This article describes the experience of completing a Cypher training session from the user's perspective — how to start a session, what happens during the scenario, and what you receive when you finish. It applies to annual, monthly, and remediation sessions.
Starting a Session
- Sign in to your company's portal, open Training Dashboard (
/portal/training) in the sidebar, and click the Security Training card. This opens Cypher at/portal/cypher. - Your dashboard shows the next session due. The label indicates the type: annual, monthly, or remediation.
- Click Start. The session begins immediately.
If you have multiple assignments pending, the dashboard shows them in priority order. Remediation sessions (assigned after a phishing click or similar event) appear prominently.
Working Through the Scenario
Each session is a story-driven scenario. The content is generated by THEO based on your company profile and your role. A session may be:
- A phishing email that you need to evaluate and respond to
- An unexpected phone call from someone requesting sensitive information
- A physical situation, such as someone asking to tailgate through a secure door
At each decision point you choose what to do. The scenario branches based on your choice. There is no single correct path — the tree is adaptive and reflects how the situation would actually develop based on your actions.
Scenarios run until you reach a resolution point.
The Debrief
After the final choice, you receive a debrief screen. The debrief shows:
- What the right action was and why
- What the attacker was actually attempting
- How your choices affected the outcome
- Your XP award for the session
Read the debrief carefully — it contains the training content. The scenario is the delivery mechanism; the debrief is the lesson.
XP and Progress Updates
Immediately after the debrief is confirmed:
- Your XP total updates
- If the XP pushes you to the next level threshold, your level advances
- Your streak counter increments if this is your first completion of the current calendar month
- Any newly unlocked badges appear in your Achievements section
You do not need to do anything to claim these — they apply automatically.
Micro-Training Sessions
Micro-training sessions (assigned after phishing clicks or other incidents) follow the same flow but are shorter. They focus on the specific gap identified by the trigger — for example, recognising a credential-harvesting link or identifying a pretexting caller. Completing a micro-training session also awards XP.
Picking Up Where You Left Off
Sessions do not save mid-scenario — you need to complete a session in one sitting. If you close the window before finishing, the session remains open and appears as in-progress on your dashboard. Start it again and you will begin from the beginning.
FAQ
How long does a session take? Most sessions are designed to be completed in a few minutes. Annual training may be longer than monthly. Micro-training sessions are the shortest.
What if I choose wrong in the scenario? Choosing an incorrect action is part of the training. The scenario adapts and the debrief explains what a better choice would have been. You still earn XP for completing the session.
Do I need to complete sessions in a specific order? Some sessions may require a prior session to be completed first. If a session is locked on your dashboard, check whether an earlier assignment is still open.