Security Training Buyer's Guide

Every RansomLeak exercise is an interactive 3D simulation. Employees make decisions under pressure inside a scenario instead of watching a video about one, and a wrong choice plays out to its consequence.

That is what builds recall weeks later. Organizations report completion rates above 90% because people finish something they are actually playing.

The microlearning drills run the same mechanic in five to ten minutes for staff who cannot stop for a full course. Every exercise in the catalogue is free to play with no sign-up, so you can test the format before you talk to sales.

The catalogue spans 200+ exercises, from security awareness and privacy and compliance to real-world incident case studies.

AI and LLM Security carries three dedicated courses: the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications, and the OWASP MCP Top 10. Between them they cover prompt injection, agent goal hijacking, tool exploitation, memory poisoning, and cascading failures across multi-agent systems.

Technical staff get the same hands-on format in the developer track, which is live now: Application Security on the OWASP Top 10 for web, API Security, Git and Repository Security, and Cloud Security.

RansomLeak maps exercises to thirteen frameworks with specific control references: SOC 2, ISO 27001, ISO 27701, NIST CSF 2.0, GDPR, the EU AI Act, CCPA / CPRA, HIPAA, HITRUST CSF, PCI DSS, NIS2, DORA, and CMMC Level 1.

The mapping is visible per exercise, not just in a sales deck. Every catalogue card shows the MITRE ATT&CK techniques, CWE weaknesses, CIS Controls, and NIST CSF functions that exercise covers.

The analytics dashboard generates completion reports with timestamps, scores, and department breakdowns that auditors accept as training evidence. Framework deep dives sit in the compliance guides, including SOC 2, ISO 27001, HIPAA, and the EU AI Act.

Every exercise exports as a SCORM 1.2 or 2004 package, compatible with Cornerstone, SAP SuccessFactors, Workday, Moodle, and Canvas.

LTI 1.3 is the newer path, with deep linking, grade passback, and roster sync, so content stays current in your LMS without re-uploading a package each release. Step-by-step guides cover Moodle and Canvas.

Organizations without an LMS run the built-in cloud LMS, with SSO, learning paths, and certificates included.

Hosting is a choice, not a constraint. The Cloud LMS runs in a US or EU region you pick at sign-up, and a dedicated single-tenant private cloud is available in the region you choose. An on-premises edition runs as containers on your own Kubernetes or Docker hosts, including air-gapped networks.

Phishing simulations deliver through direct mailbox injection using the Microsoft 365 Graph API or the Google Workspace API, so a campaign is never eaten by your own perimeter filter.

Reporter buttons capture what employees actually do, and the funnel is measured end to end: delivered, opened, clicked, credentials submitted, reported, and how long the report took. Anyone who fails lands on a teaching page that names the red flags, not a scolding.

Smishing simulations run the same campaign model over SMS. Vishing ships today as an in-browser drill, with outbound voice campaigns still in development, and we say so rather than selling a roadmap.

Every employee carries a human risk score from 0 to 100, calculated from what they did in real simulations rather than from a quiz they passed once.

The score is explainable, so you can show a person which events moved it and by how much. Risk-based automation then enrolls the people the score flags, without an analyst rebuilding a spreadsheet every quarter.

The next campaign re-tests the same people. That loop is what turns a training budget into a number your board can watch fall.

The dashboard tracks completion rates, average scores, time spent, and knowledge gaps in real time. Filter by department, team, or individual.

Export reports as PDF or CSV for board presentations and audit submissions. Certificates and learning-path progress export with them.

The same events also stream out over signed webhooks, so training and human-risk data can sit next to the signals your SOC already watches in Grafana, Datadog, New Relic, or your SIEM.

RansomLeak ships new training content every month, and whole categories land as the attack surface shifts. The OWASP MCP Top 10 course and the four developer-track categories are both recent additions.

When a major incident makes headlines, like the MGM Resorts breach, a case-study exercise follows within weeks.

What we track is documented in public rather than promised in a roadmap deck. The threat guides cover phishing, smishing, vishing, business email compromise, ransomware, deepfakes, social engineering, and prompt injection.

RansomLeak supports branded training portals and custom learning paths assigned by team, department, or role.

The content team builds industry-specific exercises on request, folding your actual policies and compliance requirements into the scenarios.

Sector-specific starting points already exist for ten industries and ten programme use cases, from employee onboarding to M&A due diligence and LMS migration.

SAML 2.0 and OIDC single sign-on with SCIM provisioning, so joiners and leavers sync without a manual CSV. Setup guides cover Okta, Microsoft Entra ID, and Duo.

New hires can also be provisioned straight from your HR system. Merge connects 80+ HRIS platforms through one integration.

Everything else runs on a token-authenticated REST API and HMAC-signed webhooks: assign training from Jira Service Management or PagerDuty, and post live completion evidence to Vanta and Drata.

Points and badges for exercise completion, with team leaderboards that turn a compliance chore into friendly competition.

A TalentLMS survey found 83% of employees feel more motivated by gamified training, and gamified programmes see 3x higher completion than standard compliance modules.

Progress, badges, and certificates stay visible to each employee, so people can see where they stand without a manager chasing them.

RansomLeak was founded by the creator of Kontra Application Security Training, which is why the developer track reads like it was written by people who have shipped secure-coding content before.

Support responds within one business day, with priority SLA options for enterprise customers. Onboarding runs in days, not quarters.

Every exercise in the catalogue is free to play with no sign-up, so an evaluation starts with your team using the product rather than watching a sandbox demo.