How a workshop runs
Scoping
We agree the audience, the stack, and the objectives, and review your latest test report
if you have one, so the workshop targets the gaps that matter to you.
Content built for your team
Exercises are built around your languages, frameworks, and infrastructure, and around
the classes of finding your environment has shown.
Hands-on delivery
On-site sessions (half-day or full-day) or live-online sessions. Participants work
through each vulnerability by hand, then fix it.
Certificates and workshop report
All attendees receive a completion certificate. You receive attendance records, an
overview of the content covered, and recommendations for follow-up.
Follow-up (optional)
Refresher sessions for new joiners, and a check in your next penetration test of whether
the same classes of finding return.
Phishing simulation for all staff: IMIZI Aware is our managed, year-round awareness programme: scheduled phishing
simulations, short role-relevant modules, and before-and-after reporting, run for you on a recurring
engagement.
BNR compliance: Article 18 of the
National Bank of Rwanda's Regulation N° 50/2022 requires regular cybersecurity awareness training for board
members, senior managers, and all staff. Our executive briefings and staff sessions support
that obligation with attendance records and a content overview, and IMIZI Aware covers the
recurring simulations and effectiveness evidence.
Delivery formats
- On-site, Kigali: Full or half-day sessions at your offices. Best for hands-on
workshops and executive briefings.
- On-site, regional: Available across Africa with advance notice.
- Live-online: Interactive sessions via video conference. Suitable for remote
or distributed teams.
- Blended: On-site for core sessions, online for refreshers.
Compliance alignment
Security training appears as a requirement in several frameworks that apply to regulated
institutions in Rwanda and across Africa. Our workshops support your compliance with:
- BNR Regulation N° 50/2022 on cyber security: Article 18 requires regular
awareness training for board members, senior managers, and all personnel who use the
institution's information systems, and an evaluation of its effectiveness
- PCI DSS v4.0: Requirement 6.2.2 requires software development personnel
to be trained at least once every 12 months on software security relevant to their job
function and development languages, including secure design and secure coding. Requirement
12.6 requires a security awareness programme for all personnel
- ISO 27001:2022: Control 6.3 (Information security awareness, education
and training) requires personnel to receive training relevant to their role. Control 8.28
(Secure coding) requires secure coding principles to be applied in software development
- Rwanda Data Protection Law N° 058/2021: requires data controllers and
processors to implement appropriate technical and organisational security measures. Staff
training is a core organisational measure that supports this obligation
For a real example of how human-factor weaknesses translate into financial loss, see our
analysis: lessons from a major bank fraud incident in Rwanda. Related services: penetration testing, security assessments, custom tooling, and managed security.
Frequently asked questions
Who is the training for?
Engineering, IT and security teams at regulated institutions across Africa: banks, MFIs, payment providers, telecoms, insurers, government bodies, ministries, healthcare institutions, and fintechs. We also run executive briefings for boards and senior management. For a recurring phishing simulation and awareness programme for all staff, see
IMIZI Aware.
What topics does the training cover?
Secure coding for web and API developers, secure mobile development, infrastructure and cloud hardening for IT teams, incident handling for IT and security teams, and executive briefings on the threat and regulatory picture. One-off staff awareness sessions on phishing and manipulation are also available; the recurring, measured programme is IMIZI Aware.
Is the training built around our organisation?
Yes. We build each workshop around your stack, your roles and, where you have one, the findings from your latest penetration test or assessment, so the exercises use the flaw patterns your own systems showed. Examples and scenarios come from threats and institutions African teams will recognise.
How is the training delivered?
On-site in Kigali, on-site regionally across Africa with advance notice, live-online for remote or distributed teams, or a blended format with on-site core sessions and online refreshers. Content is available in English, with French and Kinyarwanda versions on request.
How do you measure whether the training works?
In the workshop, hands-on exercises show who can find and fix each flaw. Over time, your next penetration test shows whether the same classes of finding come back. You receive attendance records and a short workshop report. For phishing click and report rates tracked over the year, use
IMIZI Aware.
How do we scope a training programme?
Tell us your team size, location, stack, and training objectives, and we design a workshop that fits. Each workshop has a fixed price, agreed after the scoping call. Training lands best after a penetration test or assessment has shown where the gaps are; we build the curriculum from those findings.