Module 1 — Cyber Basics for Staff
Cyber awareness training your staff will actually finish.
Twenty minutes, no jargon, built around things that plausibly happen on a Tuesday. It covers the handful of behaviours that stop the overwhelming majority of incidents.
- Recognise a phishing email that has no spelling mistakes in it
- Check where a link goes before clicking it
- Understand what MFA stops and why an unexpected prompt is urgent
- Report a suspected incident quickly and without fear
- 8 lessonsIncluded
- Scenarios and knowledge checksIncluded
- Quiz — 80% pass markIncluded
- Certificate on completionIncluded
- Retraining reminder12 months
What is in the module
Lesson by lesson
- 1
Why you are a target
Attacks are not personal and they are not sophisticated. Understanding how the numbers work removes the "why would anyone bother with us" reaction.
- 2
Phishing: what it actually looks like now
Modern phishing has good spelling and a real logo. We cover the signals that still hold up — urgency, unexpected requests, and where a link really goes.
- 3
Passwords without the misery
Why length beats complexity, why reuse is the real problem, and how a password manager removes the memory burden entirely.
- 4
Multi-factor authentication
What MFA actually stops, why an approval prompt you did not request is an emergency, and what MFA fatigue attacks look like.
- 5
Links and attachments
How to check where a link goes before clicking, which attachment types deserve suspicion, and what to do when you are not sure.
- 6
Reporting: the most valuable thing you can do
Why reporting a near-miss fast matters more than never making a mistake, and why nobody gets in trouble for reporting.
- 7
Personal devices and working away from the office
Phones, home computers, public Wi-Fi and the practical rules that keep work data where it belongs.
- 8
Safe file sharing
Sharing links versus attachments, what "anyone with the link" really means, and cleaning up access when a project ends.
Module details
- Audience
- All staff
- Duration
- About 20 minutes
- Pass mark
- 80% to pass
- On completion
- Verifiable certificate
- Format
- Lessons, scenarios, quiz
The full module, its scenarios, the quiz and the certificate live inside the platform. Our blog covers these topics at a high level for free — but the training itself is not published publicly.
See plans that include itWhat people can do afterwards
Outcomes, not attendance
- Recognise a phishing email that has no spelling mistakes in it
- Check where a link goes before clicking it
- Understand what MFA stops and why an unexpected prompt is urgent
- Report a suspected incident quickly and without fear
- Use a password manager instead of reusing passwords
- Share files without accidentally making them public
- Handle work data safely on a personal phone or home computer
- Know exactly who to tell, and how fast, when something feels wrong
A scenario from the module
The invoice that looks completely normal
You work in accounts. An email arrives from a supplier you deal with every month. The formatting is right, the logo is right, the invoice number follows on from the last one, and the person signing off is the same contact you always deal with. The only difference is a short line near the bottom: “Please note our banking details have recently changed.”
What is the single most important thing to do before this invoice is paid — and what is the one thing you must not use to do it?
The answer, the explanation and the rest of the scenarios are inside the module.
Who it is for
Assign it to the right people
Every new starter
Assign it as part of induction so cyber expectations are set in week one rather than after the first incident.
Annual refresh for all staff
Most insurance applications and supplier questionnaires ask whether staff are trained annually. This is the evidence.
Teams after a near-miss
A targeted reassignment after a close call, with completion tracked, is far more effective than an all-staff email.
Free vs paid
What you can read for free, and what needs an account.
Free on the blog, no account needed
Understand the issue. Genuinely useful, genuinely free.
- How fake invoice scams work, explained in a blog article
- Why business email compromise is so effective
- What staff should do when an email feels wrong
- General advice on passwords and MFA
Inside the platform, with a paid account
Act on the issue, and have a record that you did.
- The full eight-lesson module with scenarios and knowledge checks
- The quiz with an 80% pass mark and retakes
- A verifiable certificate on completion
- Assignment to staff with due dates and reminders
- Completion tracking and a controlled completion summary PDF
Training is one stage of five
Where this module sits in the wider platform.
A module on its own teaches. It becomes a risk control when it is assigned off the back of an assessment gap or a failed simulation, and when the completion ends up in an evidence record.
Assessments
Find the gaps that tell you which training to assign in the first place.
Phishing simulations
Test whether it stuck, and assign follow-up training automatically.
How the training works
Scenario decisions, measured competencies, badges and the full catalogue.
Reporting and evidence
Verifiable certificates and completion records for insurers and clients.
Train your team once, and be able to prove it for a year.
See the module, the quiz, the certificate and the completion tracking in a short walkthrough.