IT & cloud certifications · course 51 of 105

Cybersecurity at Work: Phishing and Passwords

Spot phishing at work, take the safe next step even after you’ve clicked, and know what NIST’s 2025 password rules really say, from length over symbols to password managers.

4 modules

Try a question

Not on sale yet. When sales open: $4.99 USD for this course, paid once, or every course for $9.99 USD a month. Prices

Runs in Claude (claude.ai, the Claude apps or Claude Code) with your own Claude account. A course opens there as soon as your payment goes through; nothing is shipped.

Preview

What it teaches

What phishing is and why spelling is no longer a safe test; the five pressure signs the UK’s National Cyber Security Centre (NCSC) tells people to look for (authority, urgency, emotion, scarcity, current events), spotted in short made-up messages; the safe next step when a message might be real or when you’ve already slipped (contact the organisation through its official details, tell IT, tell your bank, change a reused password, run an antivirus scan); and what NIST’s 2025 password rules (SP 800-63B-4) actually say: length over symbol rules, no changes on a timer, blocklists, password managers and paste allowed. The AI asks 3 questions, places you, shows a short card per module, then gives you one item at a time.

How long

36 items. About 30-50 rounds plus a 12-item final: 1-2 sessions (estimate, not timed with a real student). The tutor gives a one-line save code at the end of each session.

The modules

4 modules, drilled one item at a time.

M0
The words
The words: phishing, multi-factor authentication, one password per account
M1
Spot the pressure sign
Name the pressure sign in a short made-up message
M2
Pick the safe next step
Pick the safe next step (four options)
M3
NIST’s password rules
Is this password rule NIST’s? Yes or No, and why

Before it teaches, it asks

1
Why are you here (work training, a scare, a new job in IT), and have you ever clicked something you shouldn’t have?
2
A text that looks like it’s from your bank says there’s a problem with your account and gives a number to call. You think it might be real. What do you do?
A) Call the number in the text to check.
B) Reply to the text and ask if it’s genuine.
C) Contact the bank using the details on its official website or on a paper statement.
D) Ignore it and never contact the bank about it.
3
A sign-up page says: “Password must contain an uppercase letter, a number and a symbol.” Does NIST SP 800-63B-4 allow a login system to set that rule? Say why.

What’s exact, and what isn’t

Show

Straight from the course’s own notes.

Quoted, not written: Every M2 key and every M3 rule rests on a sentence from the NCSC’s phishing guidance or NIST SP 800-63B-4, quoted word for word in the item; 44 quotes matched on the live pages 2026-10-11.
Made up for practice: Every message line and situation. Each M1 line was written around one of the NCSC’s five signs, and four also fit a second sign, which counts too (the NCSC says scams often show more than one); which sign a line leans on most is the builder’s judgment, not the NCSC’s.
Whose rules: NIST SP 800-63B-4 is written for login systems of US government services. The course drills what it says; it doesn’t claim any other site or employer must follow it.
Honest limits: Short made-up lines, not full emails; text only (no screenshots, sender addresses or links to inspect). The NCSC’s guidance is British: its reporting addresses and phone numbers are left out.
Not in it yet: Reading a full email (sender address, link targets), passkeys, software updates, Wi-Fi, backups, ransomware, choosing a password manager.