Avencyx Professional Cybersecurity & AI

The problem we solve

The attacks that hit independent professionals and small firms are not sophisticated. They are an email that looks like it came from a client, a reused password, an unencrypted laptop left in a taxi, a confidential document pasted into an AI chat for a quick summary. The consequences, however, are out of all proportion: money wired to the wrong account, files locked, professional secrecy breached, notification duties triggered, clients lost. You have no IT department to fix it and no time to become a specialist. You need a set of measures that fits your risk, set up correctly once and maintained with minimal effort.

Situations we work on in the course:

The scenarios are realistic, built from the patterns of incidents we see in practice. You make the configurations on your own devices and accounts, guided, without the trainers having access to them.

What you will be able to do at the end of the program

At the end of the three days you will be able to:

1. Identify what you need to protect in your work, who would want that information and the most likely attack paths, in a simple risk model adapted to your profession.
2. Protect your accounts with a password manager, phishing-resistant authentication (FIDO2 security key, passkeys) and verified recovery options.
3. Secure your laptop and phone: encryption, updates, separation of professional and personal activity, backups tested by restoring them.
4. Communicate and share documents with clients, patients or sources over channels suited to the level of confidentiality, and remove hidden information from the documents you send.
5. Recognize phishing, invoice fraud, fake calls and messages, including AI-generated ones, and have a verification procedure you apply every time.
6. Choose and configure AI tools for your work, know what information may and may not be entered, and limit connector and agent permissions to the strict minimum.
7. Recognize AI-specific risks — invented results, hidden instructions in documents (prompt injection), data leakage to external services — and verify results before using them.
8. React correctly in the first hours of an incident — compromised account, lost device, ransomware, fraud — knowing what to stop, what to preserve as evidence, whom to notify and how to get back to work.
9. Maintain your personal security plan with minimal effort: a schedule of checks and a written procedure you can show a client, an auditor or an authority.

Outcomes 2, 3, 4 and 6 are verified in the room, on your devices; the others are assessed through the personal plan and the incident simulations. The criteria are published in the "Assessment and certificate" section.

The program: three days, twelve modules, one plan put into practice

Around 70% of the time is hands-on work: configurations on your own devices, checks and simulations. Each day has four 90-minute modules, and each module ends with a control put in place or a decision that goes into your personal security plan. The measures follow the structure of the NIST Cybersecurity Framework 2.0 (identify, protect, detect, respond, recover) and start from the minimum set of CIS Controls v8 (Implementation Group 1), translated for a professional without an IT department.

Day 1 — Exposure, identity, devices

Day 2 — Communications, attacks, AI

Day 3 — Incidents, your plan, verification

Daily schedule (the same on all three days): 09:00–10:30 · 11:00–12:30 · 14:00–15:30 · 16:00–17:30 — four 90-minute modules, with two 30-minute coffee breaks and a 90-minute lunch break (lunch included). The 18 hours (3 days × 4 modules × 90 minutes) are the commercial duration of the program; the course is not subject to a legally imposed minimum duration.

How we work

You configure, you don't just listen. Every measure taught is applied in the room, on your laptop and phone, step by step, with the trainer and co-trainer beside you. You leave with the controls active, not with a to-do list.

On your devices and accounts, with no access on our side. The trainers guide and visually verify the result; they do not touch participants' devices, do not receive passwords, codes or recovery keys, and do not install anything on your behalf. Your clients' documents and data do not enter the exercises; we use practice files and accounts.

Measures proportionate to the risk. There is no single list for everyone. We start from your risk model and your profession's obligations, then choose the measures that matter. A notary, an investigative journalist and a psychotherapist leave with different plans.

Established tools, with no dependence on a vendor. For each category we present the selection criteria and at least two options among those with an established reputation — password managers (Bitwarden, 1Password, KeePassXC), FIDO2 security keys and passkeys, encryption built into operating systems (BitLocker, FileVault), backup solutions, end-to-end encrypted messaging (Signal), metadata-stripping tools — including free ones or ones already included in what you have. We have no commercial partnerships with the vendors presented. We use the free or trial tiers of the tools; where these do not cover the exercise, the trainer demonstrates with the commercial version.

Aligned with the field's reference frameworks. Your plan follows the structure of the NIST Cybersecurity Framework 2.0, the controls start from CIS Controls v8 (Implementation Group 1) and ENISA's guidance for small businesses, and the AI part uses the OWASP Top 10 for LLM Applications and the requirements of the AI Act. We use them as a skeleton, translated into the language of your profession, not as checklists; if a client or an auditor asks what you rely on, you have the answer.

AI: controlling exposure, not banning it. We do not tell you not to use AI. You learn to decide, for each tool and each task: what information may go in, in which account and with which settings; what access the tool gets to email, files and calendar through connectors and agents; how to verify what it produced and what it did on your behalf. We deal explicitly with hidden instructions in the documents and emails you hand to an AI assistant (prompt injection), invented results and dependence on a single vendor.

AI tools used in the course. Participants may use their own accounts with online AI services; no paid subscription is needed to complete the exercises. Alongside online services, we also work with local AI tools and models, run on the participant's laptop under the trainer's guidance, for situations where information cannot leave the device. Installation and setup take place before the course, following the preparation guide.

What you leave with: active controls and your security plan

The result of the course has two parts. The first is a set of measures already configured and verified on your devices by the end of the three days. The second is your personal professional security plan: the document that describes what you have configured, how you use AI, what you do in case of an incident and how you maintain it all. It is written in the language of your profession and can be shown to a client, a partner, an auditor or an authority asking what measures you have taken.

The plan is completed progressively over the three days, on a working template you keep and update after the course.

Assessment and certificate

Assessment has two components. The configured controls are verified in the room, in the last module of the course, against a published checklist, without the trainers accessing your devices. The personal security plan and the AI procedure are assessed by the trainer after the course, with written feedback within five business days.

The pass mark is 70%. Participants who do not reach it receive detailed feedback and may resubmit the plan once, within 30 days, at no extra cost.

The certificate is Avencyx Academy's own certificate. It states the syllabus covered, the learning outcomes assessed, the duration and the assessment result, and carries a unique number; its authenticity can be verified on request, by certificate number, at academy@avencyx.com. Participants who do not pass the assessment receive a certificate of attendance, without the pass statement.

What this certificate is not. It is not a nationally recognized qualification and is not issued under a program authorized by a public authority. It does not attest your organization's compliance with any standard and does not replace an audit. Its value lies in the published syllabus, the assessment criteria and the measures you have configured and documented.

Who teaches

Cătălin Pătrașcu — founder of Avencyx, lead trainer

Cătălin has worked in cybersecurity for over 20 years, with experience in cybercrime investigations, electronic evidence, incident response and digital forensics, threat intelligence and SOC/CSIRT operations. He has worked in military, government and international settings, including inter-agency cooperation and capacity-building projects in the field of cybercrime.

He holds internationally recognized certifications (ISC2 CISSP, ISACA CISM, SANS/GIAC GREM, GXPN, GWAPT, EC-Council CEH, CHFI, Mile2 CPTE) and is a cybersecurity auditor attested by DNSC, Romania's National Cyber Security Directorate. He leads Avencyx's investigation, DFIR and threat intelligence work and has delivered training programs for CSIRT teams, law enforcement and private organizations.

Why it matters for this course: the measures taught are the ones the Avencyx team sees missing, case after case, in the incidents it responds to: accounts without multi-factor authentication, untested backups, unencrypted devices, confidential documents in unsuitable tools. The course puts these lessons in the order that matters for a professional without an IT department.

Co-trainer: an Avencyx co-trainer provides hands-on support throughout the configurations, so that every participant gets help when they need it.

What you need to know and bring

Required knowledge

• No prior technical training. The course is built for professionals outside IT.
• Everyday use of a laptop and a phone: email, documents, installing an app, basic settings.
• Reading-level English: some tools have an English-only interface.

Equipment

• The laptop you actually work on, with administrator rights, at least 8 GB RAM (16 GB preferred) and 32 GB of free space (64 GB preferred), running an up-to-date Windows, macOS or Linux. Configurations are made on your real device, not a borrowed one.
• The phone you use professionally, with its charger.
• Work laptops managed by an IT department may have locked settings; if that is your case, tell us in the application and we adapt the exercises.
• A hardware security key (FIDO2, USB-C and NFC) is included in the price: you receive it at the start of the course, set it up in module 2 and keep it. If you already have one, you can use your own.
• Accounts: access to your main email and cloud accounts (you will set up authentication on them) and an account with at least one of the AI tools listed in the preparation email. No paid subscriptions are required.

Before the course

• Seven days before, you receive a preparation guide: what to check on your devices, what to install, which recovery codes to have at hand, and about 30 minutes of reading.
• A short questionnaire about your profession and the devices and services you use, so we can adapt the examples and checklists.

What participation includes

• The participant manual, in a digital version for reference, with access to updates for 12 months.
• The checklists by category and the templates for the personal security plan and the AI procedure, as working templates you complete during the course and update afterwards.
• A FIDO2 hardware security key (USB-C and NFC), included, which you set up during the course and keep.
• Three days of work in a small group, with the lead trainer and a co-trainer in the room, checklist verification of your controls and individual written feedback on your plan.
• Lunch and coffee breaks on each of the three days.
• The Avencyx certificate, after passing the assessment.

Limits and rules

Defensive only, on what is yours. All exercises are done on participants' own devices and accounts or on practice accounts provided by Avencyx. We do not teach or tolerate access to systems, accounts or data that do not belong to you.

We have no access to your data. The trainers do not receive passwords, codes, recovery keys or access to devices, and do not need them. Controls are verified visually, against the checklist, with you at the keyboard. Do not bring client or patient documents into the room; the exercises use practice files.

Not legal advice, not an audit. The course explains, at a practical level, the obligations that concern information security in your profession — professional secrecy, data protection, incident notification — and helps you reflect them in your plan. It does not replace the opinion of a lawyer or your data protection officer, or the rules of your professional body, and it does not certify compliance.

Security is not absolute. The measures taught significantly reduce the most common risks and give you a response plan. No measure guarantees the absence of incidents; that is why the plan also covers response and recovery.

Participant code of conduct. On enrollment, every participant agrees in writing to the following rules: work only on your own devices and accounts or on the practice ones; do not bring or enter client, patient or source data into the exercises; do not use the attack-recognition techniques to test other people without their consent; treat information about other participants, their devices and their practices as confidential. Avencyx reserves the right to decline an application or to exclude a participant who breaches these rules, without refund of the fee.

Participant confidentiality. We do not publish the list of participants and we do not use their names or organizations in promotional material without written consent. The room is where practices and, sometimes, lived incidents are discussed; what is said in the room stays in the room.

Enrollment and terms

Price: EUR 1,000 + VAT per participant, i.e. EUR 1,210 including VAT (standard rate of 21%). Invoices are issued in RON at the BNR exchange rate on the invoice date. The price includes the three course days, the materials and templates, a hardware security key (FIDO2), verification of the controls in the room, assessment of the plan with written feedback, the certificate, access to the materials for 12 months, lunch and coffee breaks.

Groups and dedicated editions: for three or more participants from the same organization, or for a full edition delivered at your premises or live online with examples and checklists adapted to your field, request a quote. Dedicated editions can also be organized for bar associations, chambers of notaries, professional bodies, newsrooms, clinics or associated practices.

How the application works

1. You complete the application form (five minutes): your profession, the devices and services you use, what you want to get out of the course. The form runs in your browser and prepares a structured email to academy@avencyx.com, which you send from your own address; nothing is stored on the site.
2. We check whether the program meets your need and whether you meet the prerequisites. We reply within three business days. If it is not the right course, we tell you directly and, where we can, recommend an alternative.
3. On confirmation you receive a pro forma invoice; payment is by bank transfer. Your seat is reserved when payment is received, in order of confirmation.
4. Seven days before the course you receive the preparation guide.

Selection is not about exclusion but about a coherent group: at most 20 professionals who work with sensitive information and can learn from each other.

Cancellation, transfer and withdrawal

• You can transfer your seat to another person who meets the prerequisites, up to three business days before the course, at no cost.
• You can postpone your participation to a later edition, once, with at least seven days' notice before the course.
• The participation fee is not refunded in case of no-show or cancellation less than seven days before the course; transfer and postponement remain available under the conditions above.
• If Avencyx cancels or reschedules an edition, you may choose another date or a full refund.
• An edition is confirmed at a minimum of 10 participants, at least 10 days before the course.
• Right of withdrawal (consumers). If you enroll as a natural person for purposes unrelated to your professional activity, you may withdraw from the contract within 14 days of your enrollment confirmation, without giving a reason, by written notice to academy@avencyx.com; the amount paid is refunded in full within 14 days of your notice. If the edition starts before the 14 days have passed, by enrolling you expressly request that the service begin during the withdrawal period; in that case, if you withdraw after the course has started, you owe the value of the part already delivered, and once all three days have been completed the right of withdrawal ends. Enrollments made for professional purposes or invoiced to a legal entity are not covered by this right; transfer and postponement above apply to them instead.