Course: cybersecurity

Cybersecurity course: everyday security for staff and small teams

This cybersecurity course teaches everyone at work to recognise phishing and AI-powered scams, secure their accounts with passkeys and multi-factor authentication, share files without leaking data and know what to do in the first hour of an incident. It works as cybersecurity awareness training for small and mid-size teams, with practical tasks instead of slides, and it includes securing the AI tools and agents people now use.

For you or your whole team

Start with a useful first step.

7-day free trial. No credit card needed.

You will continue on the Tosheo.ai app to create your account and review the trial terms.

What you will learn

The modules in this course.

Phishing spotting and reporting

Checking a message is genuine and reporting it correctly.

Deepfake scam defence

Confirming urgent requests through a separate, known channel.

Strong sign-in

Passkeys where available, 2-step verification and a password manager elsewhere.

Safe sharing

Cloud and file permissions that give access only to the right people.

Incident first steps

What to do and whom to tell in the first hour.

AI tool security

Data rules for AI tools and awareness of prompt injection.

Example task / fictional source material

Capstone: a personal and team security check

Review your own work set-up against a checklist: sign-in on your three most important accounts, device updates, backups and sharing on files you own. Then write a one-page security habit for your team, covering scam reporting, AI tool rules and incident contacts. Record settings, never passwords.

Review criterion

Accounts secured

Each important account uses a passkey or 2-step verification, with any exception explained.

Review criterion

Sharing fixed

At least one over-shared file or folder is found and corrected, or you show none exist.

Review criterion

Incident ready

The habit names who to contact, how, and the first steps if something goes wrong.

Review criterion

Usable by colleagues

The team habit is short, plain and realistic to repeat every month.

Copy and adapt

Prompts to try

Replace the parts in square brackets with your own details, and check every output before you use it.

Check a suspicious message

Here is a suspicious message with names, numbers and links removed: [message]. List the warning signs, say what a genuine version would look like, and tell me how to verify it without using any contact details in the message.

Draft a team security habit

Draft a one-page monthly security check for a [team size] team using [main tools]. Include scam reporting, sign-in checks, file sharing reviews and AI tool rules, in plain English.

Every lesson

12 lessons you can start today.

Your diagnostic picks the order and skips what you already know. Start any lesson with a 7-day free trial, no credit card needed.

Security foundations for everyoneExplain the main threats to a small business
FoundationStart this lesson
Phishing and social engineeringSpot and report a phishing attempt
FoundationRead the free lesson Start this lesson
AI-powered scams and deepfakesRecognise voice, video and message scams made with AI
FoundationStart this lesson
Passwords, passkeys and MFASet up strong sign-in on your work accounts
FoundationStart this lesson
Protecting data at workClassify data and share it safely
FoundationStart this lesson
Safe use of AI toolsApply data rules and approved-tool policies
FoundationStart this lesson
Devices and home workingSecure your laptop, phone and home network
FoundationStart this lesson
Malware and ransomwareRecognise warning signs and respond correctly
FoundationRead the free lesson Start this lesson
Cloud and file-sharing securitySet sharing permissions that do not leak data
PractitionerStart this lesson
Incident response basicsKnow what to do in the first hour of an incident
PractitionerRead the free lesson Start this lesson
Securing AI systems and agentsRecognise prompt injection and data leakage
PractitionerStart this lesson
Building a security habit in a teamRun a short monthly security check
AdvancedStart this lesson

Who is this cyber security course for, and who is it not for?

It is for everyone who uses email, shared drives and AI tools at work: office staff, managers, finance and HR teams, and the founder or office manager who has become the de facto IT contact in a small business. Team leaders use it to run security awareness training across a whole team.

It is not a certification course for security professionals and does not prepare you for professional security exams. It is not a bootcamp, a degree or a job guarantee, and it does not teach penetration testing, network engineering or how to run a security operations centre.

What will I learn in this cybersecurity awareness training?

Six modules built around the core advice in official guidance, including the UK National Cyber Security Centre's Small Business Guide and the US CISA's core steps: avoid and report phishing, use strong passwords, use multi-factor authentication and a password manager, and update software.

1. Phishing and social engineering

Spotting suspicious emails, texts, calls and adverts, checking whether a message is genuine and reporting it the way your organisation and national service ask.

2. AI-powered scams and deepfakes

Recognising cloned voices, fake video calls and polished scam messages, and using a second channel to confirm any urgent request for money or data.

3. Passwords, passkeys and MFA

The NCSC now advises using passkeys where they are available, and turning on 2-step verification on important accounts where they are not. You set both up.

4. Data, devices and cloud sharing

Classifying data, securing a laptop, phone and home network, and setting sharing permissions on cloud files that do not leak to anyone with the link.

5. Malware, ransomware and incidents

Warning signs, why offline and tested backups matter, and a first-hour checklist: disconnect, report, preserve evidence and do not pay without advice.

6. Securing AI tools and agents

What to keep out of AI tools, approved-tool rules, and how prompt injection can make an AI system act on hidden instructions in a web page or file.

Do I need technical experience for this cybersecurity course?

No. Every lesson is written for people with no IT background, and no coding is involved. You need the work accounts and devices you already use, because several tasks ask you to check real settings, such as turning on 2-step verification, without ever entering a password into a lesson.

How does the personalised path adapt to me?

The diagnostic shows you five messages, some genuine and some scams, and asks which you would act on. It also asks about your role and tools. Finance staff get more invoice fraud and payment-change scams; HR staff get fake applicant attachments; a founder gets the team habit and incident lessons early.

If you spot every scam and already use a password manager, your path moves quickly to cloud sharing, incidents and AI security.

What do I practise?

Tasks use realistic but made-up material. One example: at Alder and Finch, a fictional 12-person accountancy, the office manager receives a voice note that sounds like a partner asking for an urgent change to a supplier's bank details. You decide what to do and write the message you would send.

The rubric is visible from the start. It checks that you did not act on the request, that you confirmed it through a separate, known contact route, that you reported it to the right person, and that your message is calm and clear enough for a busy colleague.

How long does the cybersecurity course take?

Lessons take 10 to 15 minutes, so they fit between meetings. Your path length depends on your diagnostic and pace, so we do not quote hours. Managers can assign the same short lessons to a whole team and see skill progress, never raw chat logs.

What do I get at the end?

A final practical assessment with realistic scam messages, a sharing settings check and an incident scenario. Passing earns a recognised certificate. It is not an accredited qualification or a professional security certification.

How much does the cybersecurity course cost?

Security awareness training is included in every Tosheo.ai plan. One person learning alone pays USD 79 a month or USD 790 a year on the Individual plan. A Team plan is USD 189 a month or USD 1,890 a year for up to 3 members, USD 49 a month or USD 490 a year for each extra member, and volume pricing applies from 25 members. Start with a 7-day free trial, with no credit card needed.

Sources and scope

NCSC, Small Business Guide, checked 19 October 2026 ↗

NCSC, Phishing scams: report and protect, checked 19 October 2026 ↗

NCSC, Activate 2-step verification on your email, checked 19 October 2026 ↗

NCSC, Leave passwords in the past: passkeys are the future, checked 19 October 2026 ↗

CISA, four core steps to stay safe online, checked 19 October 2026 ↗

CISA, StopRansomware, checked 19 October 2026 ↗

OWASP Top 10 for LLM Applications 2025, LLM01 Prompt Injection, checked 19 October 2026 ↗

Before you decide

A few good questions.

Is this cybersecurity course a professional certification?

No. It is awareness and practical training for everyone at work, ending in a recognised certificate. It is not a professional security certification or an accredited qualification.

What is security awareness training?

Security awareness training teaches staff to recognise and avoid everyday threats, such as phishing and scams, and to follow safe habits with accounts, devices and data.

Does the course cover deepfake and AI scams?

Yes. A full module covers cloned voices, fake video calls and AI-written scam messages, and how to confirm requests through a separate channel.

Should we use passkeys instead of passwords?

The UK NCSC advises using passkeys where they are available. Where they are not, use strong passwords, ideally from a password manager, with 2-step verification.

Can a manager assign this to the whole team?

Yes. On the Team plan, managers assign lessons, see skill progress and a team report, and never see raw chat logs.

Give your team a path, not another playlist.

Explore role-specific lessons, practical tasks and the manager view.

Start free trial7-day free trial · No credit card needed

Cybersecurity course: everyday security for staff and small teams

Start with a useful first step.

The modules in this course.

Phishing spotting and reporting

Deepfake scam defence

Strong sign-in

Safe sharing

Incident first steps

AI tool security

Capstone: a personal and team security check

Accounts secured

Sharing fixed

Incident ready

Usable by colleagues

Prompts to try

Check a suspicious message

Draft a team security habit

12 lessons you can start today.

Who is this cyber security course for, and who is it not for?

What will I learn in this cybersecurity awareness training?

1. Phishing and social engineering

2. AI-powered scams and deepfakes

3. Passwords, passkeys and MFA

4. Data, devices and cloud sharing

5. Malware, ransomware and incidents

6. Securing AI tools and agents

Do I need technical experience for this cybersecurity course?

How does the personalised path adapt to me?

What do I practise?

How long does the cybersecurity course take?

What do I get at the end?

How much does the cybersecurity course cost?

Sources and scope

A few good questions.

Keep exploring.

Is ChatGPT safe for company data?

AI acceptable use policy guide

Critical thinking course for checking AI

Browse all Tosheo.ai courses

Tosheo.ai plans and prices

Give your team a path, not another playlist.