Lion Cipher Lab
Build a security awareness and training program
- GRC / Compliance
- Intermediate
- ~60 min
- Free · no account required
Why it matters
The most-attacked part of almost every organization is not a server — it is a person reading email. Yet the human layer is the one control most often treated as a box to tick: play a video once a year, collect signatures, file the report, change nothing. This lab teaches you to design the human layer the way a professional does — as a control you enable and measure, with an owner, objectives, and metrics that show whether behavior actually changed. Almost every framework and regulation demands security awareness training, so the ability to design a real program (not a compliance ritual) is a…
What you'll learn
- security awareness program design
- audience and role-based training mapping
- writing measurable behavior-change objectives
- phishing simulation metrics (click rate and report rate)
- positioning a program on the SANS Awareness Maturity Model
- mapping awareness controls to NIST, PCI DSS, ISO 27001, and HIPAA
Steps in this lab
- The words this lab runs on, and a reframe
- Pick an environment and open your two artifacts
- Assess: identify your audiences and tie them to real risk
- Objectives: write goals you can actually measure
- Content and delivery: continuous beats the annual dump
- Simulate: measure and coach with phishing simulations
- Measure: build the metrics baseline table
- Govern and map to compliance — and mind the gap
- Judgment: the anti-pattern, and the way a pro does it
- What you built, and the mindset that outlasts it