Cybersecurity Workshop Facilitation

This training prepares facilitators to lead effective cybersecurity workshops, covering key techniques to engage participants and deliver practical security awareness content.

A digital instructor presents all 14 pages. Hold “Ask” at any point and ask out loud — the answer comes from this course. No sign-up needed.

28 minFree to watchDownloads

What you’ll learn

01Facilitating a Cybersecurity Workshop: Overview and Learning OutcomesWelcome. This session is for people who run cybersecurity workshops, not just attend them. Our goal here is simple. We will look at how to facilitate sessions where the room does the thinking, and where the results outlast the day. A quick framing point. Lecture informs. Facilitation makes the room do the thinking. And the data backs that up. Forty-five percent of programs sit at SANS Stage Three, focused on behavior change, while nineteen percent are still compliance-focused. So our outcomes are engagement, retention, and measurable behavior change, not audit artifacts. We will work with three formats you can adapt: a ninety-minute session, a half-day tabletop, and a multi-week rehearsal. And we will staff four roles: lead facilitator, co-facilitator or scribe, observer-evaluator, and IT or subject matter expert support. Pick one format and one role you own before the next slide. The 2026 Threat Reality Your Workshop Must Reflect.doi.org dl.acm.org sans.org+22 min
02The 2026 Threat Reality Your Workshop Must ReflectBefore we design any scenarios, we need a shared picture of the threat your workshop must reflect. Four points matter most. First, BEC is identity-driven: seventy-nine percent of investigated incidents bypassed MFA, mostly through adversary-in-the-middle and session hijacking. So a user completing an MFA prompt is no longer proof of safety. Second, forty percent of first-quarter 2026 BEC used AI-generated content. Typos and generic greetings are gone as cues. Third, attacks are multi-channel: email, smishing, vishing, quishing, deepfake voice and video. One phishing simulation a year leaves gaps. Fourth, speed. One automated campaign reached sixty-seven thousand users across forty-two thousand organizations in under three hours. Your debrief should ask how the first report would surface in minutes, not days. And on trust: eighty-eight percent of organizations had a trust-eroding incident in the last twelve months, and sixty percent lack confidence against deepfakes. So teach structural and behavioral verification. Callback on a known number, an approval chain, an out-of-band check. Not typo spotting. For your next step, pick two of these facts and make them the learning objectives of your first scenario. Next, we look at audience analysis and scoping before you design content.microsoft.com eye.security cybertechnologyinsights.com+22 min
03Audience Analysis and Scoping before You Design ContentLet's look at who you're actually designing for. Segment by risk, not by the org chart. Staff, managers, IT, executives, and finance or accounts payable will face different lures, so treat them as separate audiences. Then pull your baseline data before you write anything. Simulation results, incident trends, help-desk themes, and audit findings tell you where the real exposure sits. Next, define success in behavior terms: report rate, time-to-report, and repeat-click reduction. Do that before content, not after. Settle constraints early, because time, room or lab, hybrid delivery, language, accessibility, and approvals will shape your design more than your ideas will. If you plan to use layoff, benefits, or payment lures in a drill, align HR, legal, privacy, and sponsors first. Those scenarios cause real friction when people are surprised. Here's your next action: write down your segments, your baseline sources, and your success metrics on one page. That page becomes your design brief. Next, we'll move into designing the learning journey and content architecture.doi.org dl.acm.org sans.org+22 min
04Designing the Learning Journey and Content ArchitectureNow let us look at how the learning journey itself is designed. Start every module with why this matters to my job. Relevance comes before content. Adults invest effort only when they see the point, so open with their tasks, not the syllabus. Then sequence deliberately. Awareness first, then comprehension, then judgment under pressure, and finally team decision. Games and hands-on practice outperform lecture-only formats for behavior change, so build in exercises, cases, and small-group discussion. A strong opener is a disorienting dilemma, for example showing that experts fall for phishing, followed by group reflection. Avoid red-flag checklists as your primary device. They test recall, not judgment. Build once, reuse often. A scenario module library with injects, question banks, assessments, and microlearning keeps your prep time down and your consistency up. Finally, map each module to ISO 27001 clause seven point three and control A six point three, and to NIST CSF two point zero PR.AT dash zero one and zero two. That mapping is what convinces sponsors and auditors. One next action. Pick a single module and rewrite its opening around a dilemma, then tag it to those controls. Building Realistic Scenarios and Defensive Drills comes next.huntress.com repository.tudelft.nl frontiersin.org+22 min
05Building Realistic Scenarios and Defensive DrillsNow let's talk about building scenarios that feel real. Start from your own truth. Your sector, your geography, the workflows where money actually moves, and the attack patterns you have observed. That is your raw material. For the AI era, write scenarios like these. A CEO invoice fraud that arrives with a forwarded thread. A payroll redirection request. A deepfake callback. QR code phishing. And MFA fatigue, where someone is flooded with login prompts until they approve one. Run every tabletop the same way. State the objectives. Set the ground rules. Deliver the injects. Set the time limit. Then debrief with a hot wash, and write an after-action report with named owners and dates. Match the format to the question. A tabletop tests judgment. A functional drill tests procedures. Use red teaming only with written authorization. And put your rules of engagement in writing. No live attacks. Whitelisted domains only. No real credentials and no production data. Keep scenarios realistic. Keep the guardrails firm. Next, we look at facilitation techniques for engagement and psychological safety.cisa.gov cisa.gov cisa.gov+22 min
06Facilitation Techniques: Engagement and Psychological SafetyLet's look at facilitation techniques that shape engagement and psychological safety. First, contract the room. State the purpose, the agenda, the no-fault framing, and the confidentiality expectation. That no-fault rule is the backbone. Scenarios test plans and systems, never individual people. Ask open questions, then wait. Generous silence gives quieter people room. Redirect the loudest voice toward the group's input. Watch for spectators, including remote attendees. Everyone has a role and everyone speaks. If someone discloses a real incident, pause. Route it out-of-band to security, reassure them, and don't interrogate. Structured prompts plus small breakouts spread airtime and reduce dominance. If schedule runs tight, shorten modules, not the contracting step. If participants are skeptical, name that openly and invite their evidence. Your next action: draft your opening contract statement and one open question per module before you facilitate. Next, we move into running the drill: pre-brief, injects, timekeeping, and hot-wash.cisa.gov cisa.gov cisa.gov+22 min
07Running the Drill: Pre-Brief, Injects, Timekeeping, and Hot-WashNow let's talk about running the drill itself. Open with a pre-brief. State the objectives, name the roles, set the rules, cover operations-safe handling of the material, and frame it as no-fault. That framing matters, because people hold back when they fear blame. During play, release one inject at a time. After each update, ask a question that forces a decision and a named owner. Your scribe captures who decided what, why, and how. Those notes feed the after-action report. Run the hot-wash immediately, while memory is fresh. Cover objectives met, strengths, gaps, and next steps. Timebox the whole session to thirty minutes. A structured hot-wash beats an open-ended debrief every time. Your next action: draft your pre-brief talking points before the session. Next, we look at handling difficult moments: conflict, blame, and real incidents.cisa.gov cisa.gov cisa.gov+22 min
08Handling Difficult Moments: Conflict, Blame, and Real IncidentsNow let's talk about difficult moments. Conflict, blame, and real incidents. First, spot the blame spiral early. The IT versus business exchange, or the line we told you not to click. Name it, then slow the room down. Reframe to the system. Separate what you observed from who did it. If a real incident surfaces, triage it out of band. Protect the reporter, and promise nothing you cannot keep. Sensitive lures such as layoffs or payment fraud need HR consent and care. Agree on co-facilitator signals and pause points, so you can step out briefly without losing the room. And document system gaps, not employee identities. This is not an audit. Your next action: agree on those pause signals with your co-facilitator before the session. That leads us into From Hot-Wash to After-Action Report and Improvement Plan.cisa.gov cisa.gov cisa.gov+22 min
09From Hot-Wash to After-Action Report and Improvement PlanNow let's turn the hot wash into a product. The after-action report is the deliverable, not an appendix. A short summary, analysis, findings, and the improvement plan. Write each finding as observation, analysis, recommendation. Never as a judgment about a person. Every corrective action needs a finding reference, the action, a named owner, a due date, and a verification method. Name a person, not a team. Keep it short. Ten pages that get read beat forty that get filed. Break large work into milestones. Then re-test the weakest capability with a new scenario, and compare ratings. And set your T L P classification and distribution up front. Have the sponsor sign off on owners and dates. That sign-off is what gives the plan authority. Next, we'll look at measuring learning and behavior change that sponsors believe.cisa.gov cisa.gov cisa.gov+21 min
10Measuring Learning and Behavior Change That Sponsors BelieveNext, how to measure learning and behavior change in ways sponsors will actually believe. Anchor every metric to the Kirkpatrick levels: reaction, learning, behavior, and results. Then state, out loud, which level each metric proves. Report rate sits at behavior. Quiz scores sit at learning. Don't blur them. On the numbers: reporting rises with training. Employees trained in the past thirty days report about twenty one percent of simulations, versus five percent for untrained users, per the Verizon Data Breach Investigations Report. Before you compare anything, normalize clicks by difficulty tier, using the NIST Phish Scale, and by program maturity. A hard scenario and an easy one are not the same measurement. Then go beyond click rate. Report report rate, median and ninetieth percentile time to report, and the quality of real-threat reporting. Aggregate and anonymize everything. No league tables. No punishment tied to simulation results, because that teaches people to hide. So before your next sponsor review, take one dashboard and label every metric with its Kirkpatrick level. That closes this measurement section. Next, we move into tooling, hybrid logistics, and accessibility.sans.org sans.org2 min
11Tooling, Hybrid Logistics, and AccessibilityNext, let's cover tooling and logistics, because this is where hybrid workshops quietly break. First, test the platform against real access needs: WCAG 2.2 AA, screen reader, keyboard only, and phone dial in. If dial in is untested, assume it is broken. Hybrid rooms fail predictably. Assign one speaker, one microphone runner, and one chat watcher. That single decision solves most of your audio and attention problems. For materials, provide captions, editable formats, alt text, contrast at four point five to one, and text that survives two hundred percent resize. Build a contingency kit: printed materials, offline injects, a fallback dial in line, and a platform death plan. And protect the exercise itself. Whitelist the domains you need, use no real credentials, and pull no production data. One next action: run a fifteen minute technical rehearsal with an accessibility check before your next session, then move on to sustainment, embedding the workshop in a program, not a calendar.cisa.gov cisa.gov cisa.gov+22 min
12Sustainment: Embedding the Workshop in a Program, Not a CalendarNow, let's talk about sustainment. One workshop fades fast. So plan microlearning, refreshers, and repeat simulation from day one. Reminders and interactive examples stretch retention for months beyond the initial session. Next, locate your maturity stage, and move one high-impact behavior, not six. Here is the realistic tradeoff. Budget at least three dedicated full-time staff and three to five years for measurable behavior change. That number often surprises facilitators, but it is the honest baseline. Scale through partnerships with HR, Communications, Operations, and internal audit. And grow a facilitator community with shared scenarios, peer observation, and coaching loops, because a single trainer burns out. When participants push back, treat it as useful data, not resistance. Your next action is to name one reinforcement mechanism you will add to your calendar this quarter. Put that piece in place, and the program holds together. That leads us to Putting It Together: Take-Home Checklists and Next Steps.sans.org sans.org huntress.com+22 min
13Putting It Together: Take-Home Checklists and Next StepsLet's pull it into a take-home checklist you can reuse. Before the workshop: scope, objectives, audience segments, baselines, approvals, and accessibility. For design: a current-threat scenario, a difficulty tier, injects, key questions, and assigned roles. During delivery: state the contract, use no-fault framing and timeboxes, name a disclosure protocol, and close with a hot-wash agenda. Afterward: finish the after-action report within fourteen days, with owned and dated actions, and book the re-test before people leave the room. On metrics, track report rate, time to report, click rate by tier, and real-threat reporting, and read them as trends, not single numbers. For the first thirty days, run one ninety-minute session plus a small tabletop, capture a baseline, then book the re-test. Your next action is to pick one item here and put a name and a date on it today. Next, we rehearse the room itself in Practice Clinic: Rehearse the Room Before You Run It.cisa.gov cisa.gov cisa.gov+22 min
14Practice Clinic: Rehearse the Room Before You Run ItLet's close with practice. Rehearse the room before you run it. Micro-rehearsal one. Open in five minutes, covering purpose, ground rules, the no-fault statement, and your first question. Micro-rehearsal two. Deliver one AI-era inject, like a deepfake voice call from an executive, and land a decision with a named owner. Micro-rehearsal three. De-escalate a blame outburst and a real-incident disclosure, without losing the room. Micro-rehearsal four. Run a ten-minute hot wash that yields three corrective-action candidates, each with an owner. Score yourselves on the peer rubric: objective clarity, airtime balance, time discipline, safety, and notes quality. Then commit. Name one workshop next quarter and the metric you will report, such as time to a named decision owner. That is the whole course. Rehearse small, keep format simple, and make every hot wash produce owned actions. Thank you for the work you do, and good luck with your next exercise.cisa.gov cisa.gov cisa.gov+22 min

Take the deck with you

Download this course as a file — free, no sign-up needed.

PDF handoutEvery slide page, ready to print or share.15 pages · 3.5 MBDownload
Narrated PowerPointThe deck that presents itself — every slide carries the digital human's narration video.15 pages · 13.9 MBDownload
PowerPoint slidesThe full deck as a .pptx — open it in PowerPoint, Keynote, or Google Slides.15 pages · 3.5 MBDownload

Free to use in your own training — please keep the PersonWise credit page at the end.

Have your own deck? Turn it into a course

Sources consulted

Web sources consulted while building this course.