Teach people to protect themselves. The organization is what improves.
Security awareness training asks people to care about the company's data. This does the opposite. It teaches a person how they personally are found, followed, and social engineered, and the organization gets safer as a consequence rather than as an appeal.
Information security spending is on its way from roughly 183 billion dollars a year to something near 292 billion, and digital footprint management does not appear as a line on that chart. Meanwhile the overwhelming majority of breaches are facilitated through employees who are already inside the perimeter, reached by social engineering. Social engineering runs on personal information about the target, and that information is bought from brokers and lifted from breach corpora. The perimeter now runs through people, and nobody is funding that part of it.
Moves the Posture variable · Individuals, households, and organizations · Complimentary session for organizational clients
The motivation is the mechanism.
This is the one finding from our own fieldwork that changed how we teach. It is also the reason a session lands where compliance training does not.
Standard awareness training is built on an appeal to duty. Do not click the link, because the company would suffer. People sit through it, pass the quiz, and click the link three weeks later, because the company's exposure is an abstraction and their afternoon is not.
When the same person is shown how their own home address, their family's routine, and their own reused credentials are already purchasable, the abstraction disappears. They are not being asked to protect an employer. They are being shown a problem they already have.
The organizational benefit arrives second, and it arrives reliably. Someone who has just understood how a pretext call is assembled against them personally is a different person on the phone the following week. The habits are the same habits. Only the reason for adopting them has changed.
Privacy is both a personal shield and an organizational safeguard. Every session opens with that framing because it is the load-bearing claim, not a nicety.
Six modules, and what is in them.
This is the default curriculum. Modules are added or dropped to fit an audience, and the framing is set to the mission of the organization rather than delivered from a template.
Why privacy matters
The groundwork. Without it the rest reads as a list of chores.
- A short history of privacy and what it was for
- Why it underwrites democratic and organizational trust
- The personal shield and organizational safeguard framing
Commercial surveillance 101
Who is collecting, who is buying, and why the law does not stop it.
- Data brokers, ad tech, and the breach economy
- Where regulation is weak and where it is absent
- What that means for an employee specifically
Location privacy and inference risk
The module people remember, because it is the one they can feel.
- How apps, cars, and license plate readers track a person
- Why anonymized location is not anonymous
- What a location history reveals about health, finances, religion, and politics
Data deletion and leak prevention
Audit, then wipe, then keep it down. Removal is a process, not a click.
- Building an audit and wipe strategy
- Stopping leaks from phones, cars, televisions, and connected devices
- Why records repopulate and what maintaining actually costs
Five core moves for everyday privacy
The practical hour. Everyone leaves having changed something.
- Secure communications across messaging, email, and phones
- Protecting financial data
- Browsing safely: private browsers, VPNs, DNS
- Managing apps and permissions
- Smarter passwords and identity practices
Password safety and the EchoKey method
Our own approach to passphrases people can actually remember.
- Building a strong, memorable passphrase
- Demonstrating why length beats complexity, exponentially
Three formats, one curriculum.
Sessions run virtual or in person, from a single workshop to a standing annual partnership. Content is the same; the depth of discussion is what changes with the size of the room.
One to one
A client, or a client and spouse, working through their own situation rather than a generic one. Devices are handled in the session.
One or two peopleSmall group
A household including staff, a family across generations, or a small team. Small enough that people will say out loud what they are actually worried about.
Up to eightOrganizational seminar
A workforce, a security team, a wealth management team, or a board. Curriculum and framing tailored to the mission, the stack, and the threat profile.
No participant capA complimentary session
Organizational clients get one session covering the standard package, open to every employee, including people not individually covered by the program.
Focused modules
Secure communications, device privacy, or location privacy expanded into a session of its own where an audience needs the depth.
Advanced scenarios
Tactical case studies, breach response walkthroughs, and red team observations for audiences already past the basics.
Straightforward modifications are included. Newly developed modules are quoted separately.
What training cannot do.
Training is the supplemental practice, not the program, and the model we publish says so with numbers.
It does not reach records anyone else holds
Habits govern what is emitted from here on. They do nothing about the broker records, breach corpora, and public filings that already exist. That is Exposure, it is a removal problem, and it is the wider lever of the two.
Its returns diminish, and quickly
On the Threat Surface Index, Posture pays fast at first and then flattens. Moving a typical household to a well coached one is worth real points. The distance from well coached to perfect is worth very few, and no household sustains perfect anyway.
It is not a compliance deliverable
Nothing here certifies anything to anyone. If the requirement is a checkbox and a completion certificate, a compliance vendor will serve you better and cheaper.
It does not survive on its own
A session raises a workforce for a while and then the intake of new people and new devices erodes it. The organizations that hold the gain run it on a cadence rather than once.
Bring us the room, and who is in it.
Scoped to you. Training is included with organizational programs and available on its own.
A short call establishes who the audience is, what they already know, and what the organization is actually worried about. The framing is built from that rather than delivered from a deck.
Where a household is in scope, the session usually covers the people who hold access as well as the client, because that is where the shortest path runs.
- Phone
- 855.76.ERASE
- info@obscureiq.com
- Counsel
- Introductions on request
- Handling
- Encrypted intake. Off the record by default.