Beginner to intermediate
Cybersecurity Essentials & Incident Practice
Learn practical defenses, then practice how to respond when something looks wrong. Adapt the examples to the audience, from everyday account safety to a team incident exercise.
Who it is for
Small businesses, community learners, schools and workplace teams
Starting point
An introductory version needs no security background. A team incident workshop works best when the host can identify its existing reporting route and the people responsible for accounts, devices and backups.
Format
Introductory class, intermediate team workshop or progressive series with a tabletop exercise.
What you will practice
- Recognize phishing, social engineering and common account threats.
- Practice safer access, sharing, device and backup habits.
- Work through a simulated suspicious-email or account incident.
- Create an escalation checklist with clear owners and next steps.
Examples, pacing and learning checks are tailored to the audience. Tools, accounts and any paid feature requirements are agreed before booking. Instruction is provided independently by Wire Hold.
01 / Syllabus
Inside the course
A proposed outline for planning your class. Examples and depth are tailored to the audience; the final syllabus is agreed with the host.
Module 01
Recognize suspicious activity
Explore phishing, impersonation, unexpected account prompts and requests for sensitive information. Verify requests through a known route.
In practice
Inspect fictional messages and decide which details require a second check.
Module 02
Strengthen everyday habits
Discuss account access, multifactor authentication, device updates, sharing permissions and backups in the audience’s context.
In practice
Use a sample workplace setup to identify practical improvements and responsible owners.
Module 03
Practice an incident conversation
Work through a simulated suspicious-email or account event. Decide what to report, what information to preserve and who should make the next decision.
In practice
Run a tabletop scenario with new information introduced in stages, recording decisions and uncertainty.
Module 04
Turn lessons into actions
Review missed handoffs and unclear responsibilities. Prioritize a small set of improvements and identify questions for the organization’s technical lead.
In practice
Complete an escalation checklist and an action register with owners.
02 / Format & pacing
Make room for practice
Suggested plan: a 2-hour essentials class followed by a separate 90-minute tabletop exercise. Either can be scoped as a standalone session; a series allows time to practice habits between meetings.
Timings are suggested lesson plans, not confirmed availability or fixed delivery commitments. Group size, access needs, breaks and prior experience shape the final schedule.
03 / Takeaways
Keep learning after class
- A practical account, sharing and backup-habit checklist.
- A reporting and escalation worksheet adapted to the audience.
- Tabletop decision notes and a short improvement list when the exercise is included.
Practice work uses fictional, public or approved material. Sample records and projects illustrate the method; they are not client results.
04 / Learning check
Show what you can do
Recognize a suspicious request, explain a safe verification route and make a reasoned escalation decision during a simulated event. Team feedback focuses on clear responsibilities and communication.
Learning checks guide feedback and next steps. Completion does not imply vendor certification, accreditation or academic credit.
05 / Preparation
Plan a class that works for everyone
- Share the audience’s roles and existing incident-reporting process, if any.
- Use fictional scenarios; no real phishing campaign, live attack or production test is included.
- For a team exercise, invite the agreed operational and technical decision-makers and confirm accessibility needs.
Before booking, we confirm the audience, learning goals, format, materials, instructor requirements and fee. Tool subscriptions or other third-party costs are identified separately when relevant.
06 / Questions
Before you book
Is this a security audit?
No. Training develops skills and rehearses decisions using controlled examples. A security assessment or authorized testing engagement has a separate scope.
What if a real incident comes up during training?
The host should use its established response route. The class is not an emergency response service; any separate incident review needs agreed authorization, access and availability.
Bring this class to your audience.
Tell us who the work is for, what you want to improve and your preferred timing. We will confirm fit and provide a scope-based quote, with deliverables, schedule and fees agreed before work begins.