Are you preparing your programme, or has your CISO asked what your employees will actually learn? This article presents every course in the Riot catalogue, what each one covers, and how to view their content directly from the platform.
💡 Prerequisites:
Administrator access to Riot, and being logged in at hub.tryriot.com;
a subscription that includes the Awareness module.
1️⃣ How the catalogue is built
Courses written by hand. Every line of every course in the catalogue is written by our team, then translated and proofread by native speakers so that it reads naturally in each language.
Short formats. Most courses last between 3 and 6 minutes.
Multi-year courses, marked with a lightning bolt ⚡. 14 topics come in 3 chapters. Riot automatically assigns a new chapter each year: your employees never see the same content twice.
Customisable courses, marked 🛠️ in the tables below. You can adapt certain elements to your organisation from the course's Settings tab (for example, the authentication app recommended in the 2-factor authentication course).
A catalogue that keeps evolving. The most recent courses, Infostealers and OT Security, were added in October 2026.
👍 Good to know: the courses you create with Studio are not part of this catalogue: they are generated by an AI trained on our courses, from your own content. To adapt an existing Riot course to your tools and rules, use Remix.
2️⃣ Viewing a course's content from the platform
You can browse the content of any course in your programme without sending it to anyone.
👉 Step 1: Open your programme
In the left-hand column of your screen, under Applications, click Awareness, then Edit Program.
👉 Step 2: Click the course
A window opens with three tabs: Preview, Progress and Settings.
👉 Step 3: Browse the content in the Preview tab
The Preview tab displays the course content.
👍 Good to know: to experience a course exactly as your employees will, you can also send it to yourself as a test, via Slack, Teams, Google Chat or the Web (the quickest option: the course opens in a new tab). The details are in Set up and modify your Multi-year Program, under "Test delivery across different channels".
⚠️ Important: once the programme is launched, a course received as a test is considered completed and is not sent to that person again. To review a large number of courses, use the Preview tab instead.
3️⃣ Multi-year courses ⚡
Each of these 14 topics comes in 3 chapters. Place them in several years of your programme: each year, your employees receive a new chapter on the same topic, with a new scenario.
Course | What the course covers | Recommended for | Duration |
Passwords 🛠️ | Why passwords still matter, how to choose a good one and stay ahead of the latest hacking techniques. | Everyone | ≈ 5 min |
2-factor authentication 🛠️ | What 2-factor authentication is, why it is essential, and how to enable it on a work account in a few steps. | Everyone | ≈ 5 min |
Phishing | The number one security threat for the company: recognising email attacks, including the latest ones, and adopting the right reflexes. | Everyone | ≈ 5 min |
Spear phishing | Tailor-made attacks, built from information gathered about the victim and made even more effective by AI. | Everyone | ≈ 4 min |
CEO fraud 🛠️ | How an attacker poses as an executive to obtain a transfer or an urgent action, and how to foil these scams. | Finance teams | ≈ 3 min |
Vishing | Phone scams: how they work and how to get out of them simply. | Everyone | ≈ 4 min |
Deepfake | Generative AI in the service of social engineering: fake calls, fake videos, and how to stay one step ahead. | Everyone | ≈ 3 min |
Ransomware | The most dangerous and costly type of malware: how these attacks work and how to prepare for them. | Everyone | ≈ 5 min |
Data breaches | Which data breaches the employee appears in, what this means for their security, and how to protect their data. | Everyone | ≈ 4 min |
Digital footprint | Everything shared online can be used to prepare a targeted attack: how to reduce what you expose. | Everyone | ≈ 4 min |
Mobile passcode | Why a strong unlock code is essential on your phone, and how to change it easily. | Everyone | ≈ 4 min |
Insider threats 🛠️ | When the risk comes from within: recognising insider threats and knowing how to guard against them. | Everyone | ≈ 3 min |
PCI DSS 🛠️ | The security rules for payment card data and how they protect the company against fraud. | Everyone | ≈ 5 min |
HIPAA | The five key HIPAA protections for securing patients' health data. | Everyone | ≈ 6 min |
4️⃣ The other courses in the catalogue
👉 Social engineering and scams
Course | What the course covers | Recommended for | Duration |
Smishing | Phishing by text message: the three most common attacks. | Everyone | ≈ 3 min |
Quishing | Phishing by QR code, one of the fastest-growing scams. | Everyone | ≈ 4 min |
Scams on instant messaging and the reflexes to protect yourself. | Everyone | ≈ 4 min | |
Malware | Malicious software disguised as a legitimate file, and what it can cost the company. | Everyone | ≈ 3 min |
Infostealers | How a simple fake CAPTCHA can steal passwords, session cookies and work accounts, and how to block these attacks. | Everyone | ≈ 4 min |
Remote work scams | Fake remote IT workers who infiltrate companies: the warning signs to know. | Everyone | ≈ 4 min |
Third-party attacks | Every business relationship opens up new risks: how to protect yourself from attacks coming through a supplier or partner. | Everyone | ≈ 5 min |
👉 Everyday reflexes and physical security
Course | What the course covers | Recommended for | Duration |
Introduction 🛠️ | An introduction to the awareness programme, the company's most valuable assets, and why everyone is a target. | Everyone | ≈ 1 min |
AI tools | Using AI tools safely and responsibly. | Everyone | ≈ 4 min |
Software vulnerabilities | Why outdated software is a way in, and the importance of updates. | Everyone | ≈ 4 min |
DarkSword | One of the most advanced exploit kits targeting devices, and how to check whether your device is exposed. | Everyone | ≈ 3 min |
LinkedIn footprint | Reviewing your privacy settings and slimming down your public profile, the attackers' first source of information for spear phishing. | Everyone | ≈ 5 min |
Out-of-Office | What you should never put in an out-of-office message, because it can be used against you. | Everyone | ≈ 3 min |
Tailgating | How a stranger can get into a restricted area by following you, and how to check their identity politely. | Everyone | ≈ 4 min |
OT Security | Attacks targeting operational technology (OT) and how to protect physical infrastructure. | Everyone | ≈ 4 min |
👍 Good to know: if you use Sonar, the rule on over-exposed LinkedIn profiles complements the LinkedIn footprint course: the course explains why, the task gets people to act. See Your employees' LinkedIn digital footprint.
👉 Personal data and compliance
Course | What the course covers | Recommended for | Duration |
Company documents | The internal rules and policies that keep the company compliant, and what is expected of each person in their role. Add your own documents to it. | Everyone | ≈ 5 min |
Personal data | What personal data is and the rules to follow when handling it. | Everyone | ≈ 4 min |
Limited data retention | Limiting the personal data collected and how long it is kept, to comply with the GDPR and reduce the risk of a breach. | Everyone | ≈ 3 min |
Privacy-by-design | The GDPR principle of data protection by design, applied to the collection and use of personal data. | Everyone | ≈ 4 min |
NIS2 | The European cybersecurity directive: what it requires, who is accountable, and what needs to be done to stay compliant. | Everyone | ≈ 5 min |
👉 Courses for technical teams
These courses are based on the OWASP Top 10, the reference list of security risks for web applications. They are aimed primarily at your developers.
Course | What the course covers | Recommended for | Duration |
OWASP 1: Broken Access Control | Number 1 in the OWASP Top 10: understanding broken access control and spotting it in code review. | Technical teams | ≈ 5 min |
OWASP 2: Security Misconfiguration | Number 2 in the OWASP Top 10: why accidentally leaving a system exposed can be as serious as an intrusion. | Technical teams | ≈ 5 min |
OWASP 3: Software Supply Chain Failures | Number 3 in the OWASP Top 10: the risks linked to third-party code and how to protect against them. | Technical teams | ≈ 5 min |
👍 Good to know: course titles may differ slightly in your interface. The chapter name is displayed next to the course title, both in Albert's messages and on the employee portal.
5️⃣ Covering the topics your framework expects
Some frameworks, such as ISO 27001, expect your awareness programme to cover specific topics. Rather than a single course per topic, the catalogue addresses each subject from several angles. Here is where to find it:
Expected topic | Courses that cover it |
Information security policy | Company documents |
Good use of the internet | Phishing, Malware, Personal data, Ransomware, Digital footprint, Software vulnerabilities, Company documents |
Social engineering | Phishing, Spear phishing, CEO fraud, Malware, Ransomware, Smishing, Vishing, WhatsApp, Deepfake, Remote work scams, Company documents |
Security incidents | Company documents |
Encryption tools | Company documents |
Laptop and smartphone security | Mobile passcode, Passwords, Software vulnerabilities, Company documents |
Use of personal software or devices at work | Software vulnerabilities, Company documents |
Respect for intellectual property | AI tools, Company documents |
Access control | 2-factor authentication, Passwords, Insider threats, Company documents |
Individual roles and responsibilities | Personalised links to your IT or security team in many courses, Company documents |
👍 Good to know: social engineering does not have a single course. The threat is too broad and too varied: instead, the catalogue covers its most common forms, each in a dedicated course.
Key takeaways
The catalogue has more than 35 courses, including 14 multi-year topics ⚡ available in 3 chapters.
To view a course: Awareness > Edit Program > click the course > Preview tab.
A course received as a test counts as completed once the programme is launched: keep test sends to a few courses.
Courses marked 🛠️ can be adapted to your organisation from their Settings tab.
To build your programme: Set up and modify your Multi-year Program.