Live cybersecurity training, delivered in the room
Training that leaves your clients with a plan they can follow.
A person turns up and works through it with the staff, in their own
building, on their own systems. We bring the curriculum, the trainer
and the training record. You keep the client.
You run IT for other peopleYou bring the client, we bring the trainer, and the record comes
back to you. Your account, your relationship, start to finish.
How that works.
Nobody is doing ITA church, a nonprofit, a small business or a village where the
person looking after the computers also does another job. We
train your people and cover the basics behind them.
What that costs.
You want to teach thisWe are building a bench of local trainers, starting with
students and early-career people who can hold a room. Paid per
session, and here is what it
involves.
Awareness training teaches people to spot the fake. It should give them a plan.
WASTeach people to recognize attacks.
ISKnow when to stop. Know who to call.
Attacks arrive looking like work: believable, urgent, and hard to tell
apart from what you were already doing. The old giveaways were broken
English, sloppy formatting and an address that's almost right, all of
which came from scammers sending thousands at a time in a second
language, and AI tools made them cheap to clean up. Awareness training still
sends people hunting for warning signs that no longer reliably show
up. That fails. Then it does something worse. It teaches them that
when they can't find one, the message is safe.
We're not trying to make everyone a cybersecurity expert.
We want people to know when to stop, who to call, and how to wait.
So we give people a plan instead. A short list of requests that
trigger it, written on a card before anything arrives. When one
arrives, nobody has to work out whether it's fake.
They stop, they call and they wait. The same three
steps, whether it's money or people at risk.
If you're the one who runs IT, this doesn't hand you another
program. You already look after the accounts, the computers, the
network, the backups, the help desk and the phone. You don't need
another thing for people to finish and forget. You need the training
you already provide to be useful. And when something has already
gone wrong, it reaches you sooner, while someone can still contain
it.
Training gets judged on whether people finished it. That belongs in
the record, and it says nothing about what stuck. Three things that
happened after people left the room.
A 7:00am session at a shop
Maybe two minutes of it were about physical security: who's
allowed in the room where the computers live. Months later, on
visits that have nothing to do with training, one of the guys
still calls it across the floor. Authorized people only in
the computer closet. Nobody assigned that. Nobody measured
it. It came out of one session before the workday started.
The first workshop we ever ran
Adam was explaining that a passphrase can come from a good
memory, something a grandchild said, a place you keep going back
to. An older woman interrupted, and she was excited, because she
already knew exactly which one she'd use. A senior adult excited
about a password is not a reaction anyone expects to get.
A joke nobody planned
Working through unexpected calls, one of the examples is: if the
jail calls to say your kid has been arrested, don't believe them.
The room laughs. Every room laughs, and somebody always points at
one person and says except for your kids. It stays in on
purpose now. A room that's laughing is still listening, and
people remember what they were laughing at.
None of that shows up in a report, and it's still the only evidence
that counts here. We're not looking for a finished course. We're
looking for a habit that's still running months later, when nobody
was watching for it.
Same three steps every time. What changes is who teaches it.
We train your team
An authorized trainer comes to you and works through it with your
staff and volunteers, face to face. Not a webinar, not a video. Real
questions about your actual setup, answered while everyone is
still in the room.
We could run these over video and save a lot of driving. We don't.
The material changes to fit the room, and you can't read a room you
aren't in. In the room, people ask what they'd never ask a video,
and they hear each other's worries before a real request arrives.
Somebody who walks out confused didn't come out level.
They're less safe than when they went in, and they don't know it.
Included in both plans: once a year on Essential, twice on Active.
We train your trainer
For the person who already keeps your systems running, whether
that is paid staff or the volunteer who sets up the sound desk on
Sunday. You get the curriculum, the scenarios, the scripts, and a way
to tell whether it's working, and you run it on your own schedule.
Nobody in the building has more reason to want it to work than
whoever has been keeping it running. And when they have
been saying the same thing for years, we can come in as the
different voice.
Scoped and priced per organization.
We train your clients
For IT providers with their own clients. Bring us in as the trainer
and stay the one they trust.
Your clients almost certainly already pay for awareness training.
It's a line on an invoice nobody looks at, and you still get the
wire-fraud cleanup and the eleven o'clock password reset. This
goes after the cost you are already carrying, not the line item.
Partnership terms by conversation.
Compliance
Find out what you actually owe before anyone sells you anything.
Auditors ask two things: what you trained, and whether you kept the
record. This gives you both. The harder question is which requirement
you carry in the first place. They aren't the same, and most
organizations around here have never been told which one is theirs.
These standards check three things: that training covered social
engineering, who got it, and when. Social engineering means
tricking a person rather than a computer. One of them goes further
and names behaviors. CJIS, the FBI's security policy for anyone
who touches criminal justice information, asks for training on
recognizing social engineering and on reporting it. But not one of
them requires that
your staff become accurate at telling real from fake, and not one
measures them on it. So they leave you room on the goal, and a
program built on stopping, calling and waiting sits inside it rather than
against it.
One exception. Some insurance questionnaires ask specifically about
phishing simulations, the fake scam emails some programs send to test
staff, and we don't run them yet. If your renewal turns on
click-rate numbers from those tests, tell us early. Renewal is the
worst time to find that out.
Founder. Information security analyst, Cedarville University
Nearly twenty years in the field, more than fifteen of them supporting
the Department of Defense. The person who wrote our approach is the
same one who gets the call at four in the afternoon asking whether a
wire transfer request is legitimate. He'd rather get that call
before something goes wrong than clean up after it does.
Thirty minutes with a security professional. No slides. Tell us
what you have and we'll tell you what we'd do first, including when
the answer is nothing.
