u/anthonyDavidson31

Our clients regularly ask us to recommend an MSP for the broader cybersecurity work that falls outside our scope. We focus solely on security awareness training, so rather than turn those requests away, we'd like to send them to someone we know.

The exchange between MSPs also might work. Maybe client is in the timezone that is not working for you or requesting services you can't provide.

Would you like to be a part of a community for the client referral exchange? Also, what may be the downsides of such an initiative?

Saw a brilliant comment recently that I can't stop thinking about:

>Focusing on the "tells" in a phishing email was always doomed... "Count the fingers" only worked until the AI models caught up. The point isn't to make your employees into deepfake detectors, it's to train them to know when something doesn't feel right and to trust their instincts, question it, and follow your response procedure.

Want to implement something like this in my company, but not sure how that should work in practice. Any suggestions?

Allowing employees to breach security protocols once in a controlled environment and issue a warning so that they would never do that again seems like a complex training procedure.

Saw a brilliant comment recently that I can't stop thinking about:

>Focusing on the "tells" in a phishing email was always doomed... "Count the fingers" only worked until the AI models caught up. The point isn't to make your employees into deepfake detectors, it's to train them to know when something doesn't feel right and to trust their instincts, question it, and follow your response procedure.

Want to implement something like this in my company, but not sure how that should work in practice. Any suggestions?

Allowing employees to breach security protocols once in a controlled environment and issue a warning so that they would never do that again seems like a complex training procedure.

Hey r/opensource

I'm a cybersec engineer with an L&D background. Got tired of boring security awareness courses and teamed up with a builder tool to deliver a free interactive SAT for AI era.

AI agents, LLMs, and autonomous tools are being adopted faster than the security practices meant to govern them. While threats like phishing are well-understood, the AI wave has introduced attack vectors that most people have never encountered -- prompt injection, RAG exploitation, and more. The problem isn't awareness alone. Most security training is passive: slide decks and videos that people click through and forget.

This library takes a different approach. Every exercise drops you into an interactive 3D office environment where you face realistic scenarios in first-person. You interact with real objects -- a phone, a PC running a live OS (browser, terminal, Zoom), a flipchart -- and make decisions under pressure, just like you would at your desk.

Free to use personally, professionally, or in commercial workshops. The only restriction is reselling or redistributing the content as a standalone product. So if you're running an in-person training -- this library can be a great addition to your learning materials. Sharing the materials free of charge is encouraged!

What's included:

Scenarios include things like:

• Identifying hidden prompt injection instructions in uploaded documents
• Spotting sensitive data categories that should never enter AI prompts
• Evaluating third-party AI plugins for supply chain risks before deployment And more!

...and more!

Two ways to use it:

Web view -- run exercises directly in a browser, ideal for workshops or sharing with students and colleagues.

GitHub repo -- every exercise is packaged as a SCORM .zip, ready to import into any LMS, embed into an existing training pipeline, or test on SCORM Cloud before rollout. Note: SCORM files make API calls to the server for pre-rendered scene files and iframes. If that's a blocker for you or you need a security assessment -- create an issue

The repo root contains full course packages. Other .zip files in the "Individual exercises" folder contain standalone exercises if you want to build a custom curriculum.

https://github.com/ransomleak/training-owasp

Happy to answer questions or take your thoughts on the exercises!

P.S: will appreciate your stars 😄