CyberCoach is a security awareness, privacy and AI skills training platform that runs inside Microsoft Teams, Slack or a web browser. Employees practice role-based skills such as responding to social engineering, ethical and productive use of AI and even secure coding skills in short conversational scenarios. Learning is anonymous, while successful completions are stored so the organization can evidence training completion for compliance frameworks such as ISO/IEC 27001 and SOC 2.

Does CyberCoach do phishing tests?

Yes, but not by sending deceptive emails to employees. CyberCoach uses conversational phishing challenges in which employees practice recognizing and responding to social engineering scenarios in Teams, Slack or the browser. Peer-reviewed research, including Lain et al. (ETH Zurich, 2022 and 2024), finds that traditional email-based simulated phishing does not reduce risk and can increase misplaced trust in the inbox.

Are individual employee answers visible to managers?

No. Learning is anonymous: how an employee answered a training scenario is never visible to managers or administrators. What is recorded is successful completion, so the organization can evidence who has completed required training for compliance purposes. This is privacy by design: the sensitive part of the interaction stays private, and only the completion fact is retained.

Can CyberCoach be used without sharing personal data?

Yes. CyberCoach can be deployed using pseudonymous identifiers, such as Slack or Microsoft UUIDs, so no personal data is shared with CyberCoach. Compliance reporting still works: the mapping between a UUID and a real person is resolved only for authenticated and authorized administrators within the customer's own organization.

Which compliance requirements does CyberCoach support?

CyberCoach supports security awareness and secure development training requirements under ISO/IEC 27001 and SOC 2, and includes assessments covering ISO 27001, GDPR and AI compliance on the Complete plan.

Which languages does CyberCoach support?

CyberCoach is available in English, Spanish, Portuguese (Brazil), Portuguese (Portugal), Polish, French, Dutch, German, Swedish, Norwegian, Danish and Finnish, with more languages in development.

How much does CyberCoach cost?

Plans start at 49 EUR per month for Starter, 159 EUR per month for Advanced and 179 EUR per month for Complete, available monthly or yearly, including through the Microsoft Azure Marketplace.

What is the difference between Secure Coding Practices and Applied Secure Coding?

Both cover the same topics. Secure Coding Practices builds recognition of the common vulnerability classes. Applied Secure Coding takes those topics to senior level with multi-part questions and comprehensive code examples, where several trust boundaries interact, controls are only partly in place, and the learner has to weigh trade-offs and residual risk.

Who is the Applied module for?

Experienced developers, senior engineers, technical leads and security architects who review designs and decide whether they are production-ready.

Does secure coding training satisfy ISO/IEC 27001 or SOC 2?

CyberCoach records successful completions as audit evidence for secure development practice requirements in ISO/IEC 27001 and SOC 2, and covers compliance training such as PCI DSS and HIPAA. Completion is recorded; how an individual answered is not.

Do developers need a separate tool or login?

No. CyberCoach runs as a native Microsoft Teams or Slack app, or in any browser, so training happens in the chat developers already use.

Can skilled developers skip training they already know?

Yes. Skill tests let experienced developers prove competence instead of sitting through mandatory training.

Does CyberCoach cover AI and LLM use in development?

Yes. A role-based developer AI learning path covers LLM basics, efficient development workflows, prompting for code quality, and responsible and safe LLM use — the effective and the safe side together. It also supports the EU AI Act Article 4 AI-literacy duty.

What language is developer training available in?

Developer content is available in English.

Secure coding & AI training for developers

Secure coding training your senior engineers can’t guess their way through.

CyberCoach teaches secure development and effective AI use through short, interactive hands-on scenarios in Microsoft Teams, Slack or the browser.

Start free trial Get a demo

Microsoft Teams

Slack

Any browser

Questions may have code examples in multiple languages. Which one would you prefer?

JavaScript Python Java C#

Topic [1/3]: Applied Secure Error Handling and Fail-Secure Design

You're reviewing error handling and authorization failure behavior for a multi-tenant SaaS API.

The developer states that the design is secure because exceptions are handled centrally, stack traces are hidden in production, and fallback behavior keeps the service available when dependencies fail.

Continue

Considerations:

• exceptions use shared middleware • stack traces are hidden in production • requests receive correlation IDs • read-only requests use fallback behavior during policy-service outages • technical errors are logged for support

You are acting as a senior reviewer responsible for deciding whether the error-handling and failure design is production-ready.

Continue

Open the example as text in a separate window ↗

async def can_read_invoice(request, invoice):
    try:
  decision = await policy_client.check({
      "userId": request.state.user_id,
      "action": "invoice:read",
      "resourceId": invoice.id,
  })
  return decision.allowed
    except Exception as error:
  logger.warning("policy_check_failed", extra={
      "userId": request.state.user_id,
      "error": repr(error),
  })
  # keep read-only workflows available
  return request.method == "GET"

Continue

[1/4] Explain the main security concerns, unsafe assumptions, and what changes are required before this error-handling design would be safe for production use.

Type your answer and send it as a message.

The design fails open: if the policy check errors, GET requests are allowed, assuming read-only requests are safe. It also risks exposing internal errors through responses and logs. Authorization failures should deny by default, client errors should be generic, and logs sanitized.

Analyzing your answer…

✓You identified both security boundaries clearly: what the client learns from errors, and what happens when authorization cannot be verified. Good production-focused fixes. One further idea is to shape external failures consistently, so they don't reveal internal state.

Continue

Seniority levels, same topics

Secure development topic areas

LLM trainings in the developer AI path

New logins for your developers

Two levels of seniority

Same topics. Two very different questions.

Most secure coding training requires completing hours-long labs, or sitting through high level videos with zero impact. CyberCoach is the only platform to deliver hands-on developer training with real impact that scales from small teams to enterprise.

Core level

Secure Coding Practices

Recognize the vulnerability classes that keep reappearing in real code reviews — injection, broken access control, weak crypto use, unsafe file handling — and learn the practice that removes each one. For developers, testers, DevOps and anyone shipping to production.

→Short interactive challenges, answered in your own words
→Immediate, contextual feedback — guessing gets you nowhere
→Skill tests to fast-track experienced developers

New · Applied level

Applied Secure Coding Practices

The same topics at senior level. Multi-part questions built on comprehensive code examples, where several trust boundaries interact, the controls are only partly in place, and the right answer depends on trade-offs. Learners trace attack paths, name the residual risk, design the secure architecture, and review remediations that don’t quite hold.

→Written for senior engineers, tech leads and security architects
→Mirrors real code reviews, architecture reviews and security engineering work
→Judgment under partial information, not rule recall

The topic map

Thirteen topic areas, grouped the way engineers think about them.

Aligned with ISO/IEC 27001 secure development expectations and going well beyond the OWASP Top 10. Every area exists at both levels.

01 · Data and input handling

Input validation
Output encoding
Error handling and logging
Database security
File management

02 · Identity and access

Authentication and password management
Session management
Access control

03 · System and infrastructure

Cryptographic practices
Data protection
Communications security
System configuration
General coding practices

AI training for developers

Your developers already code with LLMs. Teach them to do it well.

A role-based learning path that treats effectiveness and safety as the same lesson: better prompts and better review, next to what may never leave your codebase. Assign it as a module, or let developers work through it at their own pace.

01LLM basics for developers
02Efficient development workflows
03Prompting for code quality
04Responsible LLM use in development
05Safe LLM use in development

Completions also serve as evidence for the EU AI Act Article 4 AI-literacy obligation, in force since February 2025.

Try the developer AI trainings

An LLM basics for developers challenge running inside a chat window

How it runs

Minutes of their time. In the chat they already have open.

Step 01

It’s already installed

A native Teams or Slack app, or any browser. No new system, no account provisioning, no separate developer tool.

Step 02

Fast-track the people who know

Skill tests let strong developers prove competence instead of sitting through mandatory modules. Nothing drives engagement harder.

Step 03

They reason, not click

Answers are written in their own words against a real scenario, with feedback while it’s still live in their head.

Step 04

You get audit evidence

Completions are recorded for ISO/IEC 27001, SOC 2, PCI DSS and HIPAA. How someone answered never is.

“I wonder if these new applied exercises will be too difficult for our customers.”

Anonymous content team member at CyberCoach

Flat fee packages starting from the price of a coffee cup per developer per month.

Everything in the tech track: secure coding at both levels, the developer AI path, assessments and your own content.

✓Secure Coding Practices — core level
✓Applied Secure Coding Practices — senior level
✓Developer AI and LLM learning path
✓DevSecOps trainings and skill tests
✓Assessments (ISO 27001, GDPR, AI compliance)
✓Compliance training (PCI DSS, HIPAA)
✓Create your own content with AI assistance
✓Set-up support and a 30-min kick-off call

Get started free Get a demo

FAQ

What technical and compliance teams ask

What is the difference between the core and applied secure coding modules?

The core module builds recognition of common vulnerabilities, intended as a baseline for all developers. Applied asks multi-part questions on comprehensive code examples, intended for senior developers and architects.

Who should take the applied module?

Experienced developers, senior engineers, technical leads and security architects — the people who sign off designs.

Does this satisfy ISO/IEC 27001 or SOC 2 secure development requirements?

Completions are recorded as audit evidence for secure development practice requirements, alongside compliance training such as PCI DSS and HIPAA.

Will developers actually do it?

Yes, but you need to ensure it becomes part of the way your teams work. It lives in Teams or Slack, takes minutes, and skill tests let the strongest engineers test out instead of sitting through content they know. We've done everything we can to lower the barrier and make the training useful for different skill levels.

Does it cover AI and LLM use in development?

Yes — an evolving developer AI path covering LLM basics, development workflows, prompting for code quality, and responsible and safe use, which also evidences the EU AI Act Article 4 literacy duty.

What language is developer content in?

English.

What programming languages are the secure coding exercises in?

Python, C#, Java and JavaScript.

See it in your own Teams or Slack

Start a free trial in minutes, or take 15–30 minutes with us to check CyberCoach against your secure development and compliance requirements.

Start free trial Get a demo

No credit card needed

CyberCoach at a glance

The Science Behind CyberCoach

Is Phishing Simulation Legal Under GDPR?

Pricing

Blog

Customer Stories

OT Security Training

AI Training

AI Security Training

EU AI Act Training Requirements: What You Actually Have To Do

For Developers

Secure Coding Skills

About us

About Us

Contact Us

Careers

Partner with us

Secure coding training your senior engineers can’t guess their way through.

Same topics. Two very different questions.

Secure Coding Practices

Applied Secure Coding Practices

Thirteen topic areas, grouped the way engineers think about them.

Your developers already code with LLMs. Teach them to do it well.

Minutes of their time. In the chat they already have open.

It’s already installed

Fast-track the people who know

They reason, not click

You get audit evidence

Flat fee packages starting from the price of a coffee cup per developer per month.

What technical and compliance teams ask

What is the difference between the core and applied secure coding modules?

Who should take the applied module?

Does this satisfy ISO/IEC 27001 or SOC 2 secure development requirements?

Will developers actually do it?

Does it cover AI and LLM use in development?

What language is developer content in?

What programming languages are the secure coding exercises in?

See it in your own Teams or Slack

Get the Demo Video instead