Security awareness training
An 11-module workforce program built from documented incidents, controlled technical demonstrations, and the decisions that can interrupt compromise.
Approximately 76 minutes total, self-paced, with an annual refresh and an onboarding assignment for new hires.
Each module starts with a documented incident, includes a controlled demonstration, and ends with practical ways to reduce the risk.
Environments assessed. The attack paths taught are sourced from that fieldwork.
The method
Praeven teaches the tradecraft behind the policy. Every module trains people to think like the person the policy is trying to stop.
Learners watch a password fall in a recorded cracking demonstration, so the lesson lands as evidence.
Every module connects a documented incident with controls that can interrupt similar attacks.
No gotcha simulations and no public shaming. The goal is a workforce that reports early because it feels safe to.
The habits that help prevent business email compromise also help learners protect their families, finances, and identities.
Praeven Tradecraft Series
Target Package
The Human Perimeter: Security Culture and Individual Accountability
How an adversary researches a person before first contact, illustrated through an open-source reconnaissance demonstration. Establishes the five individual responsibilities and the anticipation standard the series builds on.
The Approach
Phishing and Social Engineering: Recognition and Response
The setup phase of every social engineering operation: email, spear phishing, smishing, vishing, and QR lures, including AI-written variants that defeat grammar-based instincts. Teaches the STOP check as the standing habit.
Watch a Password Fall
Strong Passwords and Passphrases
A recorded cracking demonstration shows why short, predictable passwords are vulnerable and how long, unique passphrases improve resistance to guessing. Length over complexity per current NIST guidance, no arbitrary periodic password changes (with required changes when compromise is suspected or confirmed), and an approved password manager wherever passwords remain necessary.
Beating the Second Lock
MFA and MFA Fatigue
How attackers defeat weak second factors: push-bombing, adversary-in-the-middle pages, and stolen session cookies, demonstrated from the attacker's console. Ranks factors from phishable to phishing-resistant.
The Voice on the Line
AI Threats and Deepfakes
How little source material a synthetic voice or video needs, and why the defense is a process rather than a better eye. Out-of-band callback to a directory number, a pre-shared challenge phrase, and dual authorization, executed regardless of who appears to be asking.
Know Where Data Lives
Handling Data the Right Way
Four-tier classification and the handling rules that follow from it, with a demonstration of what a compromised endpoint can expose: the passwords file, the cookie store, autofill, and a system fingerprint.
Hostile Ground
Safe Browsing and Device Security
Untrusted networks and devices treated as an operating environment. Evil twin access points, external exposure, and the device and identity controls that can limit whether a compromised browser becomes a compromised network.
Left in Plain Sight
Acceptable Use, Physical Security, and Clean Desk
What systematic observation of a workspace yields, demonstrated through badge cloning and keystroke injection. A dropped drive is a report to file, not a mystery to solve.
The Recruitment Pitch
Insider Threat Awareness: Behavioral Indicators and Reporting
Indicators of negligent, compromised, coerced, recruited, malicious, and third-party insider risk. Framed protectively, never as peer monitoring.
Observe and Report
Incident Recognition and Reporting Without Fear
What qualifies as reportable, the quantified cost of delay, and the no-blame standard. Includes the ransomware economy of brokers, affiliates, and leak sites.
Standing Posture
Security Commitment: Recap, Assessment, and Attestation
Program recap, final knowledge assessment, and the signed acknowledgment that generates the completion certificate.
Outcome
Learners recognize an approach sooner, rather than after the attack is already in motion.
Learners identify how to verify a request through an alternative method before acting on it.
Learners build the habit of speaking up: if you see something, say something.
Learners build habits that follow them home. These practices help protect learners and their families.
Evidence
| Record | Fields captured |
|---|---|
| Assignment | Learner identifier, course, assignment date, due date, and administrator. |
| Completion | Start and completion timestamps, time zone, and completion status. |
| Assessment | Attempts, final score, passing threshold, and result. |
| Acknowledgment | Acknowledgment status and the exact text accepted by the learner. |
| Version | Course, module, transcript, and export version identifiers. |
| Administration | Export date, administrator identity, certificate identifier, and renewal date where applicable. |
Evidence an assessor can sample. The six records capture assignment, completion, assessment, acknowledgment, version, and administration detail for each learner, exported for review. Control mappings for common frameworks are available privately on request.
Pricing
One annual price for your organization, based on workforce size. No usage fees or automatic renewal price increases.
Up to 25
$1,500per year
Up to 50
$2,500per year
Up to 100
$4,000per year
Over 100
Customscoped on request
The program is being released as production is completed. Organizations can begin with the available modules and receive each remaining module at no additional charge during the annual term.
Program request
Standard programs use the published pricing. Custom requirements are quoted separately.
Scope
Workforce size, roles, and what is driving the requirement.
Responsibilities
What Praeven delivers and what remains with the customer, stated before any agreement.
Delivery
Hosting, assignment method, accessibility needs, and language requirements.
Evidence
Export format, retention, and how records reach the reviewer.
Prepare. Anticipate. Protect.