What an awareness session does not mean

A good session leaves a team with examples and a shared language: what a link is, what a shared mailbox is, when to report. That is training, not an audit.

The session does not mean the network was tested, that a grant body accredited the office, or that the next incident will not happen. A technical test, if needed, is another scope and another contract.

Suitable material is general examples. Real passwords do not come into the room for the sake of “realism”.