Learn Dark Web

Learning Path

Cybersecurity Awareness Path

Most cyberattacks do not start with a clever break-in. They start with an ordinary-looking message, a download that seems harmless, or a moment of hurry. This path teaches you to recognise the common attacks, understand what they are trying to do, and know the first steps to take when something goes wrong — in plain English, with no technical background assumed.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

How this path works. Each lesson below is a short summary written for this path, with a link to the full guide. Work through them in order, mark each one complete when you have read the guide, and test yourself with the quiz at the end. Your progress is stored only in your own browser — no account, nothing sent to us. This path teaches understanding, not credentials: completing it does not give you a certificate and does not qualify you for a job.

What you will learn

This path is for everyone who uses email, shops or banks online. It assumes no technical knowledge at all — only that you have received a suspicious message at some point and wondered whether it was real.

  • Explain what phishing, malware, ransomware and cybercrime are, in your own words.
  • Spot the red flags in a suspicious email, text or website before you click.
  • Know exactly what to do in the first minutes after clicking a bad link.
  • Tell the difference between a real warning and a scare tactic designed to rush you.
  • Know where to report an attack, and what information to keep.

Your progress

0 of 7 lessons complete.

The lessons

Read each lesson summary, then open the full guide it links to. The summaries are written for this path — they do not repeat the guides, they prepare you for them.

Lesson 1: What phishing is, and why it works

Phishing is a message that pretends to be from someone you trust — a bank, a delivery company, a colleague — in order to get you to click a link, open an attachment, or hand over a password. It works because it borrows trust: the message looks like something you already expect, arrives at a plausible moment, and asks for something small. The attacker does not need to break any security system if you open the door yourself.

This lesson explains the main forms phishing takes — email, text message, phone call, and fake websites — and why the old advice to look for bad spelling no longer protects you. Modern phishing is often written cleanly, sometimes with the help of AI, and can copy real message formats closely. What still gives it away is the mismatch: a sender address that is almost but not quite right, a link that leads somewhere unexpected, or pressure to act before you have time to think.

Read the full guide: What is phishing?

Lesson 2: How to spot a phishing email

A phishing email usually leaves traces, even when it looks polished. This lesson walks through the checks that matter most: read the sender's full address, not just the display name; hover over links to see where they really lead; look for urgency that exists only to stop you thinking; and be suspicious of any message that asks you to log in, pay, or confirm details through a link.

You will also learn which old warning signs no longer apply. Bad grammar was once a reliable tell, but AI-written messages are now grammatically clean, so a polished message proves nothing at all. A padlock icon only means the connection is encrypted, not that the site is honest. The reliable habit is a different one: if a message claims to be from a company you use, go to that company's app or type its address yourself, and check there — never through the link in the message.

Read the full guide: How to spot a phishing email

Lesson 3: You clicked a phishing link — now what?

Clicking a suspicious link is not the end of the story, and it does not mean you have already been harmed. What matters is what happens next, and the order you do it in. This lesson gives you a calm sequence: stop, do not enter anything, close the page, and then work out what actually happened — did you only open a page, did you download a file, or did you type in a password?

Each situation has a different next step. A page you only opened is usually low risk, but a downloaded file should not be opened, and a password you entered should be changed — along with every other account that reused it — with two-factor authentication turned on. This lesson also explains when to contact your bank, how to report the message, and why telling someone quickly is a strength, not something to be embarrassed about.

Read the full guide: What to do if you clicked a phishing link

Lesson 4: Malware: the signs to watch for

Malware is software designed to harm your computer or steal from you, and it usually arrives disguised as something useful: a free download, an attachment, or a pop-up warning that your computer is infected. This lesson explains the main types — viruses, spyware, and programs that quietly watch what you type — and the signs that something may be wrong: sudden slowness, unfamiliar programs, pop-ups you did not ask for, or a battery that drains far faster than usual.

Crucially, it also explains why most of those signs have innocent causes. A slow computer is usually just an old computer, not an infection, and a new program may simply be an update you forgot you installed. So this lesson teaches a proportionate response: keep your software updated, use a reputable security program, be careful about what you download, and know when the right move is to ask a professional for help rather than downloading a cleaner advertised in a pop-up.

Read the full guide: Malware awareness

Lesson 5: Ransomware, simply explained

Ransomware is malware that locks your files or your whole computer and demands payment to unlock them. This lesson explains how it usually arrives — most often through a phishing email or an unpatched program — what happens once it runs, and why the newer double-extortion variant also threatens to publish stolen data, not just lock it.

The lesson also answers the hardest question: should you pay? The official guidance is consistent — paying does not guarantee you get your files back, and it funds further attacks. Backups are the defence that works even when every other defence has failed, which is why this lesson returns to them again at the end. Instead, this lesson walks through what to do instead: disconnect the device, do not pay, restore from a backup if you have one, and report the incident to the authorities. And it shows which single habit prevents most ransomware damage: regular backups kept separate from your computer.

Read the full guide: What is ransomware?

Lesson 6: How to recognise an online scam

Online scams come in many shapes — fake shops, investment promises, romance scams, and messages about parcels you never ordered — but they share a structure. This lesson teaches that structure: an attractive offer, a reason to trust it quickly, pressure to act now, and a payment method that is hard to reverse. Once you can see the structure, new scams become easier to recognise even when you have never seen that exact trick before.

You will practise spotting the red flags in realistic, fictional examples: prices far below every other seller, guaranteed returns on an investment, a seller who only accepts gift cards or wire transfers, and a story that needs secrecy — each one paired with the safe response you should use instead. The lesson ends with a simple rule that protects you in almost every case: pause, check the claim through a channel you trust, and never send money to someone you have only met through a message.

Read the full guide: How to recognize online scams

Lesson 7: What cybercrime actually covers

Cybercrime is not one crime but a family of them, and this lesson maps the family: crimes that attack computers, crimes that use computers to attack people, and crimes where the computer is only the tool. Phishing, ransomware, identity theft, online fraud and the sale of stolen data all sit in different branches — and each has a different recovery path, which is why knowing the type matters.

This lesson uses confirmed, publicly reported cases as examples, and explains what each one teaches: that most victims are ordinary people rather than careless ones, that reporting helps the next victim even when it cannot undo the loss, and that recovery is usually a sequence of practical steps — secure the account, tell the bank, change the passwords, report it — rather than a single fix. It finishes by connecting cybercrime to the rest of this site: the threat intelligence path explains how professionals study these same crimes.

Read the full guide: What is cybercrime?

Try the tools

These free tools let you practise what the lessons describe — everything runs in your browser, and nothing you type is sent anywhere.

Check what you learned

Four questions, all based on fictional scenarios. Answer them all, then check your score — each answer explains itself, so a wrong answer teaches as much as a right one.

Answer all four questions, then check your score.

Download your notes

Download a plain-text summary of this path: the lesson list, which lessons you marked complete, and your quiz score. The file is generated on your device — nothing is uploaded.

Key terms in this path

The glossary defines every term this path uses: phishing, malware, ransomware, social engineering. If a lesson uses a word you do not know, look it up there — each term page also explains the idea with an example.

Frequently asked questions

Do I need any technical knowledge to start this path?

No. This path starts from zero and explains every term when it first appears. If you can use email and a web browser, you can follow it — and the glossary defines any word you do not know yet.

Will completing this path make me safe from all scams?

No, and any course that promised that would be misleading you. What this path gives you is a reliable habit — pause, check the sender and the link, verify through a channel you trust — that defeats most common attacks. Some attacks are hard to spot by reading alone, which is why the path also teaches what to do after something goes wrong.

How long does this path take?

Each lesson is a short summary linked to a full guide. Most readers finish the path in a few sittings over a week. You do not need to do it in one go — your progress is saved on your own device, and you can return to any lesson at any time.

What should I do if I have already been scammed?

Act in this order: secure your accounts first (change passwords, turn on two-factor authentication), then contact your bank if money was involved, then report the scam to the official reporting route in your country. The clicked-a-phishing-link lesson in this path walks through the steps for each situation.

Is this path a qualification for a cybersecurity job?

No. This path teaches everyday awareness, not professional skills, and completing it does not qualify you for a job or replace formal training. If you want to explore cybersecurity work honestly, the threat intelligence path explains how the field is studied, and the research library covers careers without hype.