Blazebet Security Training

Start here

Before you begin

Most security breaches don't come from someone breaking through a firewall — they come from a person being tricked. The 2026 Verizon Data Breach Investigations Report found that 62% of breaches involve a human element, and phishing is the number-one way attackers get in.

We run a platform handling real money and player data, which makes us a target. The good news: trained teams are dramatically harder to breach. You are our strongest layer of defense. This isn't about blame or passing a test — it's about a few simple habits that stop the most common attacks.

Read each short module, then answer the quiz at the end. Your completion is recorded so we know the team is covered. We refresh this quarterly.

Your full name Your role / team (optional)

Module 1 of 5

Phishing — the #1 threat

Phishing is when an attacker pretends to be someone you trust — by email, SMS, chat, or phone — to trick you into clicking a bad link, entering your password on a fake page, opening a harmful file, or approving a login. It's designed to make you act fast, without thinking.

The tell-tale signs

Urgency & fear — "account will be suspended," "expiring," "act now."
Unexpected sender — you weren't expecting it.
Mismatched address — the display name looks right but the real email address is wrong/random. Check the actual address.
Hidden links — a button that hides where it really goes. Hover (don't click) to see the true destination; press-and-hold on mobile.
Generic greeting — "Dear customer" instead of your name.
"Verify / upgrade / renew / confirm" language pushing you to log in via their link.
Spelling & grammar that's slightly off.

🎣 Real phishing email sent to us — [email protected]

"Your urgent action is needed towards your webmail account ([email protected]) is expiring… follow the secure web URL below to upgrade… [UPGRADE DOMAIN HERE] — cPanel Support Team"

Every red flag is here:

🚩 Sender is [email protected] — a random personal address, not cPanel or our provider.

🚩 Urgency + fear — "urgent," "expiring," "so you do not lose your account."

🚩 A single mystery button hiding a link to a fake login page built to steal our password.

🚩 Spelling mistakes — "adviced," "loose" instead of "lose."

🚩 Generic greeting, impersonates a real brand (cPanel).

What to do: don't click anything. Report it, then delete it.

Golden rules

Never click a link in an unexpected email. Go to the service by typing its address yourself.
Never enter your password on a page you reached by clicking an email link.
Don't open unexpected attachments — especially .zip, .exe, .html, or "enable macros" documents.
When in doubt, ask in the security channel before acting. Checking is always OK.

Module 2 of 5

Passwords & accounts

A stolen or reused password is one of the most common ways attackers get in. These habits close that door:

Unique password per service. If you reuse one and any site gets breached, attackers try it everywhere else. One password = one service.
Use a password manager (Bitwarden, 1Password). You remember one master password; it generates and stores the rest.
Never save the CRM/work password in your browser. Browser-saved passwords can be stolen by malware on your computer.
Long beats complex. A 16+ character passphrase like correct-horse-battery-staple is stronger and easier than P@ss1!.
Don't base passwords on your birthday, pet, or the company name.
Never share passwords over chat/email/Telegram. Everyone gets their own account — ask an admin to set up access.

Module 3 of 5

Two-factor authentication (2FA)

2FA means logging in needs two things: something you know (password) and something you have (a code on your phone). So even if an attacker steals your password, they still can't get in. It's the single most effective protection against stolen passwords.

Corporate email and the CRM require 2FA. If yours isn't set up, ask DevOps to enable it.
Prefer an authenticator app (Google Authenticator, Authy) over SMS — app codes can't be intercepted like texts.
Never approve a login or read out a code you didn't personally start. If a prompt or code arrives and you weren't logging in — someone else is trying to get into your account. Deny it and report it.
We will never ask you for your 2FA code. Anyone who does — by call or message — is an attacker.

Modules 4 & 5 of 5

Device hygiene & reporting

Keep your device clean

Keep your OS and browser updated — updates patch holes attackers exploit.
No pirated software or random browser extensions — a top way "infostealer" malware gets in, which quietly steals every saved browser password and login session. This is how strong passwords still leak.
Lock your screen when you step away.
Don't use the CRM on a shared or unsecured computer.
If your computer acts strangely, report it — don't keep logging into work accounts from it.

Reporting — and if you slip

Report anything suspicious in the security channel before acting. Don't click, reply, or forward to the sender.
If you think you clicked or entered something — tell us immediately. There is no blame for reporting fast. A password reported compromised in the first five minutes is a non-event; kept secret for a day it can become a serious breach. Speed protects you and the company.

CRM users — extra rules

Log out when done — don't leave sessions open, especially on shared machines.
Confirm your logins in the security chat when asked, so we can spot logins that aren't from real team members.
Report any unfamiliar actions or changes in the CRM right away.

Confirmation quiz

Quick quiz

Answer all questions. You need 80% to pass. You'll see the correct answer as you go. If you don't pass, you can retake it.