Cybersecurity area
SAT
SAT, or Security Awareness Training, improves user readiness and reduces risks from phishing, social engineering, fraud, and unsafe behavior.
Acronym Glossary
This glossary explains acronyms used in this part so the intended security function is clear.
- SAT
- Security Awareness TrainingUser security education focused on phishing, social engineering, and risky behavior.
What This Area Covers
SAT covers user security training, phishing simulations, and risk management related to human behavior. It is not only a formal training requirement, but an ongoing effort to build the ability to recognize risk, report suspicious situations, and respond correctly.
Why It Matters
Users are often the first point of contact with phishing, fraud, social engineering, malicious attachments, impersonation, or attempts to misuse identity. A good SAT program combines short training, simulations, measurement, and targeted feedback. Insider Risk Management adds visibility into risky behavior that may be intentional or accidental.
How To Navigate This Area
An effective awareness program is not a one-time training. It should include regular learning, simulations, behavior measurement, and feedback. In the security architecture, it complements technical controls with the human factor and now needs to account for AI-assisted phishing, deepfake scenarios, and targeted fraudulent content.
The right solution should be evaluated by language, localization, training frequency, scenario quality, and reporting. The program should not feel like punishment for users, but like a practical part of the security culture. Modern scenarios should cover QR phishing, collaboration fraud, AI-generated messages, and targeted attacks on specific roles.
The technology list below works as a map of the SAT area. The practical sequence is to name the security problem first, select the closest technology category second, and only then compare relevant vendors. This helps separate similar-sounding solutions and reduces the risk of adding another tool without a clear architectural role.
Technical Section Schema
Questions To Ask When Selecting A Solution
- Which user groups carry the highest risk or impact if they make a mistake?
- Should the organization cover only training or also phishing simulations?
- Should scenarios include AI-generated phishing, QR codes, messaging fraud, or deepfake elements?
- How will behavior change and long-term trends be measured?
- Is localization for Slovak or Czech environments required?
How To Use This Section
Each technology page expands one category, explains its architectural role, and lists SecTec portfolio vendors related to that area. The section page is therefore the orientation layer, while the detail pages support concrete mapping to solutions.
Vendors From The SecTec Portfolio
Attack coverage and defensive context
MITRE ATT&CK® Enterprise version 19.1 is used as a reference model. The mapping is a SecTec expert interpretation and does not imply endorsement by MITRE.
Practical attack scenarios
- Phishing and identity abuseAn adversary manipulates a user, obtains credentials, or abuses a trusted account to gain access to the environment.
- Public application or API abuseAn adversary exploits a vulnerable web application, API, client-side code, or software component for initial access and execution.
- Cloud and SaaS compromiseAn adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.
- Data exfiltration and leakageAn adversary searches for, collects, and transfers sensitive data from endpoints, cloud services, email, or internal repositories.
- Supply chain and trusted accessAn adversary abuses a supplier, software dependency, external access path, or trusted relationship to bypass normal controls.
- Reconnaissance and attack surface mappingAn adversary collects information about people, systems, cloud services, and internet-facing infrastructure and searches for a viable initial-access path.
- Business Email Compromise and mailbox takeoverAn adversary takes over or impersonates a trusted email identity and abuses communications for fraud, payment diversion, data collection, or further phishing.
- Privilege escalation and persistenceAn adversary expands privileges, creates or modifies accounts and policies, and establishes repeatable access to systems, identities, or cloud environments.
- Insider threat and authorized access abuseAn insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
- MFA fatigue, push bombing, and interceptionAn adversary floods a user with MFA prompts, intercepts a code, or uses social engineering to make the user approve an unauthorized sign-in.
Relevant ATT&CK techniques
- T1005 · Data from Local SystemDetect, Respond
- T1041 · Exfiltration Over C2 ChannelDetect, Respond
- T1078 · Valid AccountsDetect, Respond
- T1114 · Email CollectionDetect, Respond
- T1204 · User ExecutionPrevent, Validate
- T1213 · Data from Information RepositoriesDetect, Respond
- T1530 · Data from Cloud StorageDetect, Respond
- T1566 · PhishingPrevent, Validate
- T1598 · Phishing for InformationPrevent, Validate