GUIDE · Cyber Academy & Training
A Capability Path from Awareness to Readiness.
DAAKYI Cyber Academy builds security awareness, technical skills, certification and executive readiness, delivered with our training partners.
- Behavior change measured campaign by campaign
- Teams able to operate and harden what we deploy
- Leaders who have rehearsed their response
- 1Assess Needs
- 2Set Baselines
- 3Deliver in Tiers
- 4Rehearse and Test
- 5Measure and Reinforce
Executive Summary
- 01Awareness, technical skills, certification and leadership rehearsal each address a different failure, so each needs its own method and measure.
- 02Phishing simulation is only useful when it tracks reporting behavior and speed, not just who clicked.
- 03Tabletop exercises expose gaps in authority, contacts and escalation before a real incident does.
The Challenge
Phishing remains a leading cause of incidents, and technical teams are asked to run controls they were never trained on.
Executives are expected to lead incident response they have never rehearsed.
The DAAKYI Approach
DAAKYI runs a four‑stage path: awareness for the whole workforce, skills for IT and security teams, certification for security and audit staff, and readiness for leaders.
Each stage has a measurable outcome.
- 01
Training needs assessment
- 02
Awareness and phishing simulation campaigns
- 03
Technical and certification courses
- 04
Executive tabletop exercises
In Depth
How the Discipline Works
Awareness Changes Daily Habits
Awareness training works when it targets specific behaviors rather than general knowledge. Staff learn to recognize a suspicious sender, verify a payment change through a second channel, and report a doubtful message quickly. Phishing simulation tests those habits under realistic conditions. Each campaign uses a scenario tied to the organization's actual exposure, such as invoice fraud for finance or credential prompts for administrators. Results show who clicked, who reported, and how quickly. Reporting rate matters as much as click rate, because a reported message gives the security team early warning. Repeat campaigns show whether behavior is actually improving over time.
Technical Training Closes the Operating Gap
Buying a firewall, endpoint agent, or log platform does not make an organization safer until staff can run it. Technical training covers configuration baselines, alert triage, log analysis, and hardening against published benchmarks such as the CIS Critical Security Controls v8. Labs matter more than slides. Engineers practice on realistic systems, break things safely, and learn how adversary behavior maps to MITRE ATT&CK tactics. The goal is a team that can tune detections, patch with judgment, and explain why a setting exists. Good programs match skills to the tools actually in use.
Certification and Leadership Rehearsal Differ
Certification gives auditors and security staff a recognized, independently assessed credential that signals competence in standards such as ISO/IEC 27001. Executive readiness is a different discipline. Leaders rarely need tool skills. They need to decide under pressure: when to isolate a system, who speaks to the regulator, whether to notify customers. A tabletop exercise walks leadership through a realistic incident, injects new facts, and records decisions. Gaps in authority, contact lists, and escalation paths surface in the room rather than during a real breach. NIST SP 800-61 provides the incident handling structure such exercises often follow.
Security awareness is not a course completed once. It is behavior measured, repeated, and proven under pressure.
Capability Matrix
What the Service Includes
| Capability | Coverage | GUIDE | SECURE | OPERATE | Delivered Through |
|---|---|---|---|---|---|
| Security Awareness Programs | Workforce-wide awareness and phishing simulation. | GUIDE stage | – | – | Capability Development |
| Technical Security Training | Skills to operate and harden deployed controls. | GUIDE stage | – | – | Capability Development |
| Professional Certification | Accredited certification through PECB. | GUIDE stage | – | – | Capability Development |
| Executive and Board Awareness | Briefings and cyber readiness exercises. | GUIDE stage | – | – | Capability Development |
Security Awareness Programs
Workforce-wide awareness and phishing simulation.
- Stage
- GUIDE
- Delivered Through
- Capability Development
Technical Security Training
Skills to operate and harden deployed controls.
- Stage
- GUIDE
- Delivered Through
- Capability Development
Professional Certification
Accredited certification through PECB.
- Stage
- GUIDE
- Delivered Through
- Capability Development
Executive and Board Awareness
Briefings and cyber readiness exercises.
- Stage
- GUIDE
- Delivered Through
- Capability Development
How It Works
How Cyber Academy & Training Works
- 01Awareness
- 02Skills
- 03Certification
- 04Readiness
Methodology
The Method, Step by Step
- 1
Assess Needs
Start with who does what. Map roles to the risks they carry: finance approvers, administrators, developers, auditors, executives. Review past incidents, audit findings, and regulatory duties to identify skill gaps. The output is a prioritized training plan that links each audience to a specific behavior or competence, not a generic course list.
- 2
Set Baselines
Measure before teaching. Run a baseline phishing simulation, a short knowledge check, and a skills assessment for technical staff. Record the results by department and role. Without a baseline, later improvement cannot be shown, and budget discussions rely on opinion rather than evidence.
- 3
Deliver in Tiers
Deliver content matched to each audience. Short, recurring modules suit the wider workforce. Hands-on labs suit engineers and analysts. Instructor-led preparation suits certification candidates. Executives receive concise briefings. Keep sessions scheduled around operational pressure, such as month-end close, so attendance stays realistic.
- 4
Rehearse and Test
Move from learning to proving. Repeat phishing campaigns with new lures. Run technical exercises that test detection and response. Hold an executive tabletop built from the organization's own critical services and notification duties, including the GDPR 72-hour breach notice where it applies. Record decisions, delays, and unanswered questions.
- 5
Measure and Reinforce
Report outcomes against the baseline: reporting rates, assessment scores, certification results, and tabletop findings. Feed gaps into the next cycle. Retrain where behavior has not changed, and refresh content as adversary techniques shift. Training is a recurring control, so evidence of repetition is part of the result.
Operating Model
Delivered from the GUIDE Pillar
Pillar position
GUIDE
Advisory, Risk & Assurance
Engagement model
Capability Development
Training, certification and mentoring programs.
Best for · Regulators and operators growing talent
Threat Scenarios
What It Looks Like in Practice
Supplier Invoice Fraud
How It Shows Up
Finance receives a bank-detail change request from a spoofed supplier address that looks routine.
Response
Awareness content teaches out-of-band verification, and finance-specific simulations test whether approvers actually follow it.
Credential Harvesting Against Administrators
How It Shows Up
A privileged user enters credentials on a fake login page and does not report it.
Response
Targeted simulations and technical training reinforce rapid reporting and the use of phishing-resistant authentication.
Controls Running in Default Mode
How It Shows Up
A deployed security tool generates alerts that nobody triages or tunes.
Response
Hands-on labs teach triage, tuning, and hardening on the tools the team actually operates.
Unrehearsed Breach Decision
How It Shows Up
Leaders disagree on who may authorize a system shutdown or contact a regulator.
Response
A tabletop exercise assigns decision authority, tests escalation paths, and records every gap for correction.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Supplier Invoice Fraud | Finance receives a bank-detail change request from a spoofed supplier address that looks routine. | Awareness content teaches out-of-band verification, and finance-specific simulations test whether approvers actually follow it. |
| Credential Harvesting Against Administrators | A privileged user enters credentials on a fake login page and does not report it. | Targeted simulations and technical training reinforce rapid reporting and the use of phishing-resistant authentication. |
| Controls Running in Default Mode | A deployed security tool generates alerts that nobody triages or tunes. | Hands-on labs teach triage, tuning, and hardening on the tools the team actually operates. |
| Unrehearsed Breach Decision | Leaders disagree on who may authorize a system shutdown or contact a regulator. | A tabletop exercise assigns decision authority, tests escalation paths, and records every gap for correction. |
Outcomes
What Your Institution Gains
- Behavior change measured campaign by campaign
- Teams able to operate and harden what we deploy
- Leaders who have rehearsed their response
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| Training Needs Assessment | Links each role to the risks it carries and the skills it lacks. |
| Baseline and Campaign Results Report | Shows click, report, and response behavior by department over successive campaigns. |
| Curriculum and Lab Guide | Documents what each audience is taught and which exercises prove the skill. |
| Certification Progress Record | Tracks candidates, preparation, and results for audit and staffing evidence. |
| Tabletop After‑Action Report | Records decisions, gaps, and assigned corrective actions from the leadership exercise. |
| Role | Responsibility |
|---|---|
| Executive Sponsor (Client) | Sets expectations, attends the tabletop, and ensures managers release staff for training. |
| Security Awareness Lead (Client) | Owns the campaign calendar, coordinates with mail security, and reports behavior trends. |
| Instructor (Provider) | Delivers technical and certification content and adapts labs to the tools in use. |
| Exercise Facilitator (Provider) | Designs the scenario, controls the injects, and documents decisions and gaps. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Ad Hoc
Training happens once a year or after an incident. Completion is tracked, but behavior is not.
Stage 2
Scheduled
Awareness and technical courses follow a calendar and cover defined audiences. Phishing tests run, but results are rarely acted on.
Stage 3
Measured
Baselines exist and results are compared by role. Retraining is targeted at groups that show weak behavior.
Stage 4
Rehearsed
Leaders and technical teams practice realistic incidents regularly. Findings flow into playbooks, contacts, and the next training cycle.
Frameworks and Regulation
The Standards That Shape This Work
ISO/IEC 27001:2022
Annex A groups 93 controls into organizational, people, physical, and technological themes. The people theme covers awareness, education, and training, and ISO/IEC 27002:2022 gives guidance for implementing it.
NIST CSF 2.0
The Protect function includes awareness and training outcomes. The Govern function covers roles and accountability, which tabletop exercises test.
PCI DSS v4.0
The standard requires a security awareness program for personnel handling cardholder data. Version 4.0.1 is the current revision, and its future-dated requirements became mandatory on 31 March 2025.
Ghana Cybersecurity Act, 2020 (Act 1038)
The Act provides for licensing and accreditation of cybersecurity professionals and for incident reporting, both of which shape training content and exercise scenarios.
Buyer Guidance
Choosing the Right Provider
What to look for
- Look for programs built from a needs assessment, not a fixed course catalog.
- Look for phishing simulation that reports reporting behavior and time to report, not only click rates.
- Look for hands-on labs that use technologies similar to yours.
- Look for tabletop facilitators who can tie scenarios to your regulatory notification duties.
Questions to ask a provider
- How do you set a baseline and show change against it?
- How do you tailor lures and scenarios to our roles and sectors?
- What evidence will we receive for auditors and regulators?
- How are exercise findings tracked until they are closed?
Regulatory & Industry Context
The Obligations This Service Supports
Training supports awareness requirements in ISO/IEC 27001, PCI DSS and HIPAA, and capacity-building goals in national cybersecurity programs.
Frameworks DAAKYI helps clients implement
- ISO/IEC 27001
- PCI DSS
- HIPAA
- Ghana Act 1038
Framework references describe client implementation support, not DAAKYI certifications.
Technical Detail
For Architects and Security Leads
Telemetry sources and partner technologies
Technology partners DAAKYI works with in this area.
Framework and regulatory alignment
- ISO/IEC 27001
- PCI DSS
- HIPAA
- Ghana Act 1038
Training supports awareness requirements in ISO/IEC 27001, PCI DSS and HIPAA, and capacity-building goals in national cybersecurity programs.
Architecture reference
How Cyber Academy & Training Works: Awareness → Skills → Certification → Readiness.
DAAKYI runs a four-stage path: awareness for the whole workforce, skills for IT and security teams, certification for security and audit staff, and readiness for leaders.
Designing a Phishing Simulation Program
A useful simulation program varies difficulty, channel, and theme. Start with obvious lures and progress to targeted ones that mimic internal approvals, shared-document requests, and multifactor prompt fatigue. Technical setup needs care: allow-list the sending infrastructure, coordinate with the mail security team, and brief the help desk so real reports are not confused with tests. Track three signals: click rate, credential submission rate, and report rate. Report time matters because it measures how fast the organization could contain a real campaign. Avoid punitive handling. Staff who fear blame stop reporting. Provide immediate feedback on the landing page, and segment results by role so high-risk groups, such as finance and administrators, get focused follow-up.
Building a Skills and Tabletop Curriculum
Map the technical curriculum to MITRE ATT&CK, which organizes adversary behavior into 14 tactics. For each tactic, ask what the team can detect, what it can block, and what it cannot yet see. Build labs around the gaps. Detection engineers practice writing and tuning rules; administrators practice hardening against CIS benchmarks; incident handlers rehearse containment following NIST SP 800-61. Tabletops use the same material at leadership level. A scenario such as ransomware in a payment system forces decisions on isolation, regulator contact, and customer communication. Capture each decision, who made it, and what information was missing. Those notes become the action list for playbook and contact-list updates.
Glossary
Key Terms
- Phishing Simulation
- A controlled, authorized test that sends realistic deceptive messages to staff to measure and improve their response.
- Report Rate
- The share of recipients who flag a suspicious message to the security team, a stronger signal of readiness than click rate alone.
- Tabletop Exercise
- A discussion-based rehearsal in which leaders work through an incident scenario and record their decisions.
- Baseline Assessment
- A starting measurement of behavior and skill used to show later improvement.
Related
Explore Connected Capabilities
Related services
Platforms
Proof Points
What We Can Stand Behind
- Recognized credentials through PECB (deck, Cyber Academy).
- Every stage of DAAKYI's delivery methodology produces documented, auditable deliverables.
Technology partners
FAQ
Questions Leaders Ask
DAAKYI Intelligence
Ask Kasara About Cyber Academy & Training
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step
Discuss Cyber Academy & Training with DAAKYI
Tell us about your environment and obligations. A DAAKYI specialist for Cyber Academy & Training will respond.
Request training