# Manager Security Moments Refresher Mini-Course A free, reviewable cybersecurity awareness course package for helping managers reinforce practical security decisions during team work, approvals, vendor requests, AI use, and reporting. Use this package as a starter asset. Review and adapt it against your own policies, reporting channels, systems, role expectations, and legal/compliance requirements before assigning it to learners. ## Course overview **Audience:** People managers, team leads, department heads, operations managers, client-service leaders, MSP client managers, and supervisors who influence day-to-day security decisions. **Duration:** 6 to 8 minutes. **Format:** Short lesson, three workplace scenarios, three quiz questions with teaching feedback, remediation note, LMS packaging guidance, and a AI Studio by Jericho prompt. **Learning objective:** Managers will be able to identify common security moments in team workflows, slow down risky shortcuts, and route questions through approved verification or reporting paths. **Not a promise:** This course does not guarantee compliance, prevent incidents, or prove secure behavior. It supports awareness, policy communication, and reviewed training workflows when adapted and approved by the organization. ## Lesson script Managers shape security culture in small moments. Not with posters. Not with speeches. With the way they handle pressure, exceptions, shortcuts, and uncertainty. A team member receives an urgent vendor request. Someone asks whether they can paste customer details into an AI tool to save time. Finance gets a payment-change email. A new hire is unsure where a sensitive file belongs. A contractor asks for access before the ticket is complete. These are not abstract security topics. They are management moments. The manager's job is not to become the security department. The job is to make the safe path easier to choose. That means asking a few practical questions: - Does this request match our normal process? - Is this information sensitive, regulated, customer-owned, controlled, confidential, or proprietary? - Are we using an approved system, account, and sharing method? - Is urgency being used to bypass review? - Do we know the approved verification or reporting path? When the answer is unclear, the safest next step is usually not to improvise. Pause. Verify through a known channel. Use the approved tool. Ask the owner. Report the suspicious message. Document the exception if your process requires it. Managers also influence how people feel about reporting. If employees expect blame, they wait. If employees expect help, they ask sooner. A useful security culture makes it normal to say, “I am not sure this is safe. Can we check?” Security decisions often show up during operational pressure: month-end close, customer escalations, proposal deadlines, incident response, audits, onboarding, travel, system outages, and vendor transitions. Attackers understand timing. So do rushed employees. That is why the manager response matters. Good manager reinforcement is specific. Instead of saying “be careful,” say “do not approve payment changes from email alone; use the approved vendor-change process.” Instead of saying “AI is risky,” say “use the approved AI tool and do not enter restricted data unless policy allows it.” Instead of saying “report phishing,” say “use the report button or send it to [APPROVED REPORTING CHANNEL].” The practical habit is simple: when a request touches money, access, customer data, employee data, controlled information, confidential material, AI tools, or a process exception, slow down and use the approved path. ## Scenario 1: The urgent vendor exception A team member forwards a vendor email to their manager. The vendor says their payment details changed and asks the team to update the account before today’s payment run. The sender looks familiar, and the request sounds urgent. **Manager coaching point:** Do not approve the change from email alone. Use the approved vendor-change verification workflow. Confirm through a known contact method, not the contact details in the message. If the request does not match normal process, report it. **Teaching line:** Urgency plus money plus process change is a security moment. ## Scenario 2: The helpful AI shortcut A team lead wants to paste customer support tickets into a public AI tool to summarize the top complaint themes for the week. They plan to remove names but leave account details and message text because the summary will be better. **Manager coaching point:** Check the approved AI policy and tool list before entering work data. Do not enter customer, employee, confidential, regulated, controlled, proprietary, or security-sensitive data into unapproved AI tools. If the team needs analysis, use the approved workflow or ask the data owner. **Teaching line:** A useful shortcut still needs to respect data handling rules. ## Scenario 3: The access workaround A contractor is blocked from a shared workspace before a customer deadline. A team member asks the manager if they can share their own login temporarily so the contractor can finish the work. **Manager coaching point:** Do not share accounts or credentials. Confirm the contractor’s access request through the approved identity, ticketing, or project process. Escalate the business urgency without bypassing the control. **Teaching line:** Access pressure is real. Shared credentials make accountability and review harder. ## Quiz questions ### Question 1 A vendor asks for payment details to be changed by email before close of business. What should a manager reinforce? A. Approve it if the sender is familiar. B. Forward it to finance and ask them to hurry. C. Use the approved vendor-change verification process and report anything unusual. D. Reply asking the vendor to confirm the details in the same email thread. **Correct answer:** C **Teaching feedback:** Payment-change requests should follow the approved verification workflow. Email threads can be compromised or spoofed. Use a known channel and report suspicious or uncertain requests. ### Question 2 A team wants to use a new AI tool with customer or internal data. What is the best manager response? A. Allow it if the data will save time. B. Check whether the tool and data use are approved before any upload. C. Tell the team to remove names and proceed. D. Let each employee decide based on judgment. **Correct answer:** B **Teaching feedback:** AI use needs tool approval and data approval. Removing names may not remove sensitive context. Use approved systems and policy guidance before entering work data. ### Question 3 A deadline is at risk because a contractor lacks access. What should the manager do? A. Let an employee share credentials for one day. B. Send files to a personal account. C. Use the approved access process and escalate the urgency if needed. D. Create a shared password for the project. **Correct answer:** C **Teaching feedback:** Business urgency should be escalated through the process, not solved with shared credentials or unapproved sharing. The goal is to help the work move while preserving accountability and review. ## Remediation note If this course follows a phishing simulation, audit finding, AI-policy rollout, or access-control reminder, use the remediation message below: > This refresher is not about blame. It is about the moments where managers can help the team choose the approved path under pressure. If a request involves money, access, sensitive information, AI tools, or an exception, pause and verify through the process your organization provides. ## LMS packaging guidance - **Suggested title:** Manager Security Moments: Approvals, AI, Vendors, and Access - **Estimated seat time:** 6 to 8 minutes - **Completion standard:** View lesson and answer quiz questions - **Recommended refresh trigger:** New manager onboarding, annual refresher, AI policy rollout, vendor-payment incident, access-control finding, phishing simulation theme, or client onboarding for MSP/vCISO programs - **Accessibility notes:** Include captions/transcript for video or voiceover versions. Keep examples plain-language and avoid color-only cues. - **Export notes:** Package for your LMS using the format your environment supports, such as SCORM, xAPI, HTML, or PDF, after human review. ## Review checklist Before assigning this course, confirm: - Vendor-payment verification language matches your approved workflow. - AI tool and restricted-data examples match your policy. - Access and contractor examples match your identity/access process. - Reporting channel placeholders are replaced. - Legal, privacy, compliance, security, and L&D owners review sensitive wording where needed. - The course does not promise compliance, breach prevention, or guaranteed behavior change. ## AI Studio by Jericho prompt Use this prompt to recreate or adapt the course in AI Studio by Jericho: > Create a 6 to 8 minute cybersecurity awareness mini-course for managers called “Manager Security Moments: Approvals, AI, Vendors, and Access.” The lesson should teach managers how to reinforce approved paths when requests involve vendor payment changes, AI tool use, sensitive data, access requests, contractors, or process exceptions. Include three workplace scenarios, three quiz questions with teaching feedback, a remediation note, captions/transcript guidance, LMS packaging notes, and a review checklist. Use plain language, avoid fearmongering, avoid legal advice, and mark assumptions that require security, privacy, legal/compliance, finance, identity/access, or L&D review. ## How to adapt it - For finance managers: emphasize vendor payment changes, invoice fraud, and approval workflows. - For customer-facing managers: emphasize customer data, AI use, file sharing, and escalation. - For engineering or IT managers: emphasize access requests, secrets, repositories, logs, and approved tools. - For MSP or vCISO clients: replace placeholders with each client’s reporting channel, approved AI tools, access process, and review owners. - For regulated or government-contractor environments: route CUI, FCI, CDI, export-controlled, privacy, contractual, or regulated-data language through the appropriate compliance/legal review before publishing.