Multi-factor authentication is not bulletproof
2FA significantly improves security, but attackers can bypass a poorly chosen or configured method. Admins need to understand both its benefits and its limitations.
[ Practical IT security workshop ]
Knowing an attack exists is not enough. You need to see how it actually works.
Modern attacks go beyond fraudulent emails. They bypass multi-factor authentication and exploit mobile devices, wireless networks and commonly used tools. During the workshop, we demonstrate real attack techniques, defence options and specific settings you can apply to your infrastructure.
[ Today's attacks ]
Attackers know your security tools. And they look for ways around them.
Corporate infrastructure is changing rapidly, and so are attack methods. Knowing general recommendations is therefore not enough. Technical teams need to understand how today's attacks unfold, the traces they leave behind and which measures really matter in practice.
Phishing has moved beyond email
Quishing, smishing, fraudulent PWA apps and other techniques use channels that standard email protection does not cover.
An attack can start with a physical device
An inconspicuous cable, USB device or rogue access point can give an attacker a way into an otherwise well-secured environment.
A lack of context creates a false sense of security
A single tool or vulnerability scan will not tell the whole story. A technical team must be able to put findings into context and identify which risks to address first.
[ Workshop outcomes ]
Participants will see attack and defence in context
Understand current attack techniques
Click to learn more →They will see how modern phishing, wireless, mobile and authentication attacks work and why they can bypass common safeguards.
← BackAssess real risks more effectively
Click to learn more →They will be able to distinguish a theoretical vulnerability from an issue that could have a real impact on their infrastructure.
← BackTake away specific measures
Click to learn more →They will gain practical recommendations, tools and configurations they can use in their own environment.
← BackConnect infrastructure with human behaviour
Click to learn more →They will understand how technical weaknesses combine with social engineering, user carelessness and everyday processes.
← Back[ Audience ]
For technical teams that want to know attacks beyond presentation slides
The workshop is for people who administer, support or technically develop a corporate environment. No prior experience in penetration testing or ethical hacking is required. We tailor the content and technical depth to the specific group.
[ Suitable for, among others ]
- System and network administrators
- IT support staff
- IT managers and technical team leads
- Developers and DevOps specialists
- In-house security specialists
- Endpoint administrators
- Technically advanced users
- Other staff responsible for operating and protecting the corporate environment
[ Workshop content ]
From passwords and phishing to mobile devices, IoT and network security
We adjust the depth of each topic to your company's environment, technologies and security priorities.
01Passwords, passkeys and multi-factor authentication
- How attackers obtain and crack passwords
- The most common mistakes in creating and managing credentials
- Passkeys and their uses
- Capabilities and limitations of multi-factor authentication
- Ways to bypass 2FA
- Recommendations for more secure authentication in your company
02Modern phishing
- Current forms of email phishing
- Quishing and QR code abuse
- Smishing and attacks via SMS
- Fraudulent PWA apps
- Fake login pages
- Technical and process-based defence options
03Social engineering and physical tools
- How attackers combine manipulation with technical means
- Real-world social engineering scenarios
- Flipper Zero, USB Rubber Ducky, O.MG cable and WiFi Pineapple
- Risks of unfamiliar devices in a corporate environment
- Detection and prevention options
04Fraudulent payments and NFC attacks
- How fraudulent online payments work
- Attacks on the payment process
- How NFC relay attacks work
- The difference between real risks and widespread myths
- Protective measures for your company and its users
05Mobile device security
- The most common mobile device weaknesses
- Mobile malware and risky apps
- Zero-day scenarios
- Updates, permissions and device management
- GrapheneOS and alternative approaches to security
- Recommendations for corporate and personal devices
06IoT and connected devices
- Why IoT devices are often a weak link
- Default accounts, outdated firmware and inappropriate configuration
- Separating devices from critical infrastructure
- Identifying and reducing risks
- Practical measures for the corporate environment
07Vulnerability scanning
- What a vulnerability scan can reveal
- How to work with scan results
- False positives and missing context
- How to prioritise remediation
- Why an automated scan alone is not enough
08VPNs and network security
- What a VPN actually does
- The most common configuration mistakes
- Remote access risks
- Wireless network security
- Segmentation and limiting the impact of an incident
- Practical recommendations for your corporate network
09Tools and configurations for practical use
- Demonstrations of tools used by attackers and defenders
- More secure configuration of selected technologies
- Practical checks of the corporate environment
- Recommendations based on participants' infrastructure
- Steps you can implement when you return to work
[ Workshop format ]
We devote approximately half the time to hands-on work
The workshop takes place in person, combining clear technical explanations, live demonstrations and hands-on work by participants. It is more than watching tools on a projector. Participants also try selected procedures on their own laptops.
01
Live attack demonstrations
Click to learn more →01
The instructor demonstrates selected techniques, devices and tools in a controlled environment, explaining each step and the available defences.
← Back02
Hands-on work by participants
Click to learn more →02
Participants try selected procedures and settings themselves. Hands-on work makes up approximately half of the entire workshop.
← Back03
No complicated preparation beforehand
Click to learn more →03
Participants bring their own laptops. They do not need to install special software in advance, have administrator privileges or prepare their own lab environment.
← Back04
Environment consultation and Q&A
Click to learn more →04
The company can submit topics, technologies, configurations or issues it would like to discuss in advance. We relate our recommendations to its needs and leave room for participants' questions and experiences throughout the day and in the closing discussion.
← Back[ Practical information ]
A hands-on day tailored to your technical team
The workshop has a fixed duration of six hours. We adjust the time devoted to each topic and the depth of the practical work to the group's composition and the company's needs.
- Format
- In person
- Duration
- 6 hours
- Number of participants
- 5–15 people
- Prerequisites
- None
- Hands-on component
- Approximately 50% of the workshop
- Equipment
- Each participant's own laptop
- Advance preparation
- No special software installation, administrator privileges or personal lab required
- Price
- From CZK 40,000
- Customisation
- Based on infrastructure, technologies, issues and the group's skill level
- Includes
- Presentation, handbook, checklist, learning materials and certificate
- Bonus
- A PDF guide with instructions for employees and their families for every participant
- Company deliverable
- Specific recommendations relating to the topics covered
- Wrap-up
- Discussion and Q&A
[ Your trainer ]
Pavel „SPAJK“ Matějíček
Pavel “Spajk” Matějíček is a cybersecurity trainer and consultant at BOIT. He has worked in cybersecurity for over 10 years, focusing on user security awareness, social engineering prevention and practical protection of company data in everyday operations. Previously, he worked at ESET, helping educate people about cyber threats.
In his training, he explains things clearly, without unnecessary technical jargon, using real-world situations. He shows participants attacks and defences in a practical context and relates the workshop to the technologies, configurations and issues they encounter in their own work.
[ Why BOIT ]
We show attacks as they happen in real life
Learn from a practising professional
The workshop goes beyond textbook scenarios. It uses real techniques, devices, tools and experience from security practice.
We connect attack with defence
We do not show tools for their own sake. For each technique, we explain its impact, detection options and appropriate protective measures.
We devote half the time to hands-on work
Participants do more than listen. They try selected procedures themselves and can relate them to their own work.
We tailor the content to your company
We take into account your infrastructure, the technologies you use, participants' skill levels and the issues you are currently addressing.
[ Client experiences ]
Technical teams prepared for attacks that actually happen
Pavel's cybersecurity training has the pace of an ice hockey game: fast, practical and full of involvement. Participants aren't spectators: they're active players. No boredom, just clear insights they can use straight away.
Accolade has worked with Pavel for several years. His proactive approach makes his training one of our most popular and best-attended sessions, engaging people across generations.
We've worked with BOIT on information security talks for a long time. Pavel combines excellent expertise with an entertaining style. In over 10 years of organising specialist events, BOIT has been one of our best partners. Highly recommended.
[ FAQ ]
What you need to know before booking
01Who is the workshop for?
Administrators, IT support staff, developers, DevOps and security specialists, IT managers and technically advanced users.
02Do participants need prior knowledge of ethical hacking?
No. No prior experience in ethical hacking or penetration testing is required. We tailor the technical depth to the group's level.
03How many people is the workshop suitable for?
The recommended group size is 5 to 15 participants. A smaller group allows for hands-on work, discussion and consultation on specific technical topics.
04Do participants need their own laptop?
Yes. They will try selected practical exercises on their own laptops.
05Does any software need to be installed in advance?
No. Participants do not need to install special software in advance, have administrator privileges or prepare their own lab environment.
06How much of the workshop is hands-on?
We devote approximately half of the six-hour workshop to hands-on work. We can adjust the exact proportion to the group's composition and the agreed topics.
07Can we address specific issues in our infrastructure?
Yes. The company can submit topics, configurations or issues it would like to discuss in advance. We then tailor the workshop and resulting recommendations to its environment.
08What do participants receive after the workshop?
The workshop includes presentations, a handbook, a checklist, learning materials and a certificate. Each participant also receives a PDF guide with practical instructions for employees and their families.
09How much does the workshop cost?
Prices start at CZK 40,000. The final quote depends on the number of participants, the customisation required and the agreed focus of the programme.