Security awareness for employees
You spot phishing, social engineering and risky habits, protect your passwords, devices and company data, and report anything suspicious straight away.
Level 101 · 25 lessons · 21 practice labs
Lessons
Phishing and social engineering
- Why you are the target: people-focused threats: You understand why fraudsters target employees rather than systems and which emotions they play on.
- Spotting a phishing email: sender, link, attachment: You can tell a fake email from clues such as the sender address, urgent wording, links and attachments.
- Checking a link before you click: domains and look-alikes: You see where a link really goes and catch look-alike domains with swapped letters.
- SMS, phone and QR code scams: You recognise scams arriving by text message, phone call or QR code and respond correctly.
- CEO and invoice fraud (business email compromise): You make it a habit to verify, through a second channel, any message asking for urgent payment or new bank details.
- Impersonation with deepfake voice and video: You know a familiar voice or face can be faked and confirm unexpected requests through a safe channel.
- Pretexting, tailgating and physical social engineering: You politely but firmly stop strangers posing as technicians or couriers and anyone entering without a badge.
- Quick task: decode suspicious links without clicking
Accounts and identity
- Strong passwords and passphrases: You can create long, memorable passphrases that are different for every account.
- Using a password manager: You store passwords safely in your organisation’s approved manager and share the ones you must through the right channel.
- Multi-factor authentication and passkeys: You turn on multi-factor authentication for your accounts and can compare methods by how secure they are.
- Push-approval floods and people asking for your code: You reject approval prompts you did not start and know never to share a verification code with anyone.
- Quick task: an account security checklist
Everyday working habits
- Clean desk and locked screen: You lock your screen when you step away and never leave confidential papers or notes lying around.
- Sharing sensitive information: email, cloud, printer: You prevent leaks such as the wrong recipient, public sharing links and documents left on the printer.
- USB sticks and unknown devices: You never plug in unknown devices you find or are handed, and copy company data only to approved media.
- Updates and approved software only: You install updates without delay and use only applications your organisation has approved.
- Mobile and remote work: home network, public Wi-Fi, VPN: When working from home, a café or on the move, you protect your device, connection and screen from prying eyes.
- Travel and oversharing on social media: You see how posts reveal details about your employer, role and travel, and decide consciously what to share.
- What not to type into AI tools at work: You learn through examples why customer data, passwords and confidential documents never go into unapproved AI tools.
- Quick task: find the risks in an office description
Notice it, report it
- Something’s wrong: signs of a compromised account or device: You notice signs such as unknown sign-in alerts, messages you did not send and a device that suddenly slows down.
- Reporting culture: report fast, no blame: You know why to report at once, even after your own mistake, and exactly how to do it.
- What happens after you report: You learn which steps your report goes through in the security team and what you may be asked for.
- Capstone: triage suspicious messages in an inbox: You sort messages in a fictional inbox into safe, suspicious and dangerous, and write reports with your reasons.
Practice labs
- Three signs in an e-mail: Open five .eml files and mark the ones that are suspicious by sender address, link or attachment.
- Display name versus real address: Compare display name and real sender domain in ten messages and list the spoofed ones and those with a different reply-to address.
- Tell spear phishing apart: Separate mass phishing from messages tailored to a person and write the personal detail used and its likely source.
- A link's real destination: Compare the visible text and the real address of ten links and identify the mismatches without clicking.
- Look-alike domains: Compare addresses using letter swaps, extra words and subdomain tricks against the organisation's real domain and pick out the fakes.
- Shortened and redirecting links: Find the final destination of shortened links and redirect parameters with the lab's safe resolver and report the risky ones.
- SMS and QR code traps: Examine eight SMS and QR code examples and write which are scams and what they try to get you to do.
- A fake invoice request: Examine a thread that appears to come from a supplier asking to change bank details and write the warning signs and the verification steps.
- The transcript of a voice-clone call: Mark the pressure techniques in the transcript of a call demanding an urgent payment in a manager's voice and write the right response under company rules.
- Password or passphrase: Rank ten sample passwords from strong to weak and write why each one sits where it does.
- Account security gaps: Find reused passwords, accounts without MFA and weak recovery options in an employee's account list.
- Approval floods and code requests: Review one night's login-notification log, recognise the approval flood and write the right behaviour and reporting steps.
- Risks on the desk: List everything in a desk description that breaks the clean-desk and locked-screen rule.
- Choose the right sharing channel: For eight sharing situations, choose with reasons between e-mail, corporate cloud, encrypted transfer or not sharing at all.
- What not to type into an AI tool: Review twelve sample prompts, mark those containing customer data, source code or confidential plans and rewrite them safely.
- A home network checklist: Find risks such as a default password, old firmware and shared devices in a home network description and put the fixes in order.
- The right call while travelling: Judge six decisions in airport, hotel and café scenarios as safe or risky and write the safer option.
- Information harvested from social media: List what an attacker could learn from an employee's posts and write a phishing scenario that could be built from it.
- Something is wrong: the signs: Decide which of ten signs point to a compromised account or device and write the first thing to do.
- Write a good report: Write a short report to the security team about a suspicious message that answers what happened, when and what you did.
- What to do after clicking: From the account of an employee who clicked a link and entered a password, put the required actions in the right order and mark what not to do.
About this course
You spot phishing, social engineering and risky habits, protect your passwords, devices and company data, and report anything suspicious straight away.
What you will learn
- Phishing and social engineering
- Accounts and identity
- Everyday working habits
- Notice it, report it
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.