Changelog

Security-officer checklist on the security page, an explicit MFA statement, and a 24-hour breach notification commitment in the DPA.

Per-person risk indicator on the dashboard: low, elevated or high, always with the reasons.

Changelog, roadmap and an explainer of how the risk indicator is scored. Version and last-updated date now shown for every module in the curriculum.

Board memo template and Varhugi's answers to the vendor security questionnaire as a PDF.

See the product before signing up: the full phishing module with its quiz, the dashboard with fictional data and the "Genuine or scam?" self-test, all open without sign-in.

Automatic annual refreshers (opt-in, Pro): a year after a member passed a required module it comes back as a refresher with a 30-day due date, one per person per month.

Architecture and operations section on the security page: components, tenant separation, sessions, audit trail, backups and certifications.

Module 01 (Passwords) updated: quiz question on sharing passwords.

Admins can change member roles and invite department managers directly. A module can now be assigned to one person.

AI use policy template rewritten with a printable document layout.

Public sample of the audit report (PDF) and the NIS2 mapping table, no sign-in needed.

Security improvements to self-signup links and reminder dispatch.

Consistent terminology and phrasing across 26 modules.

Refreshers: send a specific module back to one member after an incident, with a due date and reminders.

Icelandic copy cleaned up across modules, guides and the interface.

Module 03 (Two-factor authentication) updated to 1.2.0: passkeys and what they protect against.

Vendor security page at /oryggi: hosting, access control, safeguards, subprocessors and data handling.

New Lite 50 plan and annual billing. The free plan now covers the first three modules.

Guide articles on phishing, two-factor authentication, NIS2 and security awareness, linked to the glossary.

Security review of the whole codebase with fixes shipped: access control, sessions, headers and rate limits tightened.

Entra sign-in: simpler admin consent. The dashboard gains learning coverage, department comparison and CSV export.

All 32 modules rewritten as clean informational texts, version 1.1.0.

Data Processing Agreement, processing records and legal pages published.

Module wording refined. Shadow IT is now rendered in Icelandic throughout.

Certificates redesigned: landscape PDF and downloadable PNG.

Three new modules: PDF document threats, Frontline staff under pressure, and Digital security in plain language. Passkeys section in module 03. Gender-neutral language across all modules.

Advanced track for sysadmins: Sysadmins under attack, and Supply chains and attacks you don't see at first. Assigned manually, not automatically.

Mobile improvements: reading progress, a bottom action button, and the app can be saved to the home screen.

Invitations staged in a batch and sent immediately or on a schedule.

Members can be marked on leave so stats and reminders skip them. Per-department curricula. Modules grouped into themes. Glossary tooltips inside modules. Roles synced from Entra. Admin sessions end after four hours idle.

Audit log of admin actions, strict Content Security Policy, and rate limiting on sign-in.

Ten new modules on physical security, the workplace and everyday practice. Self-signup links restricted to the company domain. Colleagues from the same Entra tenant join automatically.

Ready-made staff announcements in the dashboard. Public curriculum at /namskra.

Sign-in with Google and Microsoft Entra ID. Departments and department managers. Audit readiness and an at-risk list on the dashboard.

Four new AI safety modules. Glossary of 31 Icelandic cybersecurity terms.

NIS2 audit report as PDF for a chosen period. Daily reminders for invitations, due dates and overdue modules.

Ten new modules: AI-written phishing, MFA fatigue, invoice fraud, deepfakes, incident response and more. NIS2 explainer page.

The first three modules (passwords, phishing, two-factor authentication), quizzes and certificates with public verification.