Back to catalog
Workplace securityBeginner

Cybersecurity at Work

Eleven lessons for the person with a work mailbox: how an attack on a company is built out of ordinary requests, why the payment your director asked for is the most expensive message you will ever read, and how to report fast enough for the report to matter

Cybersecurity at Work

About this course

A course for employees rather than for security teams. It starts where personal digital hygiene ends — at the moment you walk into work and the mailbox in front of you belongs to a company with money, clients and suppliers. Accountants and their colleagues in finance, assistants, office and HR managers, sales and support, team leads, and anyone who has ever been asked to pay an invoice today will find their own working day in these lessons.

Eleven lessons cover targeted phishing assembled from what the company publishes about itself; the forged message from a manager asking for an urgent payment, taken apart line by line; swapped bank details in a long-running thread with a supplier; cloned voices and video calls; attachments, links and documents that want you to press one button; corporate accounts, single sign-on and the confirmation prompt you did not request; remote work, home routers, other people's Wi-Fi and a visible screen; removable drives, access rights and company data in personal services. The last module is about the minutes after something goes wrong: what to do first, what to write, and who to tell.

Two things shape the tone. The first is that nobody here is called careless. A good attack is designed to pass a competent, busy person on a normal Tuesday, and a course that shames people produces silence rather than safety. The second follows from it: the result this course aims at is not an employee who never clicks, but an employee who reports within minutes. Everything a company can still do — end a session, recall a payment, warn the supplier, stop the second wave — depends on that one habit. The material follows public guidance from CISA, NIST and ENISA, and deliberately leaves out advice that those bodies have retired.

Course curriculum

  1. Why the attack starts with you

    What an ordinary employee account is worth to an attacker, how a targeted message is assembled from public information, and what actually arrives in work mail instead of the virus everybody pictures.

    • 1.“Who would bother with me” — why the target is you12 min
    • 2.Targeted phishing assembled from public information13 min
    • 3.Attachments, links and documents in work mail14 min

  2. Money: forged instructions and swapped details

    The most expensive attack on a business, taken apart line by line: the urgent payment requested by a manager, the supplier whose bank details changed mid-thread, and the voice on the phone that sounds exactly like your director.

    • 1.The urgent payment your director never asked for16 min
    • 2.The supplier whose bank details changed15 min
    • 3.A voice and a face that are not there13 min

  3. Accounts, devices and access

    What single sign-on means for you, why a confirmation prompt you did not request is already an incident, how remote work actually changes the risk, and what “only what the job needs” looks like in practice.

    • 1.Corporate accounts and the prompt you did not request15 min
    • 2.Remote work: the router, the café and your screen14 min
    • 3.Other people's devices, access rights and where company data ends up13 min

  4. Reporting: the only habit that has to survive

    What to do in the first fifteen minutes after a click, how to write a report that is useful, and why a message sent an hour late is worth incomparably more than one never sent at all.

    • 1.The first fifteen minutes after a click12 min
    • 2.How and where to report, and why an hour late beats never13 min