LIVE WORKSHOPSLive workshops on
information security
Ten modules: a foundation for all employees, workshops by function, AI and deepfake, and programs that sustain culture through the year.
The platform builds a habit in all employees. Live workshops change behavior where a single mistake costs the most. Groups are limited to 15 to 17 participants, because that is the limit at which people still ask questions and take part - beyond it the room goes quiet and the workshop becomes a lecture. We adapt content and duration to your organization, and we write scenarios around your real processes.
01
Interactive,
with demonstrations
- Groups of 15 to 17: everyone gets to ask, and nobody hides in the back row.
- Body language demonstration: what gives away stress, which signals stand up in research and which are myth.
- Simulated conversation: we build a pretext in the room and show where it should have stopped.
- A vishing call, both sides of the headset: participants hear exactly where the conversation turns.
- Exercises on real frauds from practice, adapted to your industry.
- No singling out and no scare tactics: a mistake is learning material, not grounds for sanction.
Every workshop leaves a record: attendance list, a certificate for each participant and minutes for audit.
02
Where every
organization starts
Why we get hacked
2 hours · all employees · content refreshed quarterlyWhy we are susceptible to manipulation as humans and how an attacker uses it: urgency, authority, asking for a favor. How an attack is built, from publicly available data to a convincing message. The vectors employees actually meet - phishing, a call, a message, a QR code, a cloned voice, someone waiting for you to hold the door. Passwords and MFA, handling data, working outside the office. Signs of internal misuse and who to report them to. And one rule to remember: pause, verify through another channel, report.
Introduction for new hires
30 minutes · online · quarterly, for the new cohortA short introduction for people who have just arrived: why the program exists, how it works and what is expected of them on day one. Password and sign-in confirmation, what doesn't leave the building, caution with public AI tools, and who to tell when they suspect something. Delivered online, so it needs no gathering or travel.
03
Where a single mistake
costs the most
Management and C-level
90 minutes · board members and executive directors · group of up to 12Risk in business terms, without technical vocabulary. The personal responsibility the regulation places on governing bodies. What specifically targets management: a fake voice, a video call, a request that arrives while the director is traveling. An urgent-payment scenario the room solves live. And three questions management should regularly ask its security team. We invite executive assistants to the same session - they are the most common entry point for a request that looks like it comes from the director.
Managers
2 hours · heads of departments and unitsAn employee reports a suspicion to their manager before anyone else - so the manager's first reaction decides whether a second report ever arrives. What the regulation asks of a manager, how to respond to a report and why a false alarm is rewarded. Approvals under deadline and pressure. Signs of risky behavior in the team, including internal misuse, and how to escalate without accusing. A conversation with an employee who keeps repeating mistakes.
Finance and payments
2 to 3 hours · finance, treasury, procurementPayment fraud needs not a single line of malicious code - one convincing message and one approval are enough. Fake invoices step by step. Changing a supplier's bank details, the costliest single scenario. A call-back to the number in your master record, never the one in the request itself. Four eyes, segregation of duties and a holding period for new payees. Finally an exercise on your real approval flow, into which we have planted a fraud in advance.
HR and master data
2 hours · HR, master data, payrollHR is the only department that holds data on everyone and that, by the nature of the job, opens attachments from people it doesn't know. Extracting personal data by phone, with a demonstration of the call. Payroll diversion fraud, which always arrives just before payday. A fake CV with a malicious attachment. Changes to master data as a fraud vector. An employee joining, leaving or transferring as a security event, not only an administrative one.
Helpdesk and customer support
2 hours · helpdesk, support, receptionThe helpdesk is the most common target of calls that succeed - because it has the authority to restore access and is trained to be kind. What a call that gets through sounds like, demonstrated live from both sides of the headset. Password reset under pressure and the threat of escalation. What counts as sufficient identity verification and what only looks like it. How to say no without conflict, practiced in pairs. And a short script that stays on the desk.
04
The module that
changes fastest
AI, deepfake and safe use of AI tools
2 hours · all employees or targeted by rolePhishing is no longer recognized by poor language, so we show what remains as a signal: the channel, the context, the request itself and the time it arrives. A cloned voice and fake video - how much material an attacker really needs and what it costs. What happens to data an employee enters into a public AI tool and who sees it afterwards. House rules: which tools are approved and what is never entered. Finally a check that works: a call-back to a known number and an agreed code word.
05
When culture needs to stay
after the workshop too
Security ambassadors
introductory day + quarterly meetings · 10 to 15 participantsSelected employees become the first address for the question "is this okay?" in their unit. They learn how to run a short session without slides, how to answer when they aren't sure themselves, what goes to the security team immediately and how to talk about security without scaring people. It is not a one-day training: an ambassador left without support stops speaking up after the first question they can't answer. That is why the program has quarterly meetings where trends are refreshed, cases are shared and the next quarter's campaign is prepared.
Tabletop exercise
3 hours · management, IT, HR, communications, legalAn incident scenario written in advance for your organization, which the team solves under time pressure, with complications we inject mid-exercise. The goal is not to find someone to blame but to see where your policy and actual practice diverge. Reporting deadlines you calculate yourselves, as you would in a real incident. INC leads the exercise, and your person from compliance or internal audit keeps the minutes - so the minutes immediately become your audit evidence.
06
How workshops are chosen
and organized
- Which workshops and with which groups - decided after the initial assessment, based on findings and actual risk, not in advance from a catalog.
- Groups of up to 17 participants. A larger organization means more sessions, not a bigger room; we plan the schedule with your HR, around shifts and locations.
- Content is refreshed: the core workshop and the AI module quarterly, the others as your processes change.
- At your premises, in our language or in English. The introduction for new hires is delivered online.
- The program package includes an agreed number of workshops. Workshops outside the package are charged separately.
07Which three groups in your organization should go through a workshop first?
The answer to that question is already half of the program plan. Get in touch for a thirty-minute conversation - no obligation and no preparation on your side.
Ivan Dragaš · ivan.dragas@incinfosec.com
