Plain-English definitions of the threats and terms that show up in security-awareness training — and for each one, a game where you can actually do it. Learn the word, then beat the attack.
A fraudulent message — usually email — that impersonates a trusted brand or person to trick you into clicking a malicious link, opening malware, or handing over credentials. The lures lean on urgency, fear and authority. It's the single most common way breaches start.
▸ practice in PHISH — spot the phishA phishing attack tailored to a specific person or company using details the attacker researched (your name, role, projects, colleagues). Because it's personalized, it's far more convincing than mass phishing — and is how many targeted breaches begin.
▸ practice in PHISHalso: SMS phishing
Phishing delivered by text message — a fake delivery fee, bank alert or "your package is held" link. Phones make the destination URL harder to inspect and people trust SMS more than email, which is exactly why attackers use it.
▸ practice in PHISHalso: voice phishing
A phishing attack over a phone call — a fake "IT support", "bank fraud department" or "Microsoft" caller pressuring you to read out a code, install remote-access software, or move money. Voice can now be cloned, so urgency on a call is a red flag.
▸ practice in SOCIAL — spot the conA scam where an attacker impersonates an executive or vendor to trick an employee into wiring money, buying gift cards, or changing payment details. There's often no malware at all — just a convincing email and social pressure. BEC causes some of the largest financial losses in security.
▸ practice in PHISHInventing a believable scenario (the "pretext") to extract information or access — for example posing as a new hire, an auditor, or IT support to get someone to reveal details or let them in. It's the setup behind most social-engineering attacks.
▸ practice in SOCIALRequiring more than just a password to sign in — typically something you have (a phone, security key) in addition to something you know. MFA stops most credential-theft attacks, which is why attackers now try to trick you into approving or sharing the second factor.
▸ see MFA attacks in PHISHAn attack where someone who already has your password spams you with MFA approval prompts, hoping you'll tap "approve" out of annoyance or confusion. If you didn't start a login, deny it and report it — never approve a prompt you didn't trigger.
▸ spot it in PHISHAttackers take username/password pairs leaked from one breach and try them automatically across many other sites, betting that people reuse passwords. It's why a leak at one service threatens all the accounts where you reused that password — and why unique passwords + MFA matter.
▸ see how weak hashes fall in HASHAn attack that slips database commands into an input field (like a login box) that the application fails to sanitize, letting an attacker read, change or bypass data — including logging in without a password. A decades-old bug that still breaches real systems.
▸ exploit it safely in INJECTA web flaw where an attacker gets their own JavaScript to run in someone else's browser on a trusted site — stealing sessions, keystrokes or data. It happens when a site reflects user input back onto the page without escaping it.
▸ craft a payload in XSSAn attack on AI/LLM systems where hidden or malicious instructions in the input override what the AI was told to do — leaking data, ignoring guardrails or taking unintended actions. The modern equivalent of injection attacks, aimed at AI features.
▸ spot it in PROMPTMalware that encrypts an organization's files and demands payment for the key, often after stealing data to extort a second time. It usually gets in through phishing, exposed remote access (RDP), or unpatched systems — the same human and config weak spots awareness training targets.
▸ work the alert queue in TRIAGEThe principle of giving every user, service and system only the access it actually needs — and no more. It limits the blast radius when an account or key is compromised. Most cloud breaches trace back to over-broad permissions.
▸ apply it in CLOUDA security hole created by a setting, not an exploit — a public storage bucket, a database open to the internet, a firewall rule that allows everything. Misconfigurations cause a large share of cloud breaches precisely because they're easy to make and easy to miss.
▸ find them in CLOUDThe 12–24 words that control a cryptocurrency wallet. Anyone who has them owns the funds — so no legitimate service ever needs them. "Validate your wallet, enter your seed phrase" is always a scam.
▸ dodge wallet scams in CHAINA security model that assumes no user or device is trusted by default — every request is verified, regardless of whether it's "inside" the network. It replaces the old "castle and moat" idea, where anything inside the perimeter was trusted.
▸ see least-privilege in CLOUD
Social engineering
Manipulating people — rather than hacking systems — to get access, information or money. It covers phishing, pretexting, tailgating, baiting and vishing. The target is human trust, which no firewall protects.
▸ practice in SOCIAL