Track A
Human attack surface
- A.1Phishing, spear phishing, smishing and social engineering
- A.2Password security and multi-factor authentication
- A.3Secure email, internet and communication practices
Core curriculum
Twelve core modules. Four tracks. Then the pack your regulator expects.
Tracks A through D are the security awareness canon, written for busy professionals rather than for a generic office. Every organization gets them. Add-on packs go deeper where a specific framework says you must.
Track B
Information & privacy
- B.1Protection of confidential, proprietary and sensitive information
- B.2Privacy and personal data protection
- B.3AI and emerging technology security risks
Track C
Device & environment
- C.1Malware and ransomware awareness
- C.2Endpoint, laptop and mobile device security
- C.3Remote working and physical security
Track D
Governance & third parties
- D.1Access control and least privilege
- D.2Acceptable use of company systems and technology
- D.3Third-party, vendor and cloud security
How it runs
Establish it once. Maintain it all year. Prove it on demand.
Four modes, one program. The annual course is the floor, not the whole building.
Annual
Establish
The core curriculum plus your packs, assessed against a pass threshold and closed with an electronic signature. Roughly an hour, adjusted by role. This is the artifact an auditor asks for.
Monthly
Maintain
One unit of three to five minutes, plus a phishing simulation. Rotates through the tracks so no topic goes more than a quarter without contact.
On event
React
Triggered by a real incident, a new customer requirement or an emerging threat. Under three minutes, published within 48 hours. This is what makes a program feel alive rather than annual.
Always on
Prove
Every completion writes a durable record: what, when, which version, what score, whose signature. Export the whole population as an inspection packet, or one person as a training file.
Briefings · in design
Not everything is a course.
Some obligations are a document somebody has to read: a monthly security bulletin, an annual refresher deck, a policy that just changed. The training is the document. The hard part is proving people read it.
Today that proof is the last page of the deck. Name, signature, and a date the employee types themselves, emailed back to whoever is tracking it. Every weakness in that page is an evidence weakness: the date is unverifiable, the name is typed rather than authenticated, nothing records which version was read, and coverage is only as good as one person’s inbox.
Trained State publishes the document you already produce, in the format you already produce it. People are notified by email, sign in, read it, and confirm. The record carries the server’s timestamp, the authenticated person, the exact version and its hash, and the exact words they attested to.
Designed and specified, and the data model is built. Not yet shipping — it is being built with a cleared-contractor design partner.
- Confirm on the site, never in the emailA one-click link in a message gets followed by mail scanners. Any record it produced would be false.
- Only for yourselfNo administrator can confirm on someone else’s behalf. The database refuses it.
- Only what was servedYou cannot acknowledge a document the system never showed you.
- Your document, unchangedUpload the deck or the newsletter you already send. No re-authoring in a web editor.
- The roster shows gapsWho has confirmed, who opened it and stopped, and who has not started.
- What we will not claimThat it proves someone read or understood the document. No product can. It proves who attested to what, and when.
Pilot program
Start with the core. Add the pack.
We're onboarding a small number of design partners. Clinical research organizations get the Clinical & GxP pack now; if your sector's pack is on the roadmap, a design partner is how it gets built. You get the program first, we get your audit findings and your people's honest opinion of the content. Fair trade.
Developed with a clinical research design partner · STACSTRAT LLC