TryBench
Digital Safety Training for Everyday Work
Spot phishing, protect accounts, handle suspicious logs and respond to incidents the way a security team does.
17 short lessons. Staff, students and new IT or security team members. Each lesson takes about two minutes: read the idea, try it yourself, and get instant checks.
Start here: foundation lessons (7)
No experience needed. These lessons build the basics step by step.
- Why Attackers Target AccountsUnderstand the CIA triad and why attackers seek credentials to siphon money and corporate data.
- Passphrases & Multi-Factor ArmorReplace weak passwords with long passphrases and upgrade from SMS OTPs to authenticator apps.
- Phishing Email Red Flags: How to Spot a FakeIdentify manipulative urgency, spoofed headers, and fake penalties in phishing communications.
- Inspecting Links & DomainsSeparate deceptive display text from actual web addresses and understand padlock limitations.
- Rapid Incident ReportingTake immediate action when a security mistake occurs: isolate credentials and report without delay.
- Updates, Backups & Device SafetyKeep devices patched, backed up, and protected so one mistake or theft does not become a disaster.
- Public Wi-Fi, Scam Calls & QR CodesStay safe outside the inbox: open networks, phone scams, and tampered QR codes.
Go further: practitioner lessons (10)
Real workplace tasks that build on the foundation.
- Disarming Suspicious Links & IOCsDefang dangerous links and IP addresses so they cannot be accidentally clicked, and structure findings into JSON.
- Local Redaction & Data PrivacyScrub personal data locally first, and use AI redaction pipelines only with synthetic or pre-cleared text.
- Spotting Fake EmailsDetect sender mismatches, artificial urgency, and scam links with AI triage.
- MFA Fatigue Attack: How to Stop Push BombingRecognize push bombing, advise users to deny prompts, alert IT to revoke sessions, and implement number matching.
- Enforcing Least PrivilegeAudit staff permissions in a markdown table and downgrade excessive admin rights.
- Spotting Unauthorized Bulk ExportsRead multi-line server logs to isolate off-hours mass customer data downloads and data exfiltration.
- Fake Invoice Scam: Spot Business Email CompromiseSpot typosquatted vendor domains, enforce out-of-band phone verification, and layer email security controls.
- Shadow-AI Governance & Secret LeaksEnforce approved workplace AI tools, classify data, sanitize configs, and rotate credentials if leaked.
- Ransomware First Steps: Isolate the ComputerExecute CISA-aligned ransomware containment: isolate network interfaces immediately and escalate to incident response.
- Writing an Incident Escalation BriefCombine defanged indicators, redacted user secrets, and containment status into a shift handover brief.
Earn a certificate
Finish the lessons and claim a certificate with a unique ID that anyone can verify online. Share it on LinkedIn or add it to your CV.