Trainings Guide

Awareness training changes behaviour only when it is measured and specific. Veiliux runs a baseline phishing simulation before any content is delivered, so improvement is demonstrable rather than assumed. Campaigns use realistic pretexts drawn from current attacker tradecraft, payroll changes, supplier bank detail updates, MFA fatigue prompts and QR-code lures, tailored to your sector and brand.

Modules are role-based. Finance staff are drilled on invoice fraud and payment verification, executives and their assistants on impersonation and travel-period targeting, developers on credential handling and repository hygiene, and frontline staff on physical tailgating and device loss. Sessions are short, scenario-driven and delivered in language people actually use.

Reporting gives leadership click rate, report rate and time-to-report by department, tracked across campaigns. The reporting metric matters most: an organisation where staff raise the alarm in two minutes survives incidents that sink one where nobody speaks up.

Infrastructure security training is delivered in labs, not slides. Engineers work in a dedicated environment where they harden real systems, break them, and observe the telemetry their changes produce, the fastest way to convert a benchmark document into working knowledge.

Content covers Linux and Windows hardening, Active Directory tiering and delegation, network segmentation, secure remote access, cloud identity and workload configuration, container and Kubernetes security, patch and vulnerability workflow, and logging that supports investigation rather than just storage.

Each module pairs an attack with the corresponding defence, so participants see why the control exists. Courses can be aligned to certification tracks where teams need formal recognition, and the lab remains available after delivery for continued practice.

Critical national infrastructure faces adversaries with different objectives from criminal groups: disruption, positioning and influence rather than immediate financial return. This programme teaches teams to recognise that tradecraft and respond proportionately.

Material is built on documented campaigns against energy, transport, telecom, water and government sectors, walking through initial access, persistence in OT and IT environments, living-off-the-land techniques and the indicators that distinguish state-aligned activity from commodity crime.

Delivery includes response drills and intelligence-handling practice: classification discipline, sharing with national bodies and sector CERTs, and the escalation decisions that must be made quickly and cannot be improvised. Content and delivery are adapted to the clearance and handling requirements of the organisation.

Developer security training works when it uses the team's own code. Veiliux builds the course around your languages, frameworks and repositories, so every example is recognisable and every fix is immediately applicable.

Labs cover the OWASP Top 10 in practice, injection, broken access control, authentication and session flaws, SSRF, insecure deserialisation, and the API-specific issues that dominate modern breaches, alongside secrets management, dependency and supply-chain risk, and secure design review.

The DevSecOps track integrates SAST, DAST, dependency and IaC scanning into your pipeline with thresholds that block genuinely dangerous changes without drowning teams in noise. Developer scorecards track defect classes over time so security becomes a measurable engineering quality metric.

Internal audit and assurance teams are frequently asked to prove control coverage without having been taught how. This course gives them a repeatable methodology: scoping against a control framework, sampling, evidence collection, testing technique and defensible conclusions.

Practical sessions cover network discovery and topology validation, firewall and ACL review, segmentation verification, privileged access checks, configuration baselines and log coverage assessment, using tooling participants can continue to run afterwards.

A substantial part of the programme is report writing. Auditors learn to state findings with evidence, rate them consistently, avoid unsupported assertions and write recommendations that engineering teams can act on, the difference between an audit that improves security and one that generates a filing.