FREE COURSE / SELF-PACED LEARNING

Social Engineering: Break the Script

Learn to interrupt suspicious requests, verify independently and report useful evidence in this free social engineering course.

Read the first lesson Explore the curriculum

Read freely. Create an account to save your completed lessons.

Experience level
Beginner
Curriculum
3 modules · 6 lessons
Estimated reading
24 min
Language
English

Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.

KNOW WHAT YOU’RE WORKING TOWARD

What you’ll learn

  • Identify the decision, asset, and trust signal an attacker is attempting to control in a social-engineering scenario.
  • Apply an interrupt–verify–limit–report routine to suspicious requests across written, voice, and in-person channels.
  • Select an independent verification path appropriate to credential, payment, data, access, and authority requests.
  • Produce a concise, blame-free report that preserves useful context and accelerates defensive action.

Is this the right course for you?

Who it’s for

Individuals and teams facing suspicious requests across email, messaging, voice and other channels.

Scope and boundaries

Request verification and safe reporting. The technical phishing triage course focuses on investigating message evidence.

How you’ll learn

Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.

Before you begin

  • Everyday workplace familiarity — Learners should be familiar with ordinary email, messaging, phone, login, payment, or approval workflows; no cybersecurity background is required.

About this course

Social engineering succeeds when an attacker steers a normal human decision toward an unsafe action. This course teaches non-specialist employees, team leads, and security champions to recognize that steering, identify the decision at risk, and regain control before trust becomes access, money, data, or authority.

The course promises a reusable defensive habit: interrupt the script, move verification onto a channel the requester did not supply, reduce the requested action to its real consequence, and report what happened while the evidence is still fresh. Learners apply that habit to email, chat, voice, QR codes, help-desk interactions, payment changes, credential requests, and multi-stage impersonation.

The scope stays deliberately human and operational. It explains attacker tactics only to improve defensive decisions; it does not teach offensive manipulation, technical malware analysis, or organization-specific incident procedures. By the end, learners can diagnose a suspicious request, choose a proportionate verification step, protect recovery and approval paths, and make a concise report that helps defenders act.

FOLLOW THE LEARNING PATH

Course curriculum

MODULE 1

1. See the Decision Path

Social engineering becomes easier to resist when learners stop asking only whether a message looks fake and instead map the decision it is trying to produce. This module makes the hidden path visible: the claimed identity, borrowed context, emotional pressure, requested action, and asset at risk.

  1. The Attacker’s Product Is Your Next ActionMap a social-engineering attempt as a chain from pretext to consequence, then identify the exact decision the attacker needs.4 min reading
  2. Pressure, Authority, and Borrowed FamiliarityRecognize how urgency, authority, scarcity, helpfulness, and familiar context narrow attention without proving a request is false.4 min reading

MODULE 2

2. Interrupt the Script Across Channels

The same manipulation script can arrive through email, chat, SMS, QR code, phone, video, or a help-desk conversation. This module teaches channel-aware clues while keeping the response stable: pause the interaction, leave the supplied path, and verify independently.

  1. Email, Chat, SMS, and QR Codes: Read the RouteSeparate what a message says from where its links, replies, files, and QR codes attempt to route the next action.4 min reading
  2. Voice, Video, and Help-Desk ImpersonationHandle convincing voices, faces, caller IDs, and support stories as claims that still require independent proof.4 min reading

MODULE 3

3. Engineer Safer Decisions

Personal awareness is strongest when workflows make the safe choice easier. This module applies independent verification, least authority, dual control, and blame-free reporting to high-impact requests so one hurried moment does not become an organizational incident.

  1. High-Impact Requests Need a Second PathMatch payments, credentials, recovery, access, and sensitive-data requests with verification controls independent of the request itself.4 min reading
  2. Report the Attempt, Repair the PathPreserve useful context, report without blame, respond after interaction, and improve the workflow that made manipulation possible.4 min reading

BUILD ON THE RIGHT FOUNDATION

These courses address different scopes. Choose the foundation or follow-on that fits your next question.

Sources and editorial review

Reviewed by Threat Intelligence Lab

Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.

Selected references are shown here; the lessons contain the full reading lists.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.