Security cannot be left solely to IT
The technical team can address the cause of an attack, but leadership decides whether to shut down operations, communicate with clients, involve external partners or accept business risk.
[ Corporate training for management ]
During a cyber incident, IT is not the only decision-maker. Leadership makes the decisions.
When an attack halts operations, threatens data or affects clients, knowing what happened in the system is not enough. Leadership must quickly set priorities, assign responsibilities and decide how the company will respond. We prepare management for decisions that can affect business continuity, reputation and the incident's wider impact.
[ Leadership accountability ]
A crisis plan is no help if no one knows who should decide
A cyber incident can turn from a technical problem into an operational, legal and reputational crisis within minutes. Leaders therefore need enough understanding of the risks to ask the right questions, set priorities and make decisions even without all the information.
Responsibilities must be clear before an incident
If roles and authority are not assigned in advance, the company loses time during a crisis. Unclear responsibilities can slow the response and increase the incident's impact.
Security competes with other priorities for budget
Management needs to distinguish essential measures from spending with no clear benefit and make decisions based on risk, rather than price or technical specifications alone.
Communication can reduce or worsen an incident's impact
Inappropriate, delayed or uncoordinated communication can damage the trust of employees, clients and partners.
[ Training outcomes ]
Leaders will know what to ask and how to make decisions
01
They will recognise risks that matter to the business
Click to learn more →01
Participants will be able to connect technical security risks to their impact on the organisation's operations, finances, clients and reputation.
← Back02
They will clarify responsibilities
Click to learn more →02
They will understand which roles and authority must be established before an incident, and where IT's responsibility ends and leadership's begins.
← Back03
They will be able to set priorities
Click to learn more →03
Management will gain a framework for decisions on security measures, budget and acceptable risk.
← Back04
They will be better prepared for an incident
Click to learn more →04
Participants will work through decisions under pressure and identify where uncertainty may arise in escalation, coordination and communication.
← Back[ Audience ]
For people responsible for running an organisation and its teams
The training is designed for senior leaders and other decision-makers. No technical education or prior cybersecurity knowledge is required.
[ Suitable for ]
- Business owners and managing directors
- Board members
- Senior management
- Department heads and team leaders
- Operations and finance management
- HR and communications roles
- People responsible for business continuity
- Other staff involved in crisis decision-making
[ Course content ]
Cybersecurity from the perspective of decision-making, accountability and business operations
We tailor the depth of topics and the scenarios used to your organisation's industry, size, environment and distribution of responsibilities.
01Cyber risks from a leadership perspective
- How to translate technical risk into business impact
- Which assets, processes and services are critical to the company
- How to identify a risk that needs management attention
- What questions to ask internal and external specialists
02Management duties and personal liability
- Leadership responsibility for managing security risks
- Relevant aspects of NIS2 and GDPR
- How to ensure decisions and measures taken can be evidenced
- What management must direct and what it can delegate
03Security policy and allocation of roles
- Who is responsible for what before, during and after an incident
- Allocation of authority between leadership, IT and other teams
- Escalation procedures
- Working with external suppliers and partners
04Risk management and business continuity
- How to identify critical processes
- How to work with likelihood and impact
- What the company can temporarily stop and what it must maintain
- Crisis scenarios and fallback procedures
- Returning to normal operations
05Decision-making during an incident
- How to make decisions with limited and changing information
- When to activate the crisis team
- How to prioritise the first few hours
- When to involve lawyers, insurers, specialists or other partners
- How to document key decisions
06Internal and external communication
- Communicating with employees
- Informing clients and business partners
- Coordinating technical, legal and management communication
- The basics of media communication during an incident
- How to prevent contradictory or premature messages
07Investment in security
- How to prioritise security measures
- How to assess costs in relation to risk
- How to evaluate the expected benefit
- Where a false sense of security comes from
- How to continually verify the effectiveness of measures taken
08Security culture
- How leadership influences employee behaviour
- Why policies alone are not enough
- How to encourage people to report mistakes and suspicious situations
- How to make security part of everyday business operations
[ Training format ]
Less theory. More decisions leaders actually have to make.
The training takes place in person and combines clear explanations with discussion, practical examples and decision-making scenarios. By agreement, it can also include a tabletop exercise tailored to the organisation's environment.
01
Interactive instruction
Click to learn more →01
We relate each topic to how the organisation actually operates. Participants can raise questions they face in their teams and roles throughout the session.
← Back02
Decision-making scenarios
Click to learn more →02
Management works through situations that require setting priorities, assigning responsibility and choosing the next steps.
← Back03
Tabletop exercise
Click to learn more →03
Participants work through a facilitated simulated incident scenario, receive new information and decide how the organisation should respond. The exercise does not affect real systems or operations.
← Back04
Review, recommendations and Q&A
Click to learn more →04
Together, we review decisions, unclear responsibilities and weak points. The company then receives a summary and recommendations; time for questions is included.
← Back[ Practical information ]
We tailor the content to your roles, risks and decision-making processes
The training length depends on the agreed depth, group size, scope of discussion and inclusion of a tabletop scenario. These are not two fixed, separate pricing options. We prepare a scope that fits each organisation's needs.
- Format
- In person
- Duration
- 2–4 hours
- Number of participants
- 5–30 people
- Prerequisites
- None
- Price
- From CZK 45,000
- Available format
- Interactive training or training with a tabletop exercise
- Customisation
- Based on industry, environment, risks and distribution of responsibilities
- Includes
- Presentation, handbook, checklist, learning materials and certificate
- Wrap-up
- Discussion and Q&A
- Tabletop deliverable
- Summary of the exercise and recommendations
[ Your trainer ]
Pavel „SPAJK“ Matějíček
Pavel “Spajk” Matějíček is a cybersecurity trainer and consultant at BOIT. He has worked in cybersecurity for over 10 years, focusing on user security awareness, social engineering prevention and practical protection of company data in everyday operations. Previously, he worked at ESET, helping educate people about cyber threats.
In his training, he explains things clearly, without unnecessary technical jargon, using real-world situations. He helps management put technical topics into the context of risk management, business operations and decision-making during an incident.
[ Why BOIT ]
We translate cyber risks into the language of leadership
We connect security with business operations
We go beyond technical terms. We show their impact on operations, finances, clients, reputation and leadership accountability.
We work with realistic scenarios
Participants can practise decision-making in situations that reflect the actual course of a security incident.
We tailor the content
We take into account your industry, organisation size, risks, internal policies and allocation of roles.
We uncover uncertainties before an incident does
Tabletop exercises help identify weaknesses in decision-making, escalation and communication before they have real consequences.
[ Client experiences ]
Prepared leadership gives the company a head start during an incident
Pavel's cybersecurity training has the pace of an ice hockey game: fast, practical and full of involvement. Participants aren't spectators: they're active players. No boredom, just clear insights they can use straight away.
Accolade has worked with Pavel for several years. His proactive approach makes his training one of our most popular and best-attended sessions, engaging people across generations.
We've worked with BOIT on information security talks for a long time. Pavel combines excellent expertise with an entertaining style. In over 10 years of organising specialist events, BOIT has been one of our best partners. Highly recommended.
[ FAQ ]
What you need to know before booking
01Do participants need technical knowledge?
No. The training focuses on management, accountability and decision-making. We explain technical topics in a context relevant to management.
02Who is the training suitable for?
Senior management, owners, managing directors, board members, department heads, team leaders and other roles involved in risk management or crisis decision-making.
03How many people is the training designed for?
The recommended group size is 5 to 30 participants. For tabletop exercises, it is useful to involve different roles that would help handle a real incident.
04What is a tabletop exercise?
It is a facilitated incident simulation in which participants receive new information as the scenario unfolds and decide what to do next. Real systems are not affected and the exercise does not disrupt normal operations.
05Is a tabletop exercise included in the training?
Yes, by agreement it can be included within the total 2–4 hours. We tailor its scenario and depth to the specific organisation.
06Will you tailor the scenario to our company?
Yes. We can take into account your industry, key processes, typical risks, team structure and distribution of responsibilities.
07Will we receive a deliverable after the tabletop exercise?
Yes. The company receives a summary of the exercise and recommendations based on the decision-making, communication and collaboration during it.
08What do participants receive after the training?
The training includes a presentation, handbook, checklist, learning materials and certificate.
09How much does the training cost?
Prices start at CZK 45,000. The final quote depends on the duration, depth, number of participants and scope of any tabletop scenario.