Book a Demo
Demo Centre



  • Gap Analysis
  • uLearn
  • Reporting
  • Cyber Essentials
  • Security Awareness
  • Support


Knowledge Base


  • Glossary
  • IoT
  • Ransomware
  • ISO 27001
  • GDPR


In practice, your staff will be left to their own devices; any leaks or mistakes will be exploited. usecure aims to make phishing, ransomware and other kinds of deception easy to spot, leaving capable power in their hands. We provide ISO 27001 (best-practice industry certification) modules that solely deal with the perils of human error.

They are too many to mention in sufficient detail here – we suggest you check out the NCSC’s (National Cyber Security Centre) website for an informative breakdown.

The scheme focuses on five main procedures: boundary firewalls, configuration tactics, access control, path management and avoiding malware. Together, these subjects form the bedrock of any comprehensive security awareness training.

usecure is CE certified, although we don’t provide accreditation. We have several trusted partners who can carry out the assessment, and we’re more than happy to introduce you to them.

One facet of ISO 27001 in particular (clause 7.2.2) is relevant to user awareness culture, as it focuses on the employee-led, behavioural competencies they need to exhibit. Our gap analysis is informed by these very principles, adhering to the textbook guidelines.

We recommend conducting a gap analysis before and after your cyber security training. Give them 30 days to put their wisdom into practice. Then, conduct a second test, to assess what’s improved or what needs refining. This can continue for as long as you want, on a monthly basis, until your happy with the analysis’ findings.

There are several: it may include a malicious virus infecting your system, seizure of company records, or lost account privileges. All of them aren’t worth risking in today’s hyper-connected world.

An employee’s knowledge will be matched against the 12 distinct competencies we’ve structured. These will determine how well they understand security methods, and where patterns emerge across your departments.

GDPR stands for General Data Protection Regulation. It is a new piece of EU legislation that comes into force in 2018 and covers how EU citizen’s data is managed and protected.

The ‘right to be forgotten’ is the right that individuals have to request that the data controller erase/forget their personal data without undue delay where it is no longer necessary for the purposes collected. The individual also has the ‘right to be forgotten’ when they withdraw their consent or object to the data processing.

Any organisation that uses or processes an EU citizen’s data is covered by the legislation and therefore needs to know about it. However, the GDPR predominantly focuses on ‘data controllers’ and ‘data processors.’

All employees within an organisation play a part in ensuring compliance with the new regulation. If an organisation is found to have breached the new law, the financial consequences can be serious. This can also lead to a loss in consumer confidence in the brand.

The process of taking an unencrypted message (plaintext), applying a mathematical function to it (encryption algorithm with a key) and producing an encrypted message (ciphertext).

An area of systems management that involves acquiring, testing and installing multiple patches (code changes) to an administered computer system in order to maintain up-to-date software and often to address security risk.

Anyone, practically, who’s part of your operations, and deals with a single part of your IoT blueprint. Employees who connect to your network through their personal devices can pose a particular threat. One loose end is enough to threaten your protocols.

No, an IoT-enabled device has many digital access points, some of which even the latest firewalls can’t protect against.

Our training resources can simulate a phishing attack, or a malware threat, to give them a real-world sense of aptitude. The software oversees how they do, and you’ll be provided with a comprehensive report.

The Internet of Things, in layman’s terms, is the complete interconnectivity of anything with the means to go online. This takes in smart devices such as cars, phones and home automation units, alongside machine components that transmit data (for instance, an industrial drill head, or an emissions monitor in an engine).

Yes – a revision was made in 2013 to account for complex ISMS, along with the risks associated with security outsourcing.

Broadly speaking, it stands for the management policies and activity that preserve your data, communications, and digital functionality. Everything to do with it – that is, your computer systems and smart devices – must work to avoid a security breach.

The first version of these guidelines was released in 2005 by two global standard agencies, the ISO and IEC, in the aim to create a universal standard for IT systems and cyber security.

An IMS won’t be stable unless it is controlled with the utmost care and diligence. Practically, this falls on the human element of your organisation; if the people managing your safeguards don’t know what to look for, the whole system is vulnerable.

No – as we mentioned, these scams are very clever, and play off our responses to official-looking logos, guarantees and professional language.

This will depend on your organisation and budget. We have three packages – start up, professional and enterprise – each of which include an assigned account manager, independent reports and simulations as standard. usecure will consult with you to ascertain the level of service you need.

Whatever the tone of the message, it’ll request special information, purporting to use it for the benefit of the company or individual. This could take the form of a ‘security check’, ‘authentication procedure’ or ‘wrongly made payment’.

A managed service not only saves you time and resources; it also ensures that you benefit from experts in social engineering and the latest attack vectors, so that you can achieve ‘real-world’ results from your campaign.

A phishing email is carefully designed to look and feel like communications from a trustworthy source, such as a bank, retailer or HMRC. The email will encourage you to take action, either to follow a link or download a file, leaving you at the mercy of the hacker.

Absolutely, it’s a form of identity theft and therefore taken very seriously in the eyes of the law. The problem is that hackers can be difficult to trace, meaning prevention is much easier than cure.

No: in fact, other forms of phishing are on the rise. Vishing (voice phishing, via phone), smishing (phishing via SMS), search engine and social media phishing all work on the same premise – to fool you into surrendering sensitive information.

Spear phishing is a targeted attack, based on intelligence gained by a hacker on an individual. This allows for much more effective social engineering – an attempt to manipulate or deceive you to gain sensitive information.

This depends on the value of the files, the state of your backups and disaster recovery plan, and whether any other stakeholders (such as clients) will be affected. However, with the right cyber security training, you shouldn’t ever reach this point.

There are three main types of ransomware attacks: scareware, screen lockers and encryption. The first is designed to trick users into taking action; the second locks a user’s display until they pay a ransom, while the third codes a user’s files so they cannot be accessed.

Ransomware as a Service (RaaS) is where aspiring hackers with low technical skills can purchase toolkits, giving them everything they need to target an organisation with a ransomware attack. It’s a major drive behind the rise in this type of cybercrime.

Ransomware is a type of malicious software, designed to operate covertly on a user’s  device. Once the hacker has gained enough information, they will hold it hostage until a sum of money has been paid.

You certainly can – it’s one of the main filtering options we present, again backed with comparative data across sub-teams if applicable.

You can see the specific scores for each user, how many modules they’ve covered, as well as how they compare against their team.

Anyone with management responsibilities can oversee your security reports. This might be a senior IT figure, an HR manager, anyone in a compliance-based role or a company’s Managing Director, to name a few.

Creating a security culture and building user awareness relies, in part, on staff knowing that they’ll be graded. Carrying out regular reports will keep them focused, and rid the chance of anyone becoming complacent. Plus, the nature of the tests will change over time, as new cyber security measures are implemented.

There are two main ways in which employees can compromise your security: attacks conducted with malicious intent, and attacks facilitated by inadvertent actors. Together, these incidents make up 60% of all cyber attacks, demonstrating how serious the insider threat can be.

Information security awareness relates specifically to IT; it’s a formal programme designed to educate employees on cyber security.

ISO 270001 is the global standard for best practices when using an information security management system (ISMS). These systems are part and parcel of a company’s risk management process, covering legal, physical and technical measures to eliminate cyber threats.

Any employee that has access to company devices should undergo a security awareness programme, to ensure that they are aware of company policies and the latest IT best practices.

You may wish to have additional people access the usecure platform, doing this is easy just follow these steps:


Finding out when a user has completed a course is available in the "export course data" function from the PEOPLE section.

First selcect PEOPLE then choose which data you want using the check boxes on left of the name. This will allow you to select either an individual or group, or you can "select all" from the menu at the top.

Once you have selected which data you would like, select "EXPORT COURSE DATA" from the drop down menu.

Sometimes you may want to see who has outstanding courses to take, this is easy in the usecure plaform and can be viewed in two places.

Firstly you can go to the PARTICIPATION REPORT which will provide you with a full overview of everyone enrolled in the platform. You can access the report by selecting REPORTS on the left hand side, then selecting PARTICIPATION REPORT.

The first step to creating your Security Awareness programme in usecure is to upload your users into the console. To do this you need to navigate to the PEOPLE section on the left and side menu, then select ADD PEOPLE and you will be presented with a box to enter your users.

The dashboard is the main page you will see when using usecure

It shows a high level overview of the your ulearn scores in the chart at the top, and you can use the menu buttons to select what data you would like to drill down into, a particular group perhaps or timeframe.

The auto subscribe option allows you to start your Security Awareness Programme. All you need to do is select the checkbox, determine how often you would like your users to recieve their modules, and click "save", usecure will do the rest.

Users must answer a series of multiple choice questions at the end of each module. They are randomised, offering no chance of pre-emptively guessing the test if someone has to take it again, or if their colleagues do it first.

Not officially, but learning material has been shaped to cover parts of the government’s Cyber Essentials mandate and the 7.2.2. clause of ISO 27001, which centres on user awareness.

They can strengthen your aims for accreditation; we are happy to introduce you to organisations that can further your cyber security awareness programme.

There are three levels of ulearn – Beginner, Intermediate and Compliance. Each of our 12 modules scale up in this manner.uLearn is designed to cover a 2 year programme of Security awareness.

ulearn doesn’t exhaust its participants; learners can choose a suitable schedule, and there’s never too much content to overwhelm them at one time.

An adversary that possesses sophisticated levels of expertise and significant resources which allow it to create opportunities to achieve its objectives using multiple attack vectors.

Code that is often installed by malware that inserts itself into programs or operating systems to provide unauthorized access to data.

A program used for specific functions such as; keeping ports open or launching a flood of packets during a DDoS attack.

A set of Bots installed onto a computer for use of creating DDoS attacks and sending SPAM.

The person in charge of information security within the enterprise.

Adherence to, and the ability to demonstrate adherence to, mandated requirements defined by laws and regulations, as well as voluntary requirements resulting from contractual obligations and internal policies.

Abbreviation of criminal hacking.

Modifying data for your own expense i.e. changing grades, credit rates etc.

When an unauthorized transmission is allowing data to leave the system. This can be using a removal disk, printout, photographs of the screen etc.

An attempt to make a machine or network resource unavailable. Usually involves spoofing packets or email headers.

A type of DoS attack where multiple compromised systems, for example a Botnet, are used to target a single system causing a DoS attack.

A system for naming individual computers and network services that is organized into a hierarchy of domains. It is commonly used by the internet to locate computers through friendly names.

Undocumented, unauthorized program functions in a production program.

A piece of information, in a digitized form, used by an encryption algorithm to convert the plaintext to the ciphertext.

A method for exploiting a vulnerability to take control of a system or compromise it.

Put some clear and concise content in here. Keep your reader in mind. What are they trying to do? What are they hoping to learn? Why are they reading this? Help them out and use the tone and voice of your organization.

Gaining unauthorized access to data in a system or computer.

Politically or ideologically-motivated vandalism e.g. defacing a website with reason.

Creating a false identity with someone else’s identity information like; name, national insurance number etc.

Pretending to be someone or something you are not.

The operational component of incident management

The responsibility of executives and the board of directors; consists of the leadership, organizational structures and processes that ensure that the enterprise’s IT sustains and extends the enterprise's strategies and objectives.

The time between the stimulation and the response. The period where a logic bomb, virus or worm refrains damage (delivering the payload). Long latency can result in severe consequences for infected systems.

Communication network that serves several users within a specified geographic area.

A form of virus. A program in which damage (the payload) is delivered when a particular condition occurs.

Sending large numbers of unwanted emails to a single recipient or to a group of recipients, this is not SPAM it is a form of DoS.

Abbreviation of Malicious software, categorizes dangerous software like; Ransomware, Trojan horses, viruses, worms, rootkits etc.

In a DDoS attack, a program that communicates with implanted zombie programs on compromised computers. The master program usually transmits instructions to zombies with details of the targeted system.

Develops tests, test methods, reference data, proof-of concept implementations, and technical analyses to advance the development and productive use of information technology.

Fixes to software programming errors and vulnerabilities. Patch management is an area of systems management that involves acquiring, testing and installing multiple patches (code changes) to an administered computer system in order to maintain up-to-date software and often to address security risk.

The activities that malware perform on an infected computer.

Unauthorized access to restricted systems.

The fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.

Getting access to secure locations by following an authorized person through the grid.

After vulnerabilities are identified and assessed, appropriate remediation can take place to mitigate or eliminate the vulnerability.

Any type of storage device that can be removed from the system while is running.

A script used to gain unauthorized root privileges on compromised systems.

Technique of accumulating round-off errors and saving them up for a later withdrawal.

Using discarded listings, tapes or other storage media to find useful information like access codes, credentials and any other sensitive data.

A protocol that is used to transmit private documents through the Internet.

The process by which data traversing a network are captured or monitored.

An attack based on deceiving users or administrators at the target site into revealing confidential or sensitive information.

An attack where social engineering techniques are used to masquerade as a trusted party to obtain important information such as passwords from the victim.

Faking the sending address of a transmission in order to gain illegal entry into a secure system.

Software whose purpose is to monitor a computer user’s actions (e.g., web sites visited) and report these actions to a third party, without the informed consent of that machine’s owner or legitimate user.

Results from failure of the application to appropriately validate input. When specially crafted user-controlled input consisting of SQL syntax is used without proper validation as part of SQL queries, it is possible to glean information from the database in ways not envisaged during application design. 

Any event during which a threat element/actor acts against an asset in a manner that has the potential to directly result in harm.

The path or route used by the adversary to gain access to the target.

A malicious program that waits for a specific time before activating its payloads. Time bomb is a form of logic bomb found in Trojan horses.

In reference to the Greek myth, a Trojan Horse is an innocent looking program that can alter data, record passwords, send confidential data, open back doors and much more.

The use of two independent mechanisms for authentication, (e.g., requiring a smart card and a password) typically the combination of something you know, are or have.

A secure private network that uses the public telecommunications infrastructure to transmit data.

An automated process to proactively identify security weaknesses in a network or individual system.

A class of systems used to secure wireless (Wi-Fi) computer networks.

Wireless security protocol that supports 802.11i encryption standards to provide greater security. This protocol uses Advanced Encryption Standards (AES) and Temporal Key Integrity Protocol (TKIP) for stronger encryption.

A scheme that is part of the IEEE 802.11 wireless networking standard to secure IEEE 802.11 wireless networks (also known as Wi-Fi networks).

Using unauthorized equipment or software to eavesdrop on data or voice transmissions e.g. installing Keystrokes onto a computer to find what a person is typing.

A vulnerability that is exploited before the software creator/vendor is even aware of it's existence.

A program that waits in victims computers for instructions, commonly used to cause DDoS attacks.

Put some clear and concise content in here. Keep your reader in mind. What are they trying to do? What are they hoping to learn? Why are they reading this? Help them out and use the tone and voice of your organization.