Phishing and the three tells
Pause on the request rather than the sender, and verify out of band.
Free Staff Training, Included On Every Plan
Fifteen minutes your staff will actually finish.
Three short modules and your own acceptable-use policy, delivered to staff who never get an account, never set a password, and never have to be deprovisioned when they leave. What you get back is a record: who read what, when, and how they scored.
What Your Staff Get
Three modules, about five minutes each — roughly fifteen minutes in total, not an afternoon. Each one targets a behavior rather than a topic.
Paying the right people
Confirm any change to bank details by a channel you already had.
When something goes wrong, tell someone
Tell someone immediately, especially when you believe you caused it.
- Magic link
- 3 modules
- Policy sign-off
- Verified record
See the product in the order your staff experience it.
Four screens, from the link landing in their inbox to the line telling them what is being recorded.
1 of 4
No account needed
Staff get a private training link. No account, password, or deprovisioning.
Illustration — the organization and the policy text are examples.
2 of 4
Three short modules
About fifteen minutes total: phishing, payment changes, and reporting mistakes.
3 of 4
Policy acknowledgment included
They read your own policy and acknowledge the exact version they saw.
Illustration — the policy text shown is an example, not a template we supply.
4 of 4
Plain privacy expectation
The product tells learners what is being recorded before they begin.
1 of 4
Training Principle
The Content Does Not Tell Them To Look For Bad Spelling
Most awareness training still teaches people to spot a fake. Fakes got too good for that. The phishing module opens by saying so, and then teaches the three things an attacker cannot hide, because they are what the attack actually needs: the request, the fact that it came to you, and the pressure.
Every year, someone tells you to watch out for bad spelling. That advice is now worse than useless. Attackers write with the same tools you do… So we are not going to teach you to spot a fake. We are going to teach you to spot a situation.
It works through a real-shaped supplier email that changes bank details, a fake sign-in page, and a text from “the director” — then says plainly what it does not mean, so nobody leaves treating every email as an attack. The line that does the work: real work asks for these things too; the difference is that real work survives being checked.
Server-Graded
The Quiz Cannot Be Bypassed From Devtools
Grading happens on the server. The answer key is deliberately unreachable from the browser bundle, and there is a test that walks the import graph to prove it stays that way. That is what makes a completion record mean something rather than merely exist.
- 80% to pass, with unlimited retakes.
- Explanations appear with the verdict, never before it — in advance they would just be hints.
- The annual clock runs per person, from their own date. A nightly sweep finds who is due and reminds them, with two weeks of quiet in between so nobody is chased twice.
Product Position
The Record, And What It Refuses To Say
Public Verify Link
When someone finishes, they can send their record to whoever asked for it. The page that manager lands on is public — anyone holding the link can check it, with no login and no screenshot of a screenshot. It states the organization, the modules, the versions, the scores and the dates.
Then it says this, without being asked to:
It is a record of what was completed, not a certification — it does not state that any particular training requirement has been met. That is a judgment for whoever asked the question.
That sentence is the product's position, not marketing copy written around it. If you have been sold “compliant training” by three vendors this year, it is the distinction they were eliding.
See the record in the order an assessor or client would inspect it.
From what the training actually teaches, through how a completion is graded, to the line the record refuses to cross.
1 of 5
Training that teaches situations
It does not teach bad-spelling folklore. It teaches the request, the target, and the pressure.
2 of 5
Quiz answers stay server-side
Completions are graded on the server, not faked in the browser.
3 of 5
Explanations after the verdict
Learners get feedback after answering, so the explanation teaches without becoming the hint.
4 of 5
Public verification link
Anyone with the link can verify the record without asking for a login or a screenshot.
Illustration — Acme Ltd and Sam Rivera are placeholders on the reserved example domain, not customers.
5 of 5
Not a certification
StackHound says exactly what the record is, and what it is not.
1 of 5
SHA-256Versioned
The Other Half: Acknowledging Your Own Policy
The course ships alongside policy acknowledgment, and this is the half most training vendors skip — because it is not training content. You supply the document; StackHound supplies the record. An admin pastes in the staff handbook or acceptable-use policy, staff read it in full and check “I have read and understood this document.”
It exists because a completion record on its own is often not what is being asked for. PCI DSS v4.0 does not stop at “staff completed training”: personnel are required to acknowledge in writing, at least every twelve months, that they have read and understood the security policies. StackHound produces and stores exactly that record, against the specific version of the document they saw. Whether a given assessor accepts it is their judgment, not ours.
Each acknowledgment is recorded against that version's SHA-256, so publishing a new handbook never silently re-points the old ones — the record shows who is on the current text and who is not, rather than hiding the gap.
No Account
How It Reaches Your Staff
An admin enrolls people by email address from a StackHound workspace. Each person gets a single-use magic link, valid for 24 hours, opening a session that lasts 12. There is no password to set and no account to forget — and nothing to deprovision when somebody leaves.
Learners are not billable users. Operator seats price the people who read security findings; learners live in a separate table with their own ceiling, on purpose, so a firm never has to buy a larger plan simply to train its staff.
What It Costs
Nothing. Staff training and policy acknowledgment are included on every plan, Free included. The paid line falls at the compliance evidence pack — the document that assembles these records together with what StackHound observed about your sites and servers. Run acknowledgment across your whole team at no cost; pay when someone actually asks you for the document.