- Read a sender address the way an attacker builds one
- Check a link before you click it
- Report in one click, even after a mistake
Security knowledge that sticks.
Fourteen core topics in short, scenario-based lessons, written in plain language and grounded in real attacks. Every lesson ends with a decision, not a slide. Watch one play on the right.
An email from “Payroll” asks you to confirm your bank details before Friday.
The sender is payroll@n0rthwind-foods.com. That zero is the whole attack.
Do you reply, click, or report? Pick one before the timer runs out.
Urgency, a familiar sender and a believable request. Attackers combine all three.
Three questions, graded instantly. Pass and your certificate is issued.
Fourteen topics on four shelves
Hover or tap a course to see what people learn, the simulation that tests it and the controls it proves.
Threats in the inbox
4 courses- Recognise urgency, authority and flattery as pressure tactics
- Verify a request through a second channel
- Say no politely, and escalate
- Verify any change of bank details by phone
- Recognise a spoofed executive request
- Follow the dual-approval rule under pressure
- Treat unexpected attachments as suspicious
- Know what to do in the first five minutes
- Keep devices patched and backed up
Accounts and devices
4 courses- Use a password manager and unique passwords
- Spot MFA fatigue and never approve a prompt you did not start
- Move to passkeys where supported
- Lock screens and encrypt disks
- Install apps only from trusted stores
- Report a lost device immediately
- Use the VPN on public Wi-Fi
- Keep work and personal devices separate
- Guard your screen in public
- Stop tailgating politely
- Escort visitors and wear your badge
- Never plug in an unknown USB drive
Data and privacy
3 courses- Know what personal data is under DPDP and GDPR
- Collect only what you need, keep it only as long as allowed
- Handle a rights request correctly
- Label data public, internal, confidential or restricted
- Share restricted data only through approved tools
- Dispose of data and paper securely
- Spot a cloned voice or synthetic video
- Never paste restricted data into public AI tools
- Verify AI output before acting on it
Response and responsibility
3 courses- Know what counts as an incident
- Report fast, because regulators count the hours
- Preserve evidence instead of deleting it
- Recognise warning signs without profiling
- Apply least privilege to your team
- Raise concerns through the right channel
- Keep secrets out of code and logs
- Review dependencies and pin versions
- Apply the OWASP Top 10 in code review
A route for every role, running by itself
Tracks assign lessons automatically. A new engineer gets security essentials on day one and secure development by the end of the month, without anyone enrolling them.
Six formats, matched to the moment
People learn by doing, so every topic mixes formats and ends with a choice.
Two to four minutes, captioned, with a question at the end.
Make choices in a realistic situation and see what happens.
Find the warning signs in a real-looking email or message.
Three to five questions, graded instantly on the server.
Read with time tracked, then confirm you understood.
A one-line reminder in the app or Slack at the right moment.
Built-in lessons, fully under your control
Bring your own
Upload videos, documents and quizzes, or turn any policy into a lesson.
Edit anything
Change wording, examples and questions to match how your company works.
Multilingual
Run the same course in several languages and report on it as one.
Always current
New lessons arrive as attacks change, such as deepfake fraud and QR-code phishing.