What we teach, in the words a manager can use.

The attack most employees will actually see. People learn to judge a message before they click, reply, or forward it.

• Read the real address, not the display name
• Treat urgency, secrecy, and threats to pay as a stop sign
• Check where a link goes before opening it

Targeted mail that impersonates an executive, a vendor, or a thread the company already trusts.

• Spot a trusted thread that suddenly asks for money or credentials
• Refuse 'don't tell accounting' and lookalike domains
• Confirm payment or access changes on a second channel you already use

The click itself: shortened links, shared documents, unexpected files, and codes on paper or a screen.

• Preview the destination instead of trusting the button label
• Leave unexpected attachments closed, including shared-drive 'invoices'
• Treat a QR code the same as a link from a stranger

How accounts actually get taken over, and what to do when a prompt appears that the employee did not start.

• Use a unique passphrase and a manager, not a reused company password
• Deny MFA prompts you did not just request
• Never read a code or password to someone on the phone

Not every lure is an email. Calls, SMS, and a person in the lobby use the same pressure with a voice attached.

• Hang up and call back on a number the company already published
• Refuse codes, passwords, and remote-access requests
• Slow down anyone who name-drops a boss to skip the process

What staff should do in the first minutes if a screen locks, files rename themselves, or a note demands payment.

• Disconnect and call the incident path — do not pay from a desk
• Recognize the mail and remote-access paths that precede a lockout
• Know which files are not 'safe to just reopen' after a scare

Customer data, payroll, health details, and source material — where they may go, and where they must not.

• Choose the company channel instead of a personal inbox
• Stop before forwarding a spreadsheet 'just this once'
• Recognize a request for data that the requester should not have

Home offices, shared kitchens, and travel days. The workstation is part of the company's perimeter.

• Lock the screen and keep work data off personal machines
• Use the company VPN and approved storage, not a random USB
• Notice a 'new IT tool' that arrived by email instead of from IT

SMS lures, unofficial app stores, and the cafe network that asks you to 'sign in to continue'.

• Treat texted links like emailed links
• Avoid entering work passwords on a captive portal or open Wi-Fi
• Report a lost phone the same day, not after the weekend

A familiar voice on a call, or a flawless email, is no longer proof of who sent it. Employees learn a second check.

• Confirm unusual payment or access requests out of band
• Distrust a voice message that blocks questions and demands speed
• Notice writing that is polished but slightly wrong about how you work

The expensive version of phishing: a vendor 'updates' a bank account, or a boss 'needs a wire today'.

• Freeze any bank-detail change until it is verified on a known number
• Reject secrecy and same-day pressure around money movement
• Match invoice requests to a process, not to a convincing tone

A report that arrives fast is the whole point of awareness training. People practice who to tell, and what to include.

• Report a suspicious message even if you already clicked
• Preserve the mail — don't delete the only evidence
• Use the company path, not a group chat rumor

Tailgating, visitor badges, a laptop left in a car, and the USB stick someone 'found' in the parking lot.

• Don't hold the door for a badge you didn't see
• Return lost devices to IT instead of plugging them in
• Lock screens and keep papers off shared printers

Unsanctioned AI tools, personal cloud drives, and browser extensions that ask to read every page.

• Ask before putting company data into a new tool
• Remove extensions and apps IT did not approve
• Know what 'just trying a free account' can expose

The core track. How attacks are structured, how defenses fit together, and the vocabulary the rest of the lab assumes.

• Map an incident to the assets and people it actually touches
• Separate prevention, detection, and response
• Read a basic alert without treating every line as equal

Authorized testing. Students practice thinking like an attacker against systems they are allowed to touch.

• Scope a test and stay inside it
• Chain small findings into a realistic path
• Write a finding a defender can reproduce

The work of a security operations seat: triage, context, and a clean handoff when something is real.

• Triage an alert queue without burying the important one
• Pull identity, host, and mail context before escalating
• Document what you ruled out

Governance, risk, and compliance as operating work — policies people follow, evidence you can show, gaps you can name.

• Turn a control into something a team can actually do
• Collect evidence without a last-minute scramble
• Explain a risk to a manager who does not run the tools

Identity, storage, and network defaults in a cloud account — where most company data now sits.

• Read an identity policy for over-broad access
• Find a storage exposure before a scanner does
• Separate a lab account from production habits

Security inside the way software ships: pipelines, dependencies, secrets, and reviews that engineers will tolerate.

• Catch a secret before it lands in a repo
• Triage a dependency alert by exploitability, not by volume
• Add a check to a pipeline without stopping every release

How AI shows up in both the attack and the defense, including data you must not paste into a model.

• Judge an AI-written lure the way you judge any other lure
• Set boundaries for company data in assistants and agents
• Understand what a model output is not: a source of truth

Building security tools and features with the failure modes that matter: auth, input, logging, and abuse.

• Review auth and access before adding features around them
• Log what an investigator will need later
• Test how the feature fails, not only how it succeeds

The hours after something is wrong. Roles, containment, communication, and a timeline that holds up.

• Contain a host or an account without destroying evidence
• Keep a timeline a manager and a responder can both use
• Tell staff what to do next in plain language

Looking for the attacker the alerts did not page on. Hypothesis first, then the data, then a decision.

• Write a hunt question that can be answered with logs you have
• Separate a lead from a confirmed incident
• Hand a confirmed lead to response with the query attached

What a suspicious file is doing, at a level a defender can act on, inside a lab that is not the company network.

• Handle a sample without infecting the workstation you care about
• Describe behavior: persistence, credentials, outbound calls
• Turn that behavior into a detection or a block

Disk, memory, and mail evidence. What to preserve, what not to click again, and how to say what you know.

• Preserve a machine instead of 'cleaning it up' first
• Tie an artifact to a time and an account
• State the limit of what the evidence shows

Traffic, segmentation, and the paths an attacker uses once a single laptop is not enough.

• Read a flow well enough to ask a better question
• Explain why a flat network makes a phish more expensive
• Pair a control with the log that proves it worked

A backlog is not a program. Prioritize what is exposed, what is exploited, and what the business can patch.

• Rank findings by exposure and impact, not by a raw score alone
• Write an exception that has an owner and an end date
• Check that a 'fixed' item is actually gone