Security and AI usage training
Live training tailored to your company, for managers and staff. One program covers classic security awareness and the safe use of AI tools.
Training topics
Old tricks and new tools
Generative models are now in the hands of both attackers and employees. One side uses them to write phishing emails in flawless Hungarian, the other pastes draft contracts or client data into them. That is why we cover the two topics together.
Phishing and social engineering
Today's phishing email is grammatically flawless and refers to your organization's real processes. We teach the patterns by name, because people recognize a pattern once it has a name: the instruction from an executive, the changed bank details on an invoice, the shared document, the QR code.
Passwords and multi-factor authentication
Password hygiene, password managers, and safe browsing. MFA fatigue belongs here too: the attacker already has the password and keeps sending approval requests until the user taps one just to make them stop.
What you can type into an AI tool
A three-level data classification: public, internal, and personal data. Pasting personal data into a public AI service counts as a data transfer under the GDPR, usually with no legal basis and no data processing agreement.
Shadow AI
A department signs up for an AI tool with a company card, uploads its own data, and nobody knows about it. The training shows which tools are approved in your organization and what to do if someone needs a different one.
An AI answer is not a fact
A model will state falsehoods with confidence (hallucination), and it cannot reliably tell instructions apart from data. When it summarizes an incoming email, an instruction hidden in that email can run as well. This is indirect prompt injection.
Managers and staff
Managers and staff face different questions
Managers decide on the tools and carry the responsibility, while staff use them every day. That is why two separate modules build on a shared foundation.
Management module
It has its own content, built around decisions and questions of accountability. On AI, too, the focus is the management view: where not to start, what a realistic timeline looks like, and what data protection and model dependency mean for the organization.
Staff module
It is built on situations from everyday work, from the suspicious email and the urgent request to what you can type into an AI tool.
Deliverables
What you get at the end
items handed over
- Training material tailored to your organization
- Separate modules for managers and staff
- Live training in person or online
- Certificate of attendance
Related services
Rules and technical protection alongside the training
Training does not replace technology. These services put in place the rules and protective tools discussed in the training.
Shadow AI assessment with an AI usage policy
We find out which AI tools your employees use and with what data, then write the usage policy based on what we find.
GenAI data loss prevention
Stops sensitive data from ending up in AI tools, specifically in the traffic going to AI services.
Secure Copilot and Microsoft 365 AI rollout
Copilot sees whatever the user can see, so before the rollout we put permissions and sensitivity labels in order.
Email security
Protection against phishing, malicious attachments, and malicious links in email, fitted to your existing mail system.
Frequently asked questions
The questions we hear most
Isn't it enough to block AI tools?
A ban on its own does not work, because employees find ways around it. They need a usable alternative, such as a business subscription with a data processing agreement or a locally run model. We have written separate articles on shadow AI and on the risks of enterprise AI adoption.
What do you teach about phishing emails?
To report suspicious emails. Nobody can live up to a rule that says never click, and guilt discourages reporting: someone who is afraid of being told off will not say they clicked. And when someone urgently asks for something that involves money or access, the request has to be verified through a different channel, not by calling the phone number given in the email. You can read more in our article on phishing.
Do managers have to attend?
In organizations that fall under NIS2, yes: the directive requires members of the management body to take part in regular cybersecurity training. We recommend the management module even if NIS2 does not apply to your organization, because targeted attacks go after managers.
