Global

Malware and ransomware: How infections spread and what to do

A ready-made course you customise for your organisation, with a live session deck and two surveys. You only add the 7 details that are specific to your organisation.

See the live deckSee the full outline
Try the coursePreview the survey
Length
30 min
Lessons
6 lessons
Frequency
At onboarding and in the annual refresher
Last reviewed
21 Oct 2026
Safe habits
What would you do?

You find a USB drive in the car park labelled "salaries"

Try it: this is one of 20 interactive activities in the course.

What's included

Three pieces that work together

Copy once, get everything. Learners prepare on their own, you answer questions live, and the surveys tell you what stuck.

Self-paced course

Short lessons with real workplace scenarios, not walls of text.

  • 6 lessons, about 30 minutes
  • Accordion, sorting activity, process, scenario and quizzes

Live session deck

An AhaSlides presentation to run after the course, in person or online.

  • 10 slides
  • Quiz, poll, word cloud, scale slides
  • A closing slide for your contacts

Two surveys

Find out what landed, and whether people use it on the job.

  • Post-course feedback, about 2 minutes
  • 30-day check-in
  • Anonymous by default
  • Results feed your next refresher

Learning objectives

At the end of this course, learners can

Each objective and the lesson that covers it.

IDObjectiveSourceWhere it's covered
TO 206.0Achieve ≥ 80% on the final assessment-Whole course
SO 206.1Explain how malware and ransomware reach a deviceBest practiceWhole course
SO 206.2Avoid risky downloads, attachments and removable mediaOrganisation's acceptable use policyWhole course
SO 206.3Recognise signs of infection and act within minutesBest practiceWhole course
SO 206.4Know why backups and updates protect the organisation + your infoOrganisation's backup and patch policyWhole course
SO 206.5Report and stay calm during a ransomware event + your infoOrganisation's incident routeWhole course

Your part: what a template can't do for you

  • Your workplace details: fill in the 7 highlighted fields so the course describes your own policies, contacts and locations.
  • Records: record completion in your own LMS or record system.

Course outline

6 lessons, about 30 minutes

Minutes per lesson are an estimate, shared out by page count.

ContentInteractiveVideoYou customise
1

How infections start

3 pages

6 min
Before you beginNoteList
The free fontTextImage
How did it start?ChecklistKey factQuiz
2

Ways in

3 pages

5 min
Common routesTabs
What it doesAccordion
CheckSorting activityMatching quiz
3

Safe habits

3 pages

5 min
HabitsProcessYour info
Backups and updatesAccordion
Try itScenarioQuiz
4

Spotting the signs

3 pages

5 min
SignsAccordion
First minutesProcess
CheckSorting activityMulti-select quiz
5

Grey areas: pressure and payment

3 pages

5 min
Pressure tacticsTabs
What would you do?Scenario
CheckSorting activityQuiz
6

Your checklist and the final assessment

2 pages

4 min
Next stepsProcessYour infoYour info
PracticeQuizKey factNoteButtonYour info

Live deck and surveys

10 slides to run live, two surveys to close the loop

Pink slides are interactive. Both surveys are anonymous; pink questions are written for this course.

ContentTitle, agenda, "most infections start with a click
PollHave you seen a strange pop-up at work?
Word cloudA risky download you almost made
ContentWays in and signs
QuizA found USB drive should be… Handed to security unplugged ✔ · Checked at your desk · Taken home · Plugged in once
QuizYour files cannot be opened and a note appears. First step? (Report at once ✔)
ScaleHow sure are you what to do in a ransomware event?
Content · customiseReport route
Open-ended / Q&AA risky habit you want to change
Content · customiseClosing {{INCIDENT_REPORT_ROUTE}}, {{SURVEY_1_URL}}, {{SURVEY_2_URL}}, {{COURSE_URL}}
Post-course feedback: 11 questions, about 2 min
  1. Overall rating 5 stars
  2. Relevant, realistic, right length, helpful activities agree/disagree grid
  3. What was most useful? multi-select
  4. Confidence before this course, and now 1-5 scale
  5. Which habit will you start? multiple choice
  6. How confident are you in the first minutes of an infection? 1-5 scale
  7. Which course should come next? ranking
  8. I would feel safe reporting an infection. 1-5 scale
  9. One thing we should change or add open text
  10. Would you recommend this course? NPS
30-day check-in
  1. Have you used what you learned since the course? multiple choice
  2. How confident are you today? Compare with day 1 1-5 scale
  3. Do you know where to find the report route? yes / no / not sure
  4. A moment where the training helped, or where you weren't sure open text
  5. Which topics should the next refresher focus on? ranking

Results show whether people use the training on the job, not just whether they finished it.

Make it yours

7 fields to fill in, and you're ready

Everything else is done. These are the details only your organisation knows; each one is highlighted inside the course.

  • The route for reporting a security incident or suspected breach, and the time limit that applies{{INCIDENT_REPORT_ROUTE}}
  • Link to the list of approved tools and services{{APPROVED_TOOLS_LIST}}
  • Link to the next course in your security awareness path{{NEXT_COURSE_LINK}}
  • Where course completions are recorded{{LMS_OR_RECORD_SYSTEM}}
  • Link to the self-paced course{{COURSE_URL}}
  • Link to the baseline survey{{SURVEY_1_URL}}
Show all 7 fields
  • Link to the post-course and 30-day survey{{SURVEY_2_URL}}

FAQ

Common questions

Can I run malware and ransomware: How infections spread and what to do training online?

Yes. The course is self-paced and online, and the live deck lets you add a live session in the room or online.

How often is this training needed?

At onboarding and in the annual refresher.

Who needs this training?

All employees, with an IT help desk variant as a note; run by L&D with IT.

What records should I keep?

Record completion in your own LMS or record system, so you can show who finished the course and when.

Can I edit the content?

Yes, everything. Change the wording, swap scenarios for ones from your workplace, add your logo, or remove parts that don't apply.

Related templates

Often taught together

All Security Awareness Training templates →
US federalRequired by law

Security awareness essentials

All employees and contractors · Security Awareness Training

35 min
US federal

Phishing & social engineering

All employees · Security Awareness Training

30 min
GlobalHands-on practical

PCI DSS awareness for card-handling staff

Retail cashiers · Security Awareness Training

25 min
CaliforniaRequired by law

California consumer privacy (CCPA/CPRA)

Customer service · Security Awareness Training

35 min
Last reviewed: 21 October 2026Templates are a starting point, not legal advice.

Ready to run it?

Open the live deck to see how the session runs alongside the course and both surveys.

See the live deck