Question 1

What content is included?

Accepted Answer

Two courses, both included at the one price. OWASP Top 10:2025 covers all 10 categories (Broken Access Control, Security Misconfiguration, Software Supply Chain Failures, Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software or Data Integrity Failures, Security Logging and Alerting Failures, and Mishandling Exceptional Conditions) across 10 modules. See what changed from 2021 in our /guides/owasp-top-10-2025-what-changed guide. General Security Awareness 2025 covers foundational security controls plus AI-era guidance. Every module ships with an audio overview, a synchronized transcript, a scored quiz, and a formal attestation. Full catalog: /courses.

Question 2

How much does it cost?

Accepted Answer

$11.99 per learner per year. All courses, all features. No per-module fees, no minimum seats, no enterprise sales call.

Question 3

Will our auditor actually accept this?

Accepted Answer

Yes. OWASP modules, scored quizzes, formal attestations, and a timestamped exportable compliance report produce evidence auditors accept for SOC 2 CC1.4 (workforce competence and training), ISO 27001 A.6.3 (awareness and training), and A.8.28 (secure coding). Our guides map the specific controls to the specific evidence we produce. Background on auditor expectations for developer-specific training is in our /guides/do-developers-need-security-training-for-soc-2 guide.

Question 4

What's in the exportable compliance report?

Accepted Answer

Every learner's name, email, enrolled courses, per-module pass/fail and scores, and attestation timestamps. Download as a signed PDF (the auditor-ready version) or as CSV (raw data, for spreadsheets or your own tooling). See the full sample breakdown in our /guides/soc-2-developer-security-training-requirements guide.

Question 5

Does this also map to ISO 27001 Annex A.6.3?

Accepted Answer

Yes. The same evidence supports SOC 2 CC1.4 (workforce competence and training) and ISO 27001 A.6.3 (awareness and training). The OWASP module content additionally supports A.8.28 (secure coding). Evidence reusable across both audits. Full mapping in our /guides/iso-27001-a-6-3-vs-soc-2-cc-1-4-developer-training guide.

Question 6

How long does training take?

Accepted Answer

Each course takes about 50 minutes on average. Modules are short and self-paced, so learners can chip away at it between meetings.

Security training shouldn't feel like watching unskippable ads.

Short. Searchable. Not insulting.

Same audit outcome. Different decade of pricing.

Evidence, not narrative.

Every learner, every module, every date. One PDF.

Built for every role in the audit chain.

Up and running in an afternoon.

SOC 2 ready security training without the SOC 2 price tag.

Asked and answered.