Covers recognising and resisting phishing, malware and social engineering, protecting devices and accounts, and responding to incidents under UK GDPR.
This course equips learners in the UK housing and construction sector with the knowledge and practical habits needed to recognise, resist, and respond to everyday cyber threats. Covering the psychology behind attacks, the most common threat types, device and account protection, and incident response, it supports organisations in meeting their legal obligations under the UK GDPR and the Data Protection Act. The module is informed by guidance from the National Cyber Security Centre (NCSC).
Phishing, malware, ransomware, spyware, social engineering, pretexting, impersonation, two-factor authentication, password manager, passkeys, VPN, brute-force attack, cyber incident, data breach, UK GDPR, Information Commissioner's Office, National Cyber Security Centre, digital doubt
This lesson reframes how you think about cyber threats — not as complex technical assaults, but as carefully designed exploits of human behaviour. Using an immersive vault scenario, you'll understand why attackers target people rather than systems, how psychological triggers such as fear, authority, urgency, and curiosity are weaponised, and how malware can be delivered through seemingly innocent devices. You'll leave with a clear mental model of how hackers choose the path of least resistance and what that means for you at work.
This lesson explores the most common attack types you are likely to encounter in a working day, starting with phishing — the cause of 93–95% of cyber crime incidents in 2025. You'll learn to identify the visual and behavioural "tells" of a phishing email, understand the psychological tactics behind common scams (authority, urgency, curiosity, fear of loss), and recognise the difference between phishing and malware delivery. You'll also understand how ransomware and spyware operate once a device is compromised.
This lesson gives you the practical tools to become a harder target. You'll learn why password length and uniqueness matter more than complexity alone, how to apply the NCSC's three-random-words strategy, and why Two-Factor Authentication (2FA) is the single most effective control against remote account takeover. You'll also explore password managers, passkeys, and the device-level habits — software updates, screen locks, trusted app sources, and VPN use — that close the most common entry points.
This lesson prepares you to respond quickly and effectively when a cyber incident occurs or is suspected. You'll understand why prompt internal reporting is critical — both to limit organisational damage and to meet the 72-hour notification window required by UK GDPR for reportable personal data breaches. You'll learn the correct immediate actions for four common scenarios: clicking a suspicious link, receiving a phishing email, sharing data with the wrong person, and receiving a ransomware demand. Recognising the signs of a compromised device or account is also covered.
