that looks exactly like the real one. Technical controls catch a lot, but the final click is human.
Second, regulation now asks organisations to show that people are capable. The Dutch Cyberbeveiligingswet, the national implementation of the EU NIS2 directive, entered into force on 15 August 2026. NIS2 expects management bodies of covered organisations to follow cybersecurity training and encourages regular training for staff. The EU AI Act asks organisations that deploy AI systems to ensure a sufficient level of AI literacy among the people who use them. That obligation has applied since February 2025.
Training covers people who are already inside. Selection decides who comes in. If a role requires daily work with sensitive data or AI tools, it makes sense to measure the baseline before day one rather than discover the gap after an incident.
Most confusion about AI and cybersecurity testing comes from mixing two very different groups.
Security engineers, SOC analysts, pentesters, cloud security architects, ML engineers and AI developers. For these roles you want to see whether someone can do the work: investigate an incident, find a vulnerability, write and debug code, build and evaluate an AI workflow. That calls for hands-on tasks in a realistic environment. Knowledge tests are useful as a fast first filter, not as the final word.
Office staff, legal professionals, HR and payroll, finance, customer service, healthcare administration, sales and marketing. Here you do not need someone who can configure a firewall. You need someone who recognises a phishing mail, does not paste client data into a public chatbot, checks AI output before sending it and knows when to escalate. A short, practical test covers this well and is easy to add to any flow.
The mistake is to give specialists only a multiple-choice quiz, or to give a receptionist a technical exam. Match the test to what the role actually does with data and AI.
Selection Lab offers a set of hard skills tests for AI and digital safety. They are self-developed, take about 15 minutes and use practical scenarios instead of jargon. They run in the same flow as personality and cognitive assessments.
The Cybersecurity test has 20 multiple-choice questions based on situations from daily work. It covers classic phishing as well as newer tactics, such as a voice that sounds like the CEO or a video call with a manipulated face. It is built for anyone who works with client data or financial information, from receptionist to senior partner.
The AI Tools test checks the difference between using AI and using it well. It looks at prompt logic, spotting mistakes and knowing where AI does and does not belong. It also checks the safety side: pasting one confidential customer document into the wrong tool is a data breach.
The AI Editing & Verification test measures whether a candidate catches AI errors before they reach a client. Think of invented sources or court cases, swapped years and amounts, and conclusions the data does not support. It also checks tone, because generic AI text does not fit every brand or client.
This test covers where the two regulations overlap in practice: high-risk AI, automated decision-making, biometrics and generative AI. It suits privacy officers, compliance staff, HR teams working with applicant data and product or engineering managers who build AI features.
For technical roles there are tests on Programming fundamentals, Python and SQL. Each has three levels in one test, so you can separate junior from senior in one measurement. They work well as a knock-out before a coding interview or a hands-on task.
| Test | What it measures | Typical roles | Time |
|---|---|---|---|
| Cybersecurity | Recognising phishing, fraud and deepfake tactics in daily work | Legal, finance, healthcare, public sector, HR and payroll | ~15 min |
| AI Tools | Prompting, spotting mistakes, safe use of data | Nearly any office role | ~15 min |
| AI Editing & Verification | Catching hallucinations, wrong numbers and off-brand tone | Lawyers, editors, consultants, analysts | ~15 min |
| GDPR & EU AI Act | Applying privacy and AI rules in practice | Privacy, compliance, product and engineering managers | ~15 min |
| Programming, Python, SQL | Technical fundamentals at three levels | Developers, data engineers, analysts, DevOps, QA | ~15 min each |
Knowledge tests tell you what someone knows. For security specialists and AI engineers, you also need to see what they can do under realistic conditions. Several providers focus on exactly that. Based on their own descriptions:
For a SOC analyst or pentester, a lab-based assessment from a specialist provider says more than any 15-minute test. A practical setup is to use a short knowledge test as a filter early in the process and save the hands-on lab for the shortlist. Lab assessments take more time, so you only want to send candidates who already pass the basics.
Technical skill does not tell you how someone behaves with access to sensitive systems. Security and AI roles often come with privileged access, confidential data and pressure to move fast. That makes integrity and judgement part of the job profile.
The Personality, COTAN assessment measures six dimensions instead of five. The sixth is integrity, split into honesty, sincerity and the need for status and possessions. It is COTAN-reviewed, the Dutch quality benchmark that public sector organisations and tenders often require. Note that this questionnaire is available in Dutch only.
Cognitive ability adds another angle. Security and data work involve learning new tools and threats quickly. A cognitive test helps predict how fast someone picks up new material. If you test remotely and worry that candidates use ChatGPT in a second tab, proctoring with webcam, microphone and a locked browser keeps the result fair for honest candidates. Read more in our article on candidates using ChatGPT in assessments.
A situational judgement test can make this concrete. You show candidates realistic scenarios from the role, such as an urgent request to share credentials, and see how they respond.
Results land in your ATS, with standard integrations for systems such as Recruitee, Teamtailor, SmartRecruiters, Workable, Carerix and OTYS. Most organisations go live in 2 to 10 weeks. Customers report 27% less drop-off and 15 minutes saved per applicant.
Skills tests involve personal data, and AI used to evaluate candidates falls under the high-risk category of the EU AI Act. A few practical points:
For more background, see our guide to the EU AI Act in recruitment.
A cybersecurity awareness test checks whether a candidate recognises everyday threats such as phishing, invoice fraud and deepfake calls, and knows what to do. It is meant for non-specialists who handle sensitive data, not for security engineers.
Use a short test that checks prompting, spotting mistakes in AI output and safe handling of data. For roles where AI output reaches clients, add a test on verifying sources, numbers and tone. For AI engineers, add a hands-on task.
No. A knowledge test is a useful first filter, but for roles such as SOC analyst or pentester you also need a hands-on lab or practical task and a structured technical interview.
Not directly. NIS2, implemented in the Netherlands through the Cyberbeveiligingswet, focuses on cybersecurity training, and the EU AI Act asks for sufficient AI literacy among staff who use AI. Testing during selection helps you start from a known baseline.
These roles often come with privileged access and confidential data. A personality assessment that includes integrity, such as a Big Six model, adds insight into honesty and reliability that a skills test does not provide.
Which skills tests should you use when hiring for AI and cybersecurity? It depends on who you hire. For specialists such as security engineers or AI developers, combine a short knowledge test with a hands-on technical assessment and a structured interview. For everyone else, test baseline security awareness and safe use of AI tools, because most incidents start with one person clicking, pasting or trusting the wrong thing.
AI and cybersecurity used to be a topic for the IT department. Now it is a hiring question for almost every role. A paralegal pastes a client file into a chatbot. A finance assistant approves a payment after a call from someone who sounds like the CFO. A marketer publishes an AI-written claim nobody checked. None of these people are security specialists, and all of them handle data that matters.
This guide explains which tests fit which roles, what a knowledge test can and cannot tell you, and how to build AI and security checks into a selection process in the Netherlands. It is written by Selection Lab, so our own tests are in it. We also say where a hands-on technical platform is the better fit.
Two things changed. First, the attack surface moved to people. Phishing from a lookalike domain, a deepfake voice of a manager, a fake invoice that looks exactly like the real one. Technical controls catch a lot, but the final click is human.
Second, regulation now asks organisations to show that people are capable. The Dutch Cyberbeveiligingswet, the national implementation of the EU NIS2 directive, entered into force on 15 August 2026. NIS2 expects management bodies of covered organisations to follow cybersecurity training and encourages regular training for staff. The EU AI Act asks organisations that deploy AI systems to ensure a sufficient level of AI literacy among the people who use them. That obligation has applied since February 2025.
Training covers people who are already inside. Selection decides who comes in. If a role requires daily work with sensitive data or AI tools, it makes sense to measure the baseline before day one rather than discover the gap after an incident.
Most confusion about AI and cybersecurity testing comes from mixing two very different groups.
Security engineers, SOC analysts, pentesters, cloud security architects, ML engineers and AI developers. For these roles you want to see whether someone can do the work: investigate an incident, find a vulnerability, write and debug code, build and evaluate an AI workflow. That calls for hands-on tasks in a realistic environment. Knowledge tests are useful as a fast first filter, not as the final word.
Office staff, legal professionals, HR and payroll, finance, customer service, healthcare administration, sales and marketing. Here you do not need someone who can configure a firewall. You need someone who recognises a phishing mail, does not paste client data into a public chatbot, checks AI output before sending it and knows when to escalate. A short, practical test covers this well and is easy to add to any flow.
The mistake is to give specialists only a multiple-choice quiz, or to give a receptionist a technical exam. Match the test to what the role actually does with data and AI.
Selection Lab offers a set of hard skills tests for AI and digital safety. They are self-developed, take about 15 minutes and use practical scenarios instead of jargon. They run in the same flow as personality and cognitive assessments.
The Cybersecurity test has 20 multiple-choice questions based on situations from daily work. It covers classic phishing as well as newer tactics, such as a voice that sounds like the CEO or a video call with a manipulated face. It is built for anyone who works with client data or financial information, from receptionist to senior partner.
The AI Tools test checks the difference between using AI and using it well. It looks at prompt logic, spotting mistakes and knowing where AI does and does not belong. It also checks the safety side: pasting one confidential customer document into the wrong tool is a data breach.
The AI Editing & Verification test measures whether a candidate catches AI errors before they reach a client. Think of invented sources or court cases, swapped years and amounts, and conclusions the data does not support. It also checks tone, because generic AI text does not fit every brand or client.
This test covers where the two regulations overlap in practice: high-risk AI, automated decision-making, biometrics and generative AI. It suits privacy officers, compliance staff, HR teams working with applicant data and product or engineering managers who build AI features.
For technical roles there are tests on Programming fundamentals, Python and SQL. Each has three levels in one test, so you can separate junior from senior in one measurement. They work well as a knock-out before a coding interview or a hands-on task.
| Test | What it measures | Typical roles | Time |
|---|---|---|---|
| Cybersecurity | Recognising phishing, fraud and deepfake tactics in daily work | Legal, finance, healthcare, public sector, HR and payroll | ~15 min |
| AI Tools | Prompting, spotting mistakes, safe use of data | Nearly any office role | ~15 min |
| AI Editing & Verification | Catching hallucinations, wrong numbers and off-brand tone | Lawyers, editors, consultants, analysts | ~15 min |
| GDPR & EU AI Act | Applying privacy and AI rules in practice | Privacy, compliance, product and engineering managers | ~15 min |
| Programming, Python, SQL | Technical fundamentals at three levels | Developers, data engineers, analysts, DevOps, QA | ~15 min each |
Knowledge tests tell you what someone knows. For security specialists and AI engineers, you also need to see what they can do under realistic conditions. Several providers focus on exactly that. Based on their own descriptions:
For a SOC analyst or pentester, a lab-based assessment from a specialist provider says more than any 15-minute test. A practical setup is to use a short knowledge test as a filter early in the process and save the hands-on lab for the shortlist. Lab assessments take more time, so you only want to send candidates who already pass the basics.
Technical skill does not tell you how someone behaves with access to sensitive systems. Security and AI roles often come with privileged access, confidential data and pressure to move fast. That makes integrity and judgement part of the job profile.
The Personality, COTAN assessment measures six dimensions instead of five. The sixth is integrity, split into honesty, sincerity and the need for status and possessions. It is COTAN-reviewed, the Dutch quality benchmark that public sector organisations and tenders often require. Note that this questionnaire is available in Dutch only.
Cognitive ability adds another angle. Security and data work involve learning new tools and threats quickly. A cognitive test helps predict how fast someone picks up new material. If you test remotely and worry that candidates use ChatGPT in a second tab, proctoring with webcam, microphone and a locked browser keeps the result fair for honest candidates. Read more in our article on candidates using ChatGPT in assessments.
A situational judgement test can make this concrete. You show candidates realistic scenarios from the role, such as an urgent request to share credentials, and see how they respond.
Results land in your ATS, with standard integrations for systems such as Recruitee, Teamtailor, SmartRecruiters, Workable, Carerix and OTYS. Most organisations go live in 2 to 10 weeks. Customers report 27% less drop-off and 15 minutes saved per applicant.
Skills tests involve personal data, and AI used to evaluate candidates falls under the high-risk category of the EU AI Act. A few practical points:
For more background, see our guide to the EU AI Act in recruitment.
A cybersecurity awareness test checks whether a candidate recognises everyday threats such as phishing, invoice fraud and deepfake calls, and knows what to do. It is meant for non-specialists who handle sensitive data, not for security engineers.
Use a short test that checks prompting, spotting mistakes in AI output and safe handling of data. For roles where AI output reaches clients, add a test on verifying sources, numbers and tone. For AI engineers, add a hands-on task.
No. A knowledge test is a useful first filter, but for roles such as SOC analyst or pentester you also need a hands-on lab or practical task and a structured technical interview.
Not directly. NIS2, implemented in the Netherlands through the Cyberbeveiligingswet, focuses on cybersecurity training, and the EU AI Act asks for sufficient AI literacy among staff who use AI. Testing during selection helps you start from a known baseline.
These roles often come with privileged access and confidential data. A personality assessment that includes integrity, such as a Big Six model, adds insight into honesty and reliability that a skills test does not provide.
