Phishing doesn’t announce itself. It arrives dressed as the registrar, the bursar, a supervisor at 11:40 at night. We teach students, faculty and staff to recognise it — in minutes, not modules.
Incidents start at inconvenient hours, with someone tired and busy. So the programme follows that shape — it meets people at the moment of pressure, gives them something to practise, and keeps going until recognition is automatic.
Attackers read the academic calendar too. Enrolment week, grant deadlines, results day — the pretexts are timed, and they are good. We start by showing people the kind of message that actually reaches institutions, not stock examples with obvious typos.
Short exercises, run in the flow of normal work, with a debrief the moment someone engages. No annual sitting, no ninety-slide deck, no quiz that tests whether they can still read. Practice, feedback, and back to work.
The goal isn’t a completion certificate — it’s the pause before the click, and the reflex to report. Progress is tracked per person and per department, so the habit forming is something you can see rather than assume.
A campus is thousands of people making small decisions all day, on their own devices, at their own hours. Awareness has to reach all of them — not just the ones who show up to the security briefing.
Arriving with personal devices, shared logins and an inbox full of things that look official.
Holding research, grades and student records. Guidance that respects their time and what they handle.
Needing evidence that awareness is improving — measurable progress, not a completion checkbox.
The platform is in active development for schools, colleges and universities. Leave an address and we’ll get in touch when early access opens.