DAAKYI Cyber Academy
Capability That Stays with Your People.
A four-stage path from workforce awareness to executive readiness, delivered with training partners PECB and Proofpoint.
Executive Summary
- 01Awareness changes habits only when campaigns are repeated, role-specific and measured.
- 02Technical training should mirror attacker behavior so teams can detect threats and harden real systems.
- 03Executive tabletop exercises expose gaps in authority and decisions before a real incident does.
In Depth
How DAAKYI Cyber Academy Works
Awareness Is Measured, Not Just Delivered
Awareness training fails when it is treated as an annual event. Behavior changes through repetition, relevant examples and quick feedback. Phishing simulation supplies that loop. A campaign sends realistic lures, records who clicks, who enters credentials and who reports, then routes each group to short targeted learning. Reporting rate matters as much as click rate, because a reported lure gives the security team early warning. Campaigns should vary by role. Finance staff face invoice fraud, executives face impersonation, and administrators face credential harvesting. Trends across campaigns, not single results, show whether the culture is shifting.
Skills Training Follows the Attack Path
Technical training works best when it mirrors how attackers operate. MITRE ATT&CK Enterprise organizes adversary behavior into 14 tactics, which gives instructors a shared vocabulary for labs. Engineers practice detecting a technique, then hardening the control that would have stopped it. Cloud administrators work on identity and misconfiguration. Security analysts work on log triage and escalation. Network and systems teams work on baselines and patching. Hands-on exercises in a safe environment matter more than slides. The test of success is whether a team can operate its own tooling during a real alert.
Certification and Readiness Close the Loop
Certification gives staff a recognized standard to study against. For audit and security roles, that often means ISO/IEC 27001 implementation or auditing, or risk and privacy credentials. Readiness work addresses leaders. A tabletop exercise presents a scenario in stages, such as ransomware with a personal-data breach. Executives decide on containment, regulator notice, customer messaging and recovery priorities. Facilitators record the gaps in authority, contacts and playbooks. Those findings feed the next training cycle, so the academy path becomes a loop rather than a one-time course.
A trained workforce reports the attack early. A rehearsed leadership team decides quickly when it matters.
Capability path
Awareness to readiness
Stage 1
Awareness
Security awareness and phishing simulation for the whole workforce.
Behavior change measured campaign by campaign
Stage 2
Skills
Technical cybersecurity training for IT and security teams.
Teams able to operate and harden what we deploy
Stage 3
Certification
Accredited professional certification for security and audit staff.
Recognized credentials through PECB
Stage 4
Readiness
Executive briefings and tabletop exercises on realistic scenarios.
Leaders who have rehearsed their response
Training partners
Delivered with PECB and Proofpoint
Use Cases
Where Organizations Put It to Work
01
Reducing Phishing Risk Across the Workforce
Run awareness campaigns and phishing simulations that measure reporting as well as clicks.
02
Building Certified In‑House Talent
Develop security and audit staff through technical training and accredited professional certification.
03
Rehearsing Executive Crisis Decisions
Use executive briefings and tabletop exercises so leaders practice the decisions a real incident forces.
Product Journey
Discover, Engage, Onboard, Operate
- 1
Discover
Assess roles, skills gaps and certification needs.
- 2
Engage
Design a learning path across awareness, skills, certification and readiness.
- 3
Onboard
Enroll learners, launch simulations and schedule cohorts and exercises.
- 4
Operate
Track completion, reporting rates and readiness, and refresh content as threats change.
Methodology
The Method, Step by Step
- 1
Baseline the Workforce
Measure the starting point before teaching anything. Run a baseline phishing simulation, review incident history and map roles to the threats they face. Identify who handles money, data, privileged access and public communication. The baseline sets targets and prevents later results from being judged on impressions.
- 2
Map Roles to Learning
Assign content by job, not by department alone. General staff receive short habit-building modules. IT teams receive hands-on labs. Audit and security staff receive certification preparation. Executives receive scenario briefings. Each path states the behavior or capability expected at the end, so completion is never the only measure.
- 3
Deliver and Simulate
Run learning in short cycles. Pair each module with a simulation or lab that tests it within days. Phishing campaigns escalate in realism, and technical labs escalate in complexity. Keep feedback immediate and non-punitive, so staff report mistakes early instead of hiding them.
- 4
Rehearse the Response
Test decisions, not just knowledge. Build tabletop scenarios from the organization's own systems, suppliers and regulatory duties. Include injects that force trade-offs, such as a deadline for breach notification or a vendor outage. Capture decisions, delays and unclear ownership in a written record.
- 5
Measure and Repeat
Compare results against the baseline. Track reporting rates, lab performance, certification outcomes and exercise findings. Close each gap with an owner and a date. Then reset the baseline and plan the next cycle, because new hires, new systems and new threats continuously change the requirement.
Threat Scenarios
What It Looks Like in Practice
Supplier Invoice Fraud
How It Shows Up
A finance clerk receives a payment-change request that mimics a known supplier.
Response
Role-based simulation and a verification procedure teach staff to confirm bank changes through a second channel.
Administrator Credential Harvesting
How It Shows Up
Administrators receive a fake login page for a cloud console.
Response
Labs on multi-factor authentication and privileged access limit the damage from a stolen password.
Ransomware with No Decision Owner
How It Shows Up
Systems are encrypted and nobody knows who can authorize shutdown or external contact.
Response
Tabletops assign decision rights and rehearse containment, escalation and recovery order.
Audit Finding on Untrained Control Owners
How It Shows Up
An assessor finds control owners who cannot explain their responsibilities.
Response
Certification-aligned training builds auditors and owners who can evidence ISO/IEC 27001 controls.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Supplier Invoice Fraud | A finance clerk receives a payment-change request that mimics a known supplier. | Role-based simulation and a verification procedure teach staff to confirm bank changes through a second channel. |
| Administrator Credential Harvesting | Administrators receive a fake login page for a cloud console. | Labs on multi-factor authentication and privileged access limit the damage from a stolen password. |
| Ransomware with No Decision Owner | Systems are encrypted and nobody knows who can authorize shutdown or external contact. | Tabletops assign decision rights and rehearse containment, escalation and recovery order. |
| Audit Finding on Untrained Control Owners | An assessor finds control owners who cannot explain their responsibilities. | Certification-aligned training builds auditors and owners who can evidence ISO/IEC 27001 controls. |
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| Baseline Assessment Report | Sets the starting point for workforce behavior and technical skill. |
| Role‑Based Learning Plan | Matches content to jobs and the threats those jobs face. |
| Campaign Performance Reports | Show click, credential submission and reporting trends by group. |
| Lab and Certification Progress Record | Tracks technical capability and credential outcomes over time. |
| Tabletop After‑Action Report | Lists decisions, gaps and corrective actions with owners. |
| Role | Responsibility |
|---|---|
| Executive Sponsor (Client) | Sets expectations and takes part in exercises personally. |
| Security Awareness Lead (Client) | Owns the campaign calendar, reporting channel and follow-up. |
| Training Facilitator (Provider) | Delivers labs, briefings and exercises and records findings. |
| Department Managers (Client) | Release staff for training and enforce corrective actions. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Ad Hoc
Training is annual and generic, and completion is the only metric.
Stage 2
Managed
Campaigns run on a schedule and results are reported by group.
Stage 3
Measured
Learning is role-based, and reporting rates and lab results drive content.
Stage 4
Resilient
Leaders rehearse regularly, and findings change plans, tools and staffing.
Frameworks and Regulation
The Standards That Shape This Work
NIST CSF 2.0
Awareness and training sit within Protect, while Respond and Recover shape exercise content.
ISO/IEC 27001:2022
Annex A has 93 controls in four themes, including people controls. ISO/IEC 27002:2022 gives guidance.
MITRE ATT&CK
Its 14 enterprise tactics structure lab and tabletop scenarios.
Ghana Data Protection Act, 2012 (Act 843)
The data security safeguards principle makes staff handling of personal data a compliance matter.
Buyer Guidance
Choosing the Right Provider
What to look for
- Content should be tailored to roles, not one generic module for everyone.
- Simulation results should include reporting rate, not only clicks.
- Technical labs should be hands-on rather than slide-based.
- Certification should come from recognized bodies with transparent exam standards.
Questions to ask a provider
- How do you measure behavior change beyond course completion?
- How do you tailor scenarios to our systems and regulators?
- What do you deliver after an exercise besides a summary?
- How do you treat staff who fail simulations?
Technical Detail
For Architects and Engineers
Designing a Phishing Simulation Program
A sound simulation program controls for difficulty. Start with generic lures, then add pretexts based on real business processes such as invoice approval, shared documents and password resets. Measure three outcomes: click, credential submission and report. Segment results by role and tenure, never by individual for punishment. Coordinate with the mail team so simulation domains and sending infrastructure are allowlisted deliberately and documented. Include a reporting button so a reported lure reaches the security team's queue. Compare real phishing reports with simulation data, because a rise in real reports is stronger evidence of behavior change than a drop in clicks.
Building a Tabletop Exercise
A tabletop begins with an objective, such as testing breach notification decisions. Draft a scenario from ATT&CK-style behavior: initial access through phishing, credential theft, lateral movement, then data exfiltration or encryption. Release the story in timed injects. Each inject asks a named role to decide. Align decisions with the organization's incident plan, NIST SP 800-61 phases and any statutory duties, for example GDPR's 72-hour notification where feasible or incident reporting under Ghana's Cybersecurity Act, 2020 (Act 1038). A scribe records decision time, information used and owner. The after-action report ranks gaps by severity and assigns corrective actions.
Glossary
Key Terms
- Phishing Simulation
- A controlled fake attack email used to test and teach staff.
- Tabletop Exercise
- A discussion-based rehearsal of an incident with no live systems affected.
- Inject
- A timed piece of new information that forces participants to decide.
- Report Rate
- The share of recipients who flag a suspicious message to security.
FAQ
Questions About DAAKYI Cyber Academy
DAAKYI Intelligence
Ask Kasara About DAAKYI Cyber Academy
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step