#CyberLearn Updates
Stay up to date with new guides and improvements
5 November 2026
Phishing: a breach notice is a phishing forecast
A new type on the list, post-breach phishing: once your address sits in a leaked file, expect messages built from it in the name of the breached company itself. Pluxee warned its cardholders exactly so on 4 November 2026.
Read article4 November 2026
Email security: verify a changed account number by phone
Tip 6 adds that a hacked mailbox can alter a genuine invoice in place, changing only the IBAN; an account number your banking app does not recognise is a reason to check, not proof of fraud (Safeonweb).
Read articleBEC now names the tampered-invoice variant
The Business Email Compromise threat card adds the tampered-invoice pattern (a hacked mailbox alters a real invoice in transit) and the IBAN out-of-band check, with a one-line link to the Limburg financial-software fraud wave.
Read articleSocial engineering: a new "doorstep collection" type
Adds a type entry for the escalation Safeonweb documents beyond phone-only vishing: a fake "bank courier" visits in person, after a phone/SMS/email lure, to collect a card and PIN.
Read article29 October 2026
Employee training: what an assessor asks to see
The measuring section now names the record a CyFun assessor asks for under PR.AT-01.1: a dated completion record per person, kept next to the click and report rates.
Read article28 October 2026
Security policy: the translation question has a concrete answer
The FAQ on translating policies now names what Easy Cyber Protection already ships: 11 CyFun Basic procedure and policy templates carry real content in Dutch, French and English (added August 2026), not just placeholders.
Read article21 October 2026
Shadow AI governance: a fifth quarterly-review question
The quarterly review now also asks which approved AI tools read externally-supplied documents, and who checks their output figures (prompt-injection-through-documents risk).
Read article15 October 2026
Incident response: can you still run your business if...?
New section with six fallbacks (email, website, till, phones, accounting, ransomware): what you do, who decides, and what CyFun asks at each level.
Read articleSupplier security: the Danfoss supermarket fridges
New case: attackers switched supplier-managed Danfoss refrigeration controllers in French supermarkets to defrost (October 2026). Step 1 now puts supplier-managed remote equipment on the asset list. Replaces the Under Armour case.
Read articlePatch management: Joomla and JCE on the inventory
Step 1 now names Joomla and its JCE editor next to WordPress. The CCB saw the JCE flaw mass-exploited in July 2026.
Read article8 October 2026
Course lesson: Which clients, and what you actually sell
The client report is now called the ECP Baseline Scan, the name you see in the Partner Dashboard. What it contains is unchanged.
Read article7 October 2026
Who counts as professional services
The named-professions list now matches what the sector actually is: notaries, accountants, bookkeepers, payroll providers and lawyers, not a generic "consultants and architects" line.
Read articleOut of NIS2 scope is not out of leverage
The FAQ answer for smaller practices now says what actually applies when no cyber law reaches you: your contract and your clients' own questions, not a vague "best practices" line.
Read articleTwo questions beat a 28-question form
The sample security questionnaire now leads with the two questions someone actually sends: how long before we could reopen our file, and who else touches our data. The redundant entries they replace are gone from the full list.
Read articleA slow answer is not always a dodge
The MSP-questions guide now tells apart a question that genuinely takes a few days to answer from a vague non-answer to a question the MSP could clearly have answered on the spot.
Read article29 September 2026
Course lesson: What NIS2 asks you to do
Who counts as the board now follows the CCB NIS2 FAQ. That is whoever runs and represents the company, takes binding decisions for it, or controls it.
Read articleCourse lesson: The board’s own duty
The CCB FAQ’s reading of who counts as the board replaces the interim wording, including the quiz on an advisory committee.
Read articleCourse lesson: Judging the risk
The training step now cites the CCB: each company sets the content and duration of its training, and the CCB recommends no specific programme.
Read articleCourse lesson: Reporting a significant incident
Adds the CCB Notification Guide’s concrete cases of a significant incident and when you count as aware of one.
Read articleCourse lesson: Your NIS2 calendar
The deadlines start when a company falls into scope, per the CCB FAQ; a change of size counts after two accounting periods.
Read articleCourse lesson: Your own house first
Who counts as your MSP’s board now follows the CCB FAQ. The significant-incident test adds the EU regulation’s common and recurring cases.
Read articleCourse lesson: Reporting a significant incident
Per the CCB guide, the company files its own notification. Can your IT partner file it for you? The guide does not say, and the lesson now says so.
Read articleCourse lesson: Price it, contract it, limit it
The notification clause now quotes the CCB guide: your client files its own notification. Whether you may file it for them is not in the guide.
Read article28 September 2026
ECP vs KSC (Poland): CyFun next to Poland's national cybersecurity framework
New comparison page for Poland's Krajowy System Cyberbezpieczeństwa (KSC), the NIS2 transposition amendment signed February 2026, in force 3 April 2026. Registration deadline is 3 October 2026; full implementation by 3 April 2027. Covers the 18+ regulated sectors, 50+ employee / €10M+ turnover threshold, three national CSIRTs (NASK/GOV/MON), biennial ISMS audit requirement with ISO 27001 explicitly recognised, and fines up to €10M/2% (essential entities) or €7M/1.4% (important). MSPs are regulated important entities — no multi-tenant compliance track. EN/NL/FR, 10 cited sources.
Read article25 September 2026
Phishing: two figures corrected
Belgians forwarded more than 9 million suspicious messages to verdacht@safeonweb.be in 2024, not 10 million; 10 million was the 2023 record. With those reports the CCB redirected 1,644,732 suspicious links. Tycoon 2FA reached about 96,000 victims worldwide according to Microsoft, nearly 500 of them in Belgium; we had written 96,000 attacks. Sources added: Safeonweb, The Hacker News, The Brussels Times. The CCB article's timeline gets the same 2024 correction. EN/NL/FR.
Read articleLooking for something older?
Read the archive of earlier updates