Huntress Security Awareness
Training Episodes

Janel's groundbreaking invention could change the world, but Quincy's open-source research skills and big ambitions. Hackers, like Quincy, can use public sources to gather personal or sensitive details about people or organizations. Will Quincy find any information to change Janel’s future?

Learning Objectives:

• Define and describe what OSINT is
• Identify how Spear Phishing works
• Show methods of defending against Spear Phishing
• Provide steps to reduce OSINT exposure

Tina, Joshhh's new intern, thinks she can use a chatbot to help her become the best assistant ever. Tina may learn the hard way that artificial intelligence (AI) systems can provide false, misleading, or entirely fabricated information—even if the data that went into the system was accurate. With the creation of Joshhh's new album on the line, will Tina save the day or will her contributions hit a sour note with Joshhh and team?

Learn the rules of HIPAA (Health Insurance Portability and Accountability Act), which is a set of national standards that healthcare organizations must have in place to safeguard the privacy and security of protected health information (PHI). As employees of a healthcare organization or business associate, there is a legal responsibility to protect patient PHI.

Following the completion of this episode, learners should be able to:

• Describe the purpose of HIPAA
• Define Protected Health Information (PHI)
• Summarize Administrative, Technical, and Physical safeguards
• Understand the difference between unintentional and intentional disclosure
• Explain the Privacy Rules and consequences of a breach

‍

Ricky the Rocket, a former basketball star running a sports memorabilia shop, faces a security breach after poor password storage puts his business at risk. When a hacker targets Ricky’s credentials to steal a prized item, it highlights the importance of secure password practices. Modern password managers offer encrypted storage for passwords, along with the added security of Multi-factor Authentication (MFA). Can Ricky protect his championship ball from theft?

Following the completion of this episode, learners should be able to:

• Demonstrate best practices for storing passwords
• Show the dangers of insecure password storage
• Explore the benefits of a password manager, including Multi-factor Authentication (MFA)
• Recognize the risks involved with opening unsolicited email attachments

‍

At Major’s Fried Chicken, an employee accidentally inputs the secret recipe into a chatbot. Generative AI can create text based on vast data, but it’s not secure for confidential information. Sensitive details shared with AI could be exposed, risking valuable secrets. Can Major’s Fried Chicken keep its recipe safe from AI exposure?

Following the completion of this episode, learners should be able to:

• Demonstrate the importance of keeping trade secrets confidential
• Recognize the risks associated with using consumer chatbots
• Understand the importance of following generative AI policies

‍

At Luckee’s Toyland, Sarah “Bot-Head” plots a Business Email Compromise (BEC) attack to scam a toy supplier into transferring funds for a rare toy. BEC attacks involve hackers hijacking corporate email accounts to trick employees or vendors into fraudulent transactions. These attacks can go undetected, costing businesses billions. Can you spot the warning signs and prevent a BEC attack in your organization? 

Following the completion of this episode, learners should be able to:

• Explain Business Email Compromise (BEC) attacks and discuss how they could happen
• Show the common characteristics of a BEC attack
• Demonstrate correct procedures to prevent BEC attacks and ways to report suspected threats

‍

Gwen, updating her mother’s donut shop website, falls for malvertising—fake ads that appear legitimate but lead to harmful sites. As malvertising becomes more common, hackers use it to gain remote access to computers and steal sensitive data. Will Gwen spot the threat before it compromises the shop’s security?

Following the completion of this episode, learners should be able to:

• Recognize the risks of fake online advertisements and search results.
• Demonstrate ways to lower risk when online.
• Identify the dangers associated with remote control software.

‍

Ali works at Triassic Park Jr., where a hacker group, the All Seeing Three, uses malware to try and steal dinosaur DNA. Cybersecurity threats like malware can lead to major breaches, but quick reporting of suspicious activity can help prevent or limit damage. Will Ali and the team spot the threat in time to stop the theft?

Following the completion of this episode, learners should be able to:

• Define a suspicious event
• Summarize the importance of reporting a suspicious event
• Demonstrate ways to report or seek clarification from IT
• Describe important information to report
• Recognize different methods of attack from hackers

‍

DeeDee, upset that her off-brand NFT isn't accepted by others, targets an employee at the world's largest NFT exchange to steal a valuable NFT. Using spear phishing, DeeDee crafts a targeted email to trick Aubrey into revealing sensitive account details. With phishing attacks on the rise, financial gain is a common motive, but revenge and social status can also drive attackers.

Following the completion of this episode, learners should be able to:

• Define spear phishing
• Summarize why hackers use spear phishing
• Demonstrate how to identify a targeted phishing email
• Describe the risk of entering sensitive info into suspicious websites
• Explain the risk of willingly sharing your 2FA or MFA code and/or password

‍

Radical Pharma’s brilliant engineer, Erwin, is passed over for credit on a groundbreaking product, creating the potential for an insider threat. Insider threats—whether from malicious intent or negligence—are especially dangerous due to the insider’s access to sensitive information. Understanding and preventing these threats is critical for any organization’s security. Frustrated and resentful, Erwin plans to steal the formula and sell it. Will Radical Pharma stop him in time?

Following the completion of this episode, learners should be able to:

• Define Insider Threats
• Classify the different Insider Threats and possible motivations
• Evaluate the risks of unintentional threats and preventive measures
• Identify support and security measures to report possible threats

‍

Tom’s Forest Foods is revolutionizing the cookie industry, but Dr. Cookay has other plans. Ransomware attacks are on the rise, blocking access to systems and causing major financial losses. As these threats grow, every team member plays a vital role in preventing attacks. Will Tom’s business thrive, or will Dr. Cookay get away with a ransomware attack?

Following the completion of this episode, learners should be able to:

• Define Ransomware
• Summarize ransomware motives for hackers
• Provide tips on how to avoid opening unsolicited attachments and links
• Highlight the importance of reporting suspicious activity quickly
• Identify preventative measures, like a backup and recovery strategy
• Practice mock response events

‍

Bot-Head is trying to build something special for the Curriculaville Comic-Con, but with her bank account running low, she contemplates turning to a dangerous AiTM (Adversary-in-the-Middle) attack to fund her project. In this attack, a hacker intercepts communication between two parties, pretending to be one of them, to steal sensitive information like login credentials and authentication tokens. Will Bot-Head’s shortcut lead her into serious cyber danger?

Following the completion of this episode, learners should be able to:

• Define Adversary-in-the-Middle (AiTM) attacks
• Understand the motives behind AiTM attacks
• Identify tactics used in AiTM attacks and phishing schemes
• Explore methods to defend against AiTM attacks and spoofed websites

‍

While on vacation, Imani tries to stay connected to work, but her remote setup becomes a target for Weasley, who uses shoulder surfing, rogue Wi-Fi, and unlocked devices to steal sensitive company information. As remote work becomes more common, it’s crucial to be aware of the risks involved, such as unsecured networks and unattended devices. Imani must secure her devices and work environment to prevent sensitive information from being compromised.

Following the completion of this episode, learners should be able to:

• Practice secure Wi-Fi connection habits
• Recognize the risks of leaving devices unattended
• Understand the unique security challenges of remote work

‍

On a field trip to CCB Studios, Eli discovers the consequences of leaving a device unlocked. When a programmer steps away, his unattended computer becomes an easy target for anyone looking to steal data or cause trouble. This episode highlights the importance of locking or logging out of your devices when you’re away. Unlocked devices can lead to security breaches, malware installation, and data theft, all of which can have serious consequences for both personal and organizational security.

Following the completion of this episode, learners should be able to:some text

• Explain the importance of enforcing passwords on all devices
• Recognize the risks of leaving devices unlocked and unattended
• Identify physical protections for locking and securing devices
• Learn strategies to prevent unauthorized access to devices

‍

Cannoli Brothers Construction is bidding for a massive project, Super Space City, but Weasley, the janitor, steals sensitive documents and sells them to a competitor. Protecting sensitive information isn't just about digital security—it’s about physical security too. A Clean Desk Program helps manage physical access to sensitive documents and workspaces, ensuring confidential materials aren’t left exposed. Can Cannoli Brothers prevent sensitive information from falling into the wrong hands?

Following the completion of this episode, learners should be able to:

• Summarize the purpose of a Clean Desk Program
• Recognize the need to physically protect sensitive information
• Learn techniques to secure devices and documents from theft

‍

Moo Moo’s Ice Cream is about to face a cyber attack, but not from where you'd expect. A clever 5-year-old named DeeDee uses phishing tactics to exact her revenge on the company. As DeeDee’s scheme unfolds, employees are tricked into revealing sensitive information, highlighting the dangers of phishing.

Following the completion of this episode, learners should be able to:

• Summarize phishing and its associated risks
• Identify tactics hackers use to execute phishing attacks
• Demonstrate how to spot phishing emails

‍

The General Data Protection Regulation (GDPR) is a global standard for protecting the privacy of EU citizens’ data. Learn about the key requirements and how GDPR impacts data handling practices across borders. Everyone plays a part in safeguarding this data, wherever it flows.

Following the completion of this episode, learners should be able to:

• Understand the purpose and scope of GDPR
• Identify the key stakeholders in GDPR compliance
• Apply best practices for handling EU citizen data
• Recognize the impact of data collection on GDPR compliance

‍

Learn the basic principles of the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) compliance framework dedicated to helping protect the North American power grid from cyber attacks. Learners experience a visual representation of complex regulatory standards broken down into easy-to-understand concepts across 11 episodes. Episodes include: NERC CIP Overview, Cyber Security Policies, Physical Access Controls, Electronic Access Controls, Visitor Control Program, BES Cyber System Information, Identification of Cyber Security Incidents, Recovery Plans for BES Cyber Systems, Responding to Cyber Security Incidents, CIP-013 Supply Chain Risk Management, and Interconnectivity of BCAs, Transient Cyber Assets and Removable Media.

Following the completion of this episode, learners should be able to:

• Describe the functions of the Federal Energy Regulatory Commission (FERC), North American Electric Reliability Corporation (NERC), and Regional Entities
• Understand the different roles between each regulator entity
• Demonstrate the goals of NERC Critical Infrastructure Protection (CIP) standard compliance to protect against cybersecurity threats.

‍

The SKORMS, an intergalactic species, rely on secure deliveries from Earth, but they’re frustrated when their packages go missing. When a data breach threatens their shipments, SOC 2 comes to the rescue. Learn how SOC 2 helps organizations secure sensitive data, build trust, and protect customer information by ensuring they meet industry-leading security standards.

Following the completion of this episode, learners should be able to:

• Define the purpose and importance of SOC 2 compliance
• Understand the 5 Trust Services Criteria for SOC 2
• Recognize the difference between SOC 2 Type 1 and Type 2 reports
• Identify key security controls and best practices for SOC 2 compliance

‍

Ernest is working on marketing materials for the highly anticipated Toucan Man III, when his son, Eli, accidentally discovers the script for the film. Confidential information, whether related to a movie script or sensitive business data, must be protected from unauthorized access. Exposing this information—whether intentionally or not—can lead to significant consequences. Learn why it's crucial to limit access and properly secure confidential data to prevent leaks or misuse.

Following the completion of this episode, learners should be able to:

• Apply the "Need to Know" principle for data access
• Recognize the importance of locking unattended devices
• Understand the basics of data classification programs
• Explain why protecting confidential information is essential

‍

When utility companies start receiving suspicious emails about avoiding compliance audits, Brooke knows something isn't right. She hovers over the link and uncovers a malware attack targeting systems worldwide. Malware is malicious software designed to damage, disrupt, or steal data from computer systems. Once a system is infected, it can lead to data loss, unauthorized access, or even surveillance. Can Brooke stop the malware before it spreads further? 

Following the completion of this episode, learners should be able to:

• Define malware and its purpose
• Understand how anti-malware software works
• Recognize different types of malware and how they spread
• Identify best practices for data backup and protection

‍

Philippe, the curator at Don Abbrucci Gallery, is hosting an art auction, but his decision to reuse passwords across multiple accounts puts him at risk. Reusing passwords makes it easier for hackers to gain access to personal and work accounts if one password is stolen. Watch as Philippe’s password habits lead to a hacker’s success in this cautionary tale about the dangers of password reuse.

Following the completion of this episode, learners should be able to:

• Recognize the risks of reusing passwords
• Define data dumps, data leaks, and credential stuffing
• Identify how hackers steal and exploit passwords
• Implement strategies to protect online accounts

‍

Professor Bogusat at Bryson University finds an unmarked USB drive on campus and decides to open it, unknowingly triggering a malware attack. Hackers often plant infected removable media like USB drives in public spaces to trick people into installing malware. Connecting unknown devices can lead to data loss, theft, or other malicious actions. Can Bryson University avoid the fallout from this dangerous mistake?

Following the completion of this episode, learners should be able to:some text

• Identify the risks of connecting unknown removable media
• Apply secure handling practices for removable media
• Understand best practices for managing and securing removable media

Paige loves video games, but has never given much thought to securing her online accounts. When she signs up for BopTalk without enabling multi-factor authentication (MFA), Passmaster wizard shows her a world where her accounts are vulnerable. Paige soon learns that just having a strong password isn't enough to protect her accounts. Multi-factor authentication adds an extra layer of defense by requiring more than just a password to access an account, ensuring hackers can't easily break in—even if they know your password.

Following the completion of this episode, learners should be able to:

• Explain the importance of using multi-factor authentication (MFA)
• Understand the different layers of protection for online accounts
• Identify various authentication methods
• Recognize why a strong password alone isn't enough to keep accounts secure

‍

Heather leaves her phone unattended in the yoga studio locker room, and Michelle seizes the opportunity to access her sensitive data. As Heather's day spirals into chaos, she realizes the importance of keeping her mobile devices secure. Mobile devices store a wealth of personal information, making them prime targets for hackers. Learn how to protect your devices and data from being compromised, even when you're on the go.

Following the completion of this episode, learners should be able to:

• Understand the importance of strong passcodes on mobile devices
• Identify the risks of leaving mobile devices unsecured
• Demonstrate how to properly lock and store mobile devices when unattended
• Recognize how quickly a mobile device attack can occur

‍

Matt, the founder of BopTalk, is faced with a tempting offer to sell all the user data his company has collected, putting user privacy at risk. Privacy is about protecting sensitive information and ensuring it's not shared without consent. Every online service collects and stores your data—learning how it’s handled and protected is crucial to understanding the risks. As a mysterious mentor shows him the consequences of this decision, Matt must decide whether to sacrifice privacy for profit.

Following the completion of this episode, learners should be able to:

• Describe your rights to data privacy and security
• Summarize the role and purpose of privacy policies
• Understand your responsibility to protect sensitive information
• Examine key regulations that govern privacy and data protection

‍

Frank just sealed a major deal with Roaster’s Peanut Butter, but he makes a crucial mistake on his trip back to headquarters. Kurt, an opportunistic hacker, sets up fake Wi-Fi and sends a fraudulent email to a vendor using Frank’s email. This is a Business Email Compromise (BEC) attack, where hackers use compromised email accounts to trick victims into transferring funds. Can Frank save his business from losing it all?

Following the completion of this episode, learners should be able to:

• Describe how BEC attacks occur
• Recognize common characteristics of BEC scams
• Demonstrate procedures to prevent BEC attacks
• Identify effective reporting and response techniques

‍

Billy starts his internship at Mom and Pop’s Hover Labs, but when his friends ask about his work, he unknowingly risks exposing sensitive information. Information security is about protecting data from unauthorized access or misuse. Securing this data is vital, as it holds an organization’s value and must be safeguarded to meet legal obligations. Will Billy keep the company's secrets safe?

Following the completion of this episode, learners should be able to:

• Identify different types of sensitive information
• Understand the purpose of an information protection program
• Apply the “Need to Know” principle to protect sensitive data

‍

Craig is starting his first day as an office manager at Balloon Marketing when he receives an email from his "boss" asking him to buy gift cards. Gift card scams are a growing threat, as hackers impersonate trusted sources to steal money. By using publicly available information and simple tactics, cybercriminals can trick employees into making fraudulent purchases. In this episode, Craig faces the consequences of a scam on his very first day. Can he spot the red flags before it's too late?

Following the completion of this episode, learners should be able to:some text

• Identify what gift card scams are and how they work
• Recognize why hackers target specific individuals
• Verify the authenticity of requests for gift card purchases
• Implement a reporting process for potential gift card scams

‍

Cookie Crush is the latest online gaming sensation, but a dangerous scheme is brewing behind the fun. Dr. Cookay has designed a game that secretly installs ransomware on users’ devices, locking up their files until a ransom is paid. When Adam, the IT manager, discovers the attack, he must act fast to prevent the company’s data from being held hostage. Can Adam stop the ransomware before it spreads? 

Following the completion of this episode, learners should be able to:

• Identify what ransomware is and how it impacts an organization
• Evaluate the risks and recovery options after a ransomware attack
• Implement proactive tactics to defend against ransomware

‍

A cyber attack has hit Van Saun Zoo, and it's up to Don, the night shift hero, to save the animals from disaster. With chaos unfolding, Don must find the incident response plan—if he can remember where it’s kept. Incident response is a crucial, organized approach to handling cybersecurity incidents. Knowing how to respond and report a breach is key to minimizing damage. Can Don stop the attack in time to save the zoo?

Following the completion of this episode, learners should be able to:some text

• Identify and report a cybersecurity incident
• Summarize key steps in an incident response plan
• Recognize the importance of practicing mock cybersecurity incidents
• Understand the need to regularly update the incident response plan

‍

It’s Valentine’s Day, and florist Steph is swamped with orders when she receives a text asking her to update her banking info. Without thinking, she clicks the link—leading her into a smishing scam. Smishing is a type of phishing that uses text messages to trick people into taking action. Hackers rely on our quick response to texts, making it easy to fall for their scams.

Following the completion of this episode, learners should be able to:

• Define smishing and its objectives
• Explain why you should avoid clicking links in unsolicited messages
• Identify how hackers spoof text messages
• Practice caution when responding to unexpected messages

‍

Phishing is one of the most common cyberattack methods where hackers impersonate trusted sources to steal sensitive information. By sending deceptive emails, they trick victims into clicking malicious links. Learning to recognize and defend against phishing attacks is essential for protecting yourself and your organization. With just one click, hackers can gain access to valuable data—be prepared to spot the signs and stop them.

Following the completion of this episode, learners should be able to:

• Define phishing and its goals
• Identify common methods used in phishing attacks
• Recognize different types of phishing schemes
• Spot indicators of phishing emails
• Understand the importance of reporting phishing attempts

‍

Your online accounts are prime targets for hackers. Defending against cyber threats is essential in today’s digital world. This introduction to cybersecurity covers key concepts like passwords, multi-factor authentication, phishing, and more, empowering you to protect your personal and professional accounts. Learn how cybersecurity is a shared responsibility— not only for you but also for your family and co-workers.

Following the completion of this episode, learners should be able to:

• Apply basic cybersecurity best practices
• Recognize common threats like phishing and social engineering
• Use “Cyber Sense” to detect and respond to threats
• Understand the importance of asking for expert help when needed

‍

Peter is transported to the digital world, where the wise PassMaster teaches him how to create a strong password to stop hackers. After encountering a brute force attack, Peter learns that weak passwords leave online accounts vulnerable. Strong passwords are essential for protecting accounts from cyberattacks and should be complex, unpredictable, and resistant to common hacking methods. Can Peter defend his accounts from the Brute Force monster?

Following the completion of this episode, learners should be able to:

• Recognize the risks of weak online account protection
• Apply the 3 key concepts for creating strong passwords
• Demonstrate how to create a secure, strong password

‍

Password managers are essential tools for securely storing and managing your passwords. They help protect your online accounts by encrypting passwords in a virtual vault, making it easier to use complex passwords without the risk of reusing weak ones. Encryption scrambles data to keep it safe, even if stolen.

Following the completion of this episode, learners should be able to:

• Define the function of a password manager
• Explain the risks of password reuse
• Understand the role of a master password
• Recognize the importance of using strong passwords

‍

Learn about PCI compliance and the Payment Card Industry Data Security Standard (PCI-DSS), designed to protect cardholder data from breaches. With increasing data threats, businesses must follow PCI standards to ensure sensitive payment information is securely processed, stored, and transmitted.

Following the completion of this episode, learners should be able to:

• Understand the requirements of PCI-DSS
• Identify key players involved in PCI compliance
• Apply best practices for handling cardholder data
• Recognize the key reporting processes for PCI compliance

‍

Phil's tropical vacation quickly turns sour when Tom’s constant interruptions lead to chaos. While using the resort's free Wi-Fi, Phil spots Tom's sensitive information and wreaks havoc at the zoo where Tom works. Public Wi-Fi may seem convenient, but it’s also a major security risk. Free networks can expose your data to hackers, but a Virtual Private Network (VPN) can protect your information by encrypting your connection. Will Phil’s vacation become a disaster, or will he learn the value of securing his internet use?

Following the completion of this episode, learners should be able to:some text

• Identify the risks of connecting to public Wi-Fi networks
• Create a secure strategy for working remotely
• Demonstrate the benefits of using VPN technology
• Understand privacy risks associated with wireless internet connections

‍

Weasley targets Gigantic Mutual Bank, but to pull off his heist, he needs to outsmart the physical security. Physical security safeguards people, property, and information from harm or theft. While these breaches don’t require advanced tech skills, they can still lead to serious threats, including theft or sabotage. Can Weasley break in, or will the bank’s security stop him?

Following the completion of this episode, learners should be able to:

• Evaluate risks to physically secure areas
• Recognize tactics hackers use to access secure areas
• Understand their role in protecting secure spaces

‍

DeeDee will do anything to meet her idol, Joshhh, even if it means pretending to be a journalist to contact his PR team. Social media makes it easy to connect with people, but it also opens the door for hackers to manipulate personal information for targeted attacks. In this episode, DeeDee learns how easily hackers can impersonate others and exploit publicly available details. Your social media activity could be a goldmine for attackers—what you post can be used against you.

Following the completion of this episode, learners should be able to:

• Evaluate the risks of sharing personal information on social media
• Recognize disinformation and misinformation tactics
• Understand the importance of verifying sources before trusting online information
• Practice best practices for redacting sensitive data online

‍

DeeDee is determined to see Joshhh in concert, but with tickets sold out, she takes matters into her own hands. Using manipulation and deceit, she’s able to select and manipulate her target to gain access to sensitive information. Social engineering exploits human emotions and behaviors to steal valuable data, and it’s one of the most common and dangerous threats in cybersecurity. Can DeeDee’s tactics succeed, or will she fall victim to her own manipulation?

Following the completion of this episode, learners should be able to:

• Identify different types of social engineering threats
• Explore real-world examples of social engineering tactics
• Demonstrate strategies to defend against social engineering attacks

‍

Kristin is ready for another round of browser security training, but this time, she’s in for an eye-opening experience. Using Noah's high-tech Browser Simulator, she explores the dangers of the Internet—where malicious links and websites lurk. Secure browsing is critical in today’s digital world, and knowing how to spot threats can be the key to staying safe online. Can Kristin avoid the hidden dangers of the web?

Following the completion of this episode, learners should be able to:some text

• Recognize the risks of browsing the Internet
• Identify signs of malicious websites and online threats
• Demonstrate secure browsing practices to stay safe online

‍