Security training · Curriculum

Security knowledge that sticks.

Fourteen core topics in short, scenario-based lessons, written in plain language and grounded in real attacks. Every lesson ends with a decision, not a slide. Watch one play on the right.

Payment Fraud Essentials4 min
Chapter 1 · The hook

An email from “Payroll” asks you to confirm your bank details before Friday.

Chapter 2 · Look closer

The sender is payroll@n0rthwind-foods.com. That zero is the whole attack.

Chapter 3 · Your move

Do you reply, click, or report? Pick one before the timer runs out.

Chapter 4 · Why it worked

Urgency, a familiar sender and a believable request. Attackers combine all three.

Chapter 5 · Quick check

Three questions, graded instantly. Pass and your certificate is issued.

12345
The library

Fourteen topics on four shelves

Hover or tap a course to see what people learn, the simulation that tests it and the controls it proves.

Threats in the inbox

4 courses
5 min · EveryonePhishing & email threatsHover for details
Phishing & email threatsWhat people learn
  • Read a sender address the way an attacker builds one
  • Check a link before you click it
  • Report in one click, even after a mistake
Tested by: Credential phishingISO A.6.3 · SOC 2 CC2.2
4 min · EveryoneSocial engineeringHover for details
Social engineeringWhat people learn
  • Recognise urgency, authority and flattery as pressure tactics
  • Verify a request through a second channel
  • Say no politely, and escalate
Tested by: Pretexting callISO A.6.3
6 min · FinancePayment fraud & BECHover for details
Payment fraud & BECWhat people learn
  • Verify any change of bank details by phone
  • Recognise a spoofed executive request
  • Follow the dual-approval rule under pressure
Tested by: Invoice fraudISO A.6.3 · SOC 2 CC2.2
4 min · EveryoneMalware & ransomwareHover for details
Malware & ransomwareWhat people learn
  • Treat unexpected attachments as suspicious
  • Know what to do in the first five minutes
  • Keep devices patched and backed up
Tested by: Malicious attachmentISO A.8.7

Accounts and devices

4 courses
4 min · EveryonePasswords, passkeys & MFAHover for details
Passwords, passkeys & MFAWhat people learn
  • Use a password manager and unique passwords
  • Spot MFA fatigue and never approve a prompt you did not start
  • Move to passkeys where supported
Tested by: MFA fatigueISO A.5.17
3 min · EveryoneDevice & mobile securityHover for details
Device & mobile securityWhat people learn
  • Lock screens and encrypt disks
  • Install apps only from trusted stores
  • Report a lost device immediately
Tested by: SmishingISO A.8.1
3 min · EveryoneRemote & hybrid workHover for details
Remote & hybrid workWhat people learn
  • Use the VPN on public Wi-Fi
  • Keep work and personal devices separate
  • Guard your screen in public
Tested by: Wi-Fi portal lureISO A.6.7
3 min · EveryonePhysical securityHover for details
Physical securityWhat people learn
  • Stop tailgating politely
  • Escort visitors and wear your badge
  • Never plug in an unknown USB drive
Tested by: USB dropISO A.7.2

Data and privacy

3 courses
6 min · EveryoneData protection & privacyHover for details
Data protection & privacyWhat people learn
  • Know what personal data is under DPDP and GDPR
  • Collect only what you need, keep it only as long as allowed
  • Handle a rights request correctly
Tested by: Data request pretextGDPR Art. 39 · DPDP
4 min · EveryoneData classification & handlingHover for details
Data classification & handlingWhat people learn
  • Label data public, internal, confidential or restricted
  • Share restricted data only through approved tools
  • Dispose of data and paper securely
Tested by: Shared-file lureISO A.5.12 · ISO A.5.13
5 min · EveryoneAI, deepfakes & safe AI useHover for details
AI, deepfakes & safe AI useWhat people learn
  • Spot a cloned voice or synthetic video
  • Never paste restricted data into public AI tools
  • Verify AI output before acting on it
Tested by: Deepfake voice callISO 42001 · EU AI Act

Response and responsibility

3 courses
3 min · EveryoneIncident reportingHover for details
Incident reportingWhat people learn
  • Know what counts as an incident
  • Report fast, because regulators count the hours
  • Preserve evidence instead of deleting it
Tested by: Report-button drillISO A.6.8 · CERT-In
4 min · ManagersInsider risk & acceptable useHover for details
Insider risk & acceptable useWhat people learn
  • Recognise warning signs without profiling
  • Apply least privilege to your team
  • Raise concerns through the right channel
Tested by: Access request pretextISO A.5.10 · ISO A.6.4
8 min · EngineersSecure developmentHover for details
Secure developmentWhat people learn
  • Keep secrets out of code and logs
  • Review dependencies and pin versions
  • Apply the OWASP Top 10 in code review
Tested by: Fake package alertISO A.8.28 · SOC 2 CC8.1
Learning tracks

A route for every role, running by itself

Tracks assign lessons automatically. A new engineer gets security essentials on day one and secure development by the end of the month, without anyone enrolling them.

New hiresSecurity essentialsDay 1Acceptable Use PolicyDay 1Phishing & passwordsWeek 1Data handlingMonth 1Everyone · yearlyAnnual refresherQ1Phishing simulationQ2Privacy updateQ3Incident drillQ4EngineersSecure developmentMonth 1Secrets & accessQuarterlySupply-chain securityYearlyFinancePayment fraud & BECMonth 1Invoice-fraud simulationQuarterlyDual approval refresherYearlyExecutivesWhaling & deepfakesMonth 1Voice-clone drillTwice yearlyLeading an incidentYearlyCustomer supportSocial engineering by phoneMonth 1Identity checksQuarterlyVishing simulationYearly
Formats

Six formats, matched to the moment

People learn by doing, so every topic mixes formats and ends with a choice.

Short video

Two to four minutes, captioned, with a question at the end.

Interactive scenario

Make choices in a realistic situation and see what happens.

Spot the red flag

Find the warning signs in a real-looking email or message.

Quick check

Three to five questions, graded instantly on the server.

Policy read-through

Read with time tracked, then confirm you understood.

Nudges

A one-line reminder in the app or Slack at the right moment.

Your content, your rules

Built-in lessons, fully under your control

Bring your own

Upload videos, documents and quizzes, or turn any policy into a lesson.

Edit anything

Change wording, examples and questions to match how your company works.

Multilingual

Run the same course in several languages and report on it as one.

Always current

New lessons arrive as attacks change, such as deepfake fraud and QR-code phishing.

Keep exploring

The rest of security training

Knowledge assessment

Adaptive tests show what each person really knows, topic by topic.

Explore

Attack simulation

Realistic phishing, smishing, vishing, QR, MFA-fatigue and deepfake tests.

Explore

Human risk score

A live score by person, team and attack type, with automatic follow-up.

Explore