Interactive Learning Journey Step 1 of 5: Phishing Awareness
📊
PPT Deck
1
1. Phishing
2
2. Passwords
3
3. Privacy
4
4. Reporting
5
5. Assessment
⚡
Level 2 (Adv)
🏆
Certificate
📊 Executive Briefing · 10 Slides

Enterprise Cybersecurity Awareness Presentation

Comprehensive corporate orientation covering modern social engineering vectors, identity defense, ISO 27001/42001 protocols, and everyday cyber resilience.

💡

Presentation Overview & Controls:

Navigate through the 10 briefing slides using the controls below or keyboard arrow keys (◀ / ▶). Use "📝 Notes" for speaker explanations, "⛶ Fullscreen" for theater presentation, or "📥 Download PPT" to get the editable PowerPoint file for team briefings.

📊 Executive Deck Slide 1 of 10
📥 Download PPT
ACMECORP ENTERPRISE SECURITY BRIEFING · 2026

Cybersecurity Awareness:
Defending the Human Perimeter

Essential Protocols, Social Engineering Defense & AI Threat Preparedness
✓ ISO/IEC 27001:2022 Aligned ✓ ISO/IEC 42001 (AI Systems) 👥 All Enterprise Personnel ⏱ 10 Slides · ~20 Mins
Module 1 · Context & Enterprise Risk
The Modern Threat Landscape: Cyber Threats Target People
82%
Human Factor in Breaches
The vast majority of corporate network intrusions stem from phishing, stolen credentials, or social engineering rather than software zero-days.
$4.45M
Average Breach Cost
Includes direct forensic incident response, regulatory compliance penalties (GDPR/HIPAA), customer notifications, and business disruption.
3.4B
Phishing Emails Daily
Threat actors now deploy Generative AI to generate flawless localized grammar, executive lookalike emails, and voice clone pretexts.
Module 1 · Threat Vectors
Primary Social Engineering Attack Vectors
📧
Email Phishing (Mass Deception):Deceptive emails mimicking IT helpdesks, Microsoft 365, or payroll to steal login credentials or drop malware.
🐋
Whaling & Executive BEC:Targeted attacks impersonating C-suite executives urging finance to authorize urgent wire disbursements.
📱
Smishing (SMS Phishing):Urgent mobile text messages claiming bank locks, package delivery issues, or MFA confirmation prompts.
📞
Vishing (Voice Impersonation):Adversaries calling employees posing as IT support engineers requesting remote desktop credentials.
📑
Supply Chain Invoice Redirection:Compromised vendor accounts emailing legitimate-looking invoices with altered bank wire routing.
Module 1 · Spot the Threat
Anatomy of a Phishing Attack: The 5 Critical Red Flags
🚨 Simulated Attack Header & Payload
From: IT Service Desk <noreply@secure-it-helpdesk.net>
Subject: ⚠️ URGENT: Account Suspension in 45 Mins
Body: "Dear Employee, unauthorized logins detected from Romania. You must verify credentials immediately or face workstation termination."
Link: [VERIFY LOGIN NOW] ➔ https://secure-it-helpdesk.net/m365/login
🔍 Forensic Indicators To Check
  • Spoofed Sender Domain: Lookalike domain (secure-it-helpdesk.net ≠ your company domain).
  • Manufactured Urgency: Tight deadlines ("45 minutes") engineered to bypass critical thinking.
  • Generic Salutation: "Dear Employee" indicates mass-sprayed harvesting campaign.
  • Mismatched Hyperlinks: Hovering over button reveals external credential-stealing proxy.
  • Coercive Pressure: Threats of disciplinary action to isolate you from verifying with peers.
Module 2 · Access Security
Password Hygiene & Multi-Factor Authentication (MFA)
🔑 Passphrase Standards
  • Length Beats Complexity: 16+ character passphrases (e.g. Coffee#River$Blue49) take centuries to crack.
  • Zero Reuse: Never use the same password across corporate and personal services.
  • Password Managers: Use approved enterprise vaults to store and auto-fill cryptographically unique keys.
  • Never Share Credentials: Never transmit passwords over chat, email, or sticky notes.
🛡️ Multi-Factor Authentication (MFA)
  • The Non-Negotiable Barrier: MFA stops 99.9% of credential-stuffing attacks even if passwords leak.
  • FIDO2 & Authenticator Apps: Mobile push / TOTP apps and hardware security keys exceed legacy SMS.
  • MFA Fatigue Attack Alert: If bombarded with push requests you didn't initiate, REJECT ALL.
  • Prompt Escalation: Report unsolicited push prompts to SOC immediately — your password was compromised.
Module 3 · Operational Security
Data Privacy & Clean Desk Policy (ISO/IEC 27001 Controls)
📋 Data Classification

Proper handling depends on asset sensitivity:

  • Public: External marketing, public press.
  • Internal: General intranet policies.
  • Confidential: Financials, strategic plans.
  • Restricted: PII, customer data, API keys.
🔒 Clean Desk & Screen (A.7.7)

Physical workspace hygiene protects assets:

  • Lock Workstations: Win + L or Mac Cmd+Ctrl+Q whenever stepping away.
  • No Sticky Notes: Writing passwords on screens is an audit failure.
  • Shred Printouts: Use locked disposal bins.
⚖️ Handling PII & Compliance

Safeguarding Personally Identifiable Info:

  • PII Scope: Names, SSN, banking info, emails.
  • Need-to-Know: Access only what is required.
  • Data Masking: Redact PII in shared docs.
  • Zero Personal Egress: Never email files home.
Module 4 · Incident Response
Incident Reporting: The Critical First 15 Minutes
STEP 1
Identify or Suspect
Notice an unusual email, accidental link click, unauthorized wire request, or sudden popup warning.
STEP 2
Never Hide or Panic
Our organization operates a blame-free reporting culture. Prompt reporting protects the enterprise.
STEP 3
Click "Report Phishing"
Use the integrated reporting button in Outlook/mail client to submit headers directly to the SOC sandbox.
STEP 4
Isolate & Escalate
If credentials were entered or malware downloaded, disconnect Wi-Fi and immediately notify IT Helpdesk.
⚡
The Golden Rule: An accidental click reported in 5 minutes is a quick SOC remediation. An unreported click concealed for 24 hours becomes a corporate ransomware disaster.
Level 2 Track · ISO/IEC 42001 & AI Threats
Emerging Threats: Generative AI, Voice Deepfakes & Shadow AI
🎙️ Executive Voice Deepfakes

Adversaries clone executive voices using 3-second public recordings to leave urgent voicemails demanding wire transfers.

Defense: Mandatory out-of-band voice callback to pre-verified numbers. Never accept voice authorization alone.
🛡️ Shadow AI Data Ingestion

Pasting company code, client data, or unannounced financial figures into public consumer AI models leaks IP into public datasets.

Defense: Strictly use enterprise-approved LLMs with verified zero-retention data privacy guarantees.
💉 Prompt Injection Attacks

Untrusted resumes, invoices, or web pages can contain invisible text commanding connected AI tools to leak system data.

Defense: ISO 42001 guardrail filters and content isolation barriers before agent processing.
Summary · Daily Operational Checklist
The Human Firewall: 5 Daily Commitments
1️⃣
Stop & Inspect:Pause before clicking unexpected links, downloading unsolicited attachments, or entering credentials.
2️⃣
Out-of-Band Wire Verification:Never modify banking routing or authorize wire disbursements without direct verbal phone confirmation.
3️⃣
Protect MFA Like House Keys:Treat authenticator prompts as strict security gates; never approve an unexpected push notification.
4️⃣
Clean Desk & Instant Screen Lock:Lock computers every time you leave your desk. Keep badges and confidential records secure.
5️⃣
Report Quickly & Without Hesitation:Use the Report Phishing button. Proactive alerts help our SOC defend all employees enterprise-wide.
TRAINING ORIENTATION COMPLETE

Ready for Hands-On Practice!

Apply your knowledge through our simulated threat labs and knowledge assessment.
✓ Step 1: Interactive Phishing Simulators (Whaling, Boss Scam, Vendor BEC)
✓ Step 2: Password Strength Tester & Clean Desk Spot Challenge
✓ Step 3: Final Knowledge Assessment (5 Randomized Questions · 80% to Pass)
✓ Step 4: Downloadable & Printable Official Certificate of Completion
📥 Download Complete PowerPoint Presentation (.pptx)
📥 Download PowerPoint (.pptx)
🎣 Module 1 · Fundamentals

Phishing & Social Engineering

Learn to identify deceptive emails, SMS attacks, and voice scams designed to steal credentials and compromise systems.

💡

What to do on this page (Step 1 of 5):

1. Review the 3 scam examples below (Email, Text/SMS, Phone Calls).
2. Test yourself on the 4 interactive attack simulators below (Whaling, Boss Scam, Vendor BEC, IT Phish).
3. In the spot-the-threat challenge, identify all forensic red flags in the simulated attacks.
4. When you're ready, click "Continue to Step 2: Passwords →" at the bottom of the page!

🎣
Email Phishing
Most common attack vector

Phishing emails masquerade as trusted entities (banks, IT departments, executives) to trick you into revealing credentials, clicking malicious links, or downloading malware-laced attachments.

Attackers use domain spoofing (e.g., support@paypa1.com), lookalike logos, and urgency tactics to bypass critical thinking.

🔑 Key Red Flags
  • Unexpected urgency ("Act NOW or lose access")
  • Sender domain doesn't match the company
  • Requests for credentials or payment via email
  • Generic greetings ("Dear Customer")
  • Grammar or spelling errors in official-looking emails
📱
Smishing (SMS Phishing)
Attacks via text messages

Attackers send fraudulent SMS messages impersonating delivery services or IT. They create urgency to make you click without thinking.

📱 Simulated SMS Thread
+1-555-0197 (Unknown)
ALERT: Your package #7742 is on hold. Confirm address: fed-ex-delivery.tk/confirm
You
This looks suspicious! I won't click that link.
✅ Correct — This is Smishing!
The domain fed-ex-delivery.tk is fake. Never click links from unknown text messages.
📱 Smishing Rule
  • Legitimate carriers never ask for passwords via SMS
  • Watch out for random 10-digit unknown sender numbers
  • Never click shortened or unfamiliar links on mobile
📞
Vishing (Voice Phishing)
Phone-based social engineering

Attackers call employees posing as IT support, vendors, or executives, using pressure and authority to extract sensitive information or system access.

They often pretend there is an urgent emergency with your workstation or cloud credentials that requires your immediate password.

☎️ Vishing Defense Tactics
  • Never provide passwords over the phone — IT will NEVER ask
  • Verify caller identity by hanging up and calling the official number
  • Be wary of callers creating urgency or claiming authority
  • Use a code word system with your IT team for verification
🎯 Interactive Simulators: Social Engineering Lab
Select Social Engineering Attack to Inspect:
🔍
Spot the Threats Challenge
Click each threat indicator you can spot in the email on the left.
Progress: 0 / 5 identified

Click each item below when you spot it in the scenario to the left:

5 found = Scenario Complete!
ℹ️
Enterprise Defense Rule: Whether an email claims to be IT support, your CEO, or an overseas vendor — always verify unusual payment requests and credential demands out-of-band via phone or internal chat.
Step 1 of 5: Phishing Awareness
🔐 Module 2 · Fundamentals

Password Hygiene & Multi-Factor Authentication

Master the art of creating unbreakable passwords and learn why MFA is your strongest line of defense.

💡

What to do on this page (Step 2 of 5):

1. Review the 3 password rule cards below.
2. Test a sample password in the live meter below — achieve "Strong" to auto-complete this step.
3. Understand how Multi-Factor Authentication (MFA) works, then click "Continue to Step 3: Data Privacy →"!

🔑
Strong Password Principles
NIST SP 800-63B Guidelines

A strong password is your first barrier against unauthorized access. Modern guidance prioritizes length and uniqueness over complex character requirements.

📋 Corporate Password Policy
  • Minimum 12 characters (16+ recommended)
  • Mix of uppercase, lowercase, numbers, and symbols
  • No dictionary words, names, or keyboard patterns
  • Unique password for every account — no reuse
  • Use a corporate-approved Password Manager
⚠️
Common Password Mistakes
What attackers look for first

Attackers use automated tools to crack common patterns in seconds. Never use predictable phrases:

password123 Company2026! qwerty Summer2026 123456789 Welcome@1
🚫 Never Use
  • Names of family, pets, or birthdays
  • Keyboard sequences like asdfgh or 123456
  • Seasonal words with numbers like Spring2026!
🗄️
Password Manager Essentials
One master key, total security

Password managers generate, store, and autofill complex unique passwords for every service — eliminating password reuse and memory burden.

Approved enterprise tools: 1Password, Bitwarden, Keeper, CyberArk.

✅ Password Manager Benefits
  • Auto-generates 24+ character random passwords
  • Detects and alerts on breached credentials
  • Secure encrypted sharing for team logins
  • Works across all devices seamlessly
💪
Interactive Password Tester
Type below to see real-time entropy scoring
Enter a password

Tip for non-IT users: Combine 3–4 completely unrelated words into a passphrase (e.g., Purple$Elephant_Runs@42!). It's easy for humans to remember, but impossible for computers to guess.

💡 Passphrase Formula
  • Pick 3 random words: Staple-Coffee-Rocket
  • Add symbols & numbers: Staple#Coffee42Rocket!
🔒
Multi-Factor Authentication (MFA)
Stops 99.9% of account attacks (Microsoft)

MFA requires two independent verification factors before granting access. Even if an attacker steals your password, they are blocked without factor #2.

👤
1
Password
You KNOW
→
📱
2
Phone / App
You HAVE
→
✅
3
Access
Secured
🚨
MFA Fatigue Warning: If you receive an unexpected push notification you didn't initiate, deny it immediately and notify IT.
Step 2 of 5: Passwords & MFA
🔒 Module 3 · Fundamentals

Data Privacy & Clean Desk Policy

Protect sensitive information through proper data handling, PII identification, and a clean physical workspace.

💡

What to do on this page (Step 3 of 5):

1. Review the 4 Data Classification tiers (Secret, Confidential, Internal, Public).
2. Click on the highlighted text in the HR report to practice redacting PII (Personal Data).
3. In the Clean Desk scanner, click on all 6 physical security violations to secure your desk, then click "Continue to Step 4"!

📊
Data Classification Framework
Know what you're protecting and how to handle it
🔴 Restricted / Secret
Trade secrets, credentials, encryption keys, legal holds, executive communications
🟡 Confidential
Employee records, financial data, customer PII, business strategies, HR documents
🔵 Internal Only
Internal policies, org charts, meeting notes, project plans (no external sharing)
🟢 Public
Press releases, published reports, marketing materials, job postings
🎯 Interactive: Identify & Redact PII
🔍
PII Redaction Exercise
Click on each piece of Personally Identifiable Information (PII) in the document below to redact it.
ℹ️
PII is any information that can identify an individual. Regulations like GDPR, CCPA, and HIPAA require organizations to minimize, protect, and control access to PII. Click highlighted text to redact.
INTERNAL HR REPORT — CONFIDENTIAL

Employee Name: John Michael Smith has been with the company since 2019. His employee ID is EMP-2019-4412. He resides at 123 Maple Street, Austin, TX 78701. His personal mobile number is +1 (512) 555-0147 and personal email is john.m.smith.personal@gmail.com. His Social Security Number on file is XXX-XX-4521. Health insurance plan: BCBS Gold — member since March 14, 1988. Annual compensation: $98,500 + 15% bonus target.
⚠️
Note: This document should never be sent via unencrypted email. Always use the secure file transfer portal and limit recipients to authorized personnel only.
🖥️ Interactive: Clean Desk Security Scan
🖥️
Clean Desk Policy — Security Scan
Click on each item that violates the Clean Desk Policy to remove it. Score: 0 / 6 violations cleared
Loading desk scene...
📋 Clean Desk Checklist
  • Lock screen when leaving desk (Win+L / Ctrl+Cmd+Q)
  • Shred printed confidential documents after use
  • Remove USB drives and store them securely
  • Never write passwords on sticky notes
  • Secure visitor badges when not in use
  • Enable screensaver with password after 5 minutes
🚨
Shoulder Surfing: Attackers can read sensitive information from your screen or desk in shared/open office environments. Always use a privacy screen filter and position monitors away from public areas.
Step 3 of 5: Privacy & Clean Desk
🚨 Module 4

Incident Reporting Workflow

Practice identifying phishing emails in a simulated inbox and learn the correct steps to report security incidents.

💡

What to do on this page (Step 4 of 5):

1. In your simulated email inbox below, click on each of the 3 emails to read them.
2. For suspicious phishing messages, click the red "🚨 Report Phishing" button.
3. Practice identifying genuine vs malicious messages, then click "Continue to Step 5: Final Assessment →"!

Mail Folders
📥 Inbox 3
⭐ Starred
📤 Sent
🗑️ Trash
🚨 Reported
Training
📚 Completed
📋
Incident Response Protocol
What happens after you report a phishing email
📧
1. You Report
Click "Report Phishing" in your email client or forward to security@yourcompany.com
🔬
2. SOC Investigates
Security Operations Center analyzes headers, URLs, and payloads within minutes
🛡️
3. Threat Contained
Malicious domains blocked at firewall, email gateway updated, organization-wide alert issued
📊
4. Lessons Learned
Incident logged, training updated, detection rules refined for future prevention
Step 4 of 5: Incident Reporting
📝 Module 5

Knowledge Check & Final Assessment

Demonstrate your cybersecurity knowledge with 5 randomized questions. You need 80% or higher to pass and receive your certificate.

💡

What to do on this page (Step 5 of 5):

1. Choose Level 1: Core Fundamentals (or toggle to Level 2 for advanced AI & adversary threats).
2. Click "🚀 Start Assessment" and answer 5 multiple-choice questions.
3. Score 80% or higher (4 out of 5) to automatically unlock your official certificate! You can retake the quiz as many times as you like.

📝

Ready for Your Assessment?

5 questions drawn from a randomized question bank. Both questions and option choices are randomized on each attempt. You need 80% to pass.

5
Questions
80%
Pass Score
∞
Attempts
Step 5 of 5: Final Assessment
⚡ Advanced Certification Track

Level 2: Advanced Threat Defense & ISO 42001 AI Security

Comprehensive defensive mastery mapped to real-world offensive adversary tactics, MITRE ATT&CK telemetry, ISO/IEC 27001:2022 ISMS Controls, and ISO/IEC 42001:2023 Artificial Intelligence Management Systems (AIMS).

⚡

Level 2 Advanced Defense Track:

1. Review the 3 Pillars: Offensive Adversary Tactics, ISO 27001:2022 Controls, and ISO 42001 AI Security.
2. Try the 3 Interactive Labs below (Prompt Injection Sandbox, Voice Deepfake Analyzer, Shadow AI Classifier).
3. Click "Take Level 2 Assessment" to unlock your special Level 2 Endorsement on your Certificate!

🎯
Offensive Adversary Attack Vectors
Real-World Adversary TTPs & Exploitation

Modern adversaries utilize sophisticated techniques that bypass conventional controls:

⚔️ Advanced Adversary Profiles
  • AitM Reverse-Proxy Phishing: Frameworks like Evilginx proxy authentic traffic in real time, capturing session cookies to bypass OTP/Push MFA. Countermeasure: FIDO2 / WebAuthn hardware keys.
  • Quishing (QR Code Phishing): Malicious URLs embedded inside image matrix barcodes that evade optical and email spam filters.
  • Physical Hardware Drops: Weaponized BadUSB / Rubber Ducky HID devices injecting malicious keystroke payloads in seconds.
  • OSINT Reconnaissance: Gathering company hierarchy and supplier relations via open sources to orchestrate spear phishing.
📜
ISO/IEC 27001:2022 Controls
Information Security Management (ISMS)

The updated 2022 revision introduces critical Annex A security controls required for modern enterprise resilience:

🛡️ Key Annex A 2022 Controls
  • A.5.7 Threat Intelligence: Continuous ingestion and contextualization of adversary TTPs, IoCs, and MITRE ATT&CK telemetry.
  • A.8.11 Data Masking: Mandatory pseudonymization and tokenization of sensitive records before non-production or analytics use.
  • A.8.12 Data Leakage Prevention (DLP): Real-time egress inspection blocking unauthorized transmission of confidential IP.
  • A.8.8 Management of Technical Vulnerabilities: Risk-based patching cadence prioritized by CVSS severity and exploitability.
🤖
ISO/IEC 42001 & AI Threats
Artificial Intelligence Management (AIMS)

ISO/IEC 42001:2023 establishes governance for responsible, safe AI. Organizations must actively defend against the OWASP Top 10 for LLMs:

⚡ Emerging AI Threat Landscape
  • Prompt Injection (Direct & Indirect): Adversaries embedding hidden instructions in files/resumes to hijack autonomous AI agents (OWASP LLM01).
  • Shadow AI & Data Exfiltration: Staff pasting proprietary source code or customer PII into public AI systems lacking enterprise zero-retention (OWASP LLM02).
  • Deepfake Vishing & Synthetic Cloning: Sub-3-second voice synthesis cloning executive voices to authorize fraudulent wire transfers.
  • Data Poisoning & Model Inversion: Adversaries corrupting fine-tuning datasets or extracting sensitive training data via targeted inference.
🧪 Interactive Lab 1: AI Prompt Injection & Guardrail Defense
🛡️
Prompt Injection Defense Sandbox (ISO 42001 & OWASP LLM01)
Test attack prompts against our simulated Enterprise LLM Guardrail to witness automated sanitization in real time.
ℹ️
Select an attack preset below or write a custom prompt to test whether our ISO 42001 input sanitizers and context fences detect adversarial injection.
Ready for evaluation
ISO 42001 AI GUARDRAIL TELEMETRY STATUS: STANDBY
> Enter a prompt above and click "Run Guardrail Analysis" to inspect input filtering, intent classification, and policy enforcement telemetry...
🎧 Interactive Lab 2: Deepfake Voice Forensic Analyzer
🎙️
Deepfake Audio Vishing Inspection Lab
Analyze an urgent CEO voicemail demanding an immediate wire transfer. Identify all synthetic voice artifacts to protect company assets.
📞 Voicemail from "CEO_Marcus_Direct.wav" (Duration: 00:14) URGENT CALL

"Hi, this is Marcus. I'm boarding a flight to London right now and can't access Slack. We need to wire $180,000 immediately to Escrow Account #4912 to close the acquisition. Bypass standard approvals — I take full responsibility. Do it right now."

Forensic Checklist — Click each indicator you verify: (0 / 4 verified)
🤖 Acoustic Cadence Anomaly: Unnatural rhythmic regularity with absent respiratory micro-pauses
✈️ Context Clashing: Claiming airport boarding gate but missing environmental acoustics / announcements
⚠️ Process Subversion: Asking to bypass multi-person dual-control ERP treasury controls
🔒 Mandatory Protocol: Execute out-of-band callback on pre-verified internal number or challenge phrase
⚖️ Interactive Lab 3: Shadow AI Compliance Auditor
⚖️
Shadow AI & Data Governance Classifier
Evaluate whether each employee input complies with ISO 27001:2022 A.8.12 (DLP) and ISO 42001 AI Data Privacy.
Scenario 1: Code Debugging Pending Review

An engineer pastes an internal payment gateway script containing hardcoded AWS secret keys and database URLs into a public chat LLM to format SQL queries.

Scenario 2: Data Sanitization (ISO 27001 A.8.11) Pending Review

A data scientist substitutes all customer names with synthetic hashes (tokenization) and strips IP addresses before asking an approved enterprise LLM with a zero-data-retention agreement to generate trend charts.

⚡ Advanced Track: ISO 27001 & ISO 42001
🏆 Certificate

Completion Certificate

Your certificate of completion for the Enterprise Cybersecurity Awareness Program.

AcmeCorp Security · Cybersecurity Awareness Program
This is to certify that
has successfully completed the
Enterprise Cybersecurity
Awareness Program
Covering: Phishing & Social Engineering · Password Hygiene & MFA · Data Privacy & Clean Desk Policy · Incident Reporting · Knowledge Assessment
Date Completed —
Assessment Score —
Certificate ID —
✅ Verified · Compliant with ISO 27001:2022 · ISO/IEC 42001:2023 · NIST CSF 2.0 ✅
ℹ️
Tip: Type your name in the field above before printing. To save as PDF, use your browser's Print dialog and choose "Save as PDF" as the destination. SCORM completion status has been transmitted to your LMS.
🔒

Certificate Locked

Complete the Final Assessment with a score of 80% or higher to unlock your certificate.

🏆 Completion Milestone