System learning paths

System learning paths are ready-made curricula that RansomLeak builds and maintains. They appear automatically in every organization’s learning path list, already published and in the catalogue. In the list you’ll recognise them by the System badge.

Compliance framework tags

Most system paths are tagged with the compliance frameworks they help satisfy, shown as badges in the list. The tags include SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, NIS2, DORA and 23 NYCRR 500, among others.

These tags drive the Compliance page (Analytics → Compliance) and the Vanta integration: when a learner completes a framework-tagged system path, that counts as security awareness training evidence for that framework.

Secure development path

Most system paths are SAT paths for every employee. Secure Development Training is an AppSec path for developers and engineers: OWASP Top 10 for web and APIs, repository and CI/CD secrets, container images and cloud infrastructure. It’s tagged PCI DSS, SOC 2 and ISO 27001. As with any AppSec path, only people with an AppSec licence can be enrolled.

You can’t edit them, but you can clone them

System paths are read-only for your organization so that RansomLeak can keep them current. In the list, Edit, Publish/Unpublish and Delete are disabled. Opening one shows the banner Platform-managed learning path.

To customise one, click Clone to edit (or Clone in the list menu). You get an ordinary path of your own, with the same steps and prerequisites, that you can change freely.

Caution

A clone is not a system path. It keeps no framework tags and doesn’t repeat each year, so completing it doesn’t count as framework evidence on the Compliance page or in Vanta. If you need compliance evidence, assign the original system path.

Yearly retraining

Many frameworks require training to be repeated periodically, so some system paths repeat on a fixed cycle, typically every 12 months. For an enrolled learner:

1. 14 days before the renewal date, they get a “due soon” email.
2. On the renewal date, they get a “due now” email.
3. After a grace period, the path is marked incomplete again. Only work done in the new cycle counts toward completing it.

Each time a learner completes a new cycle, their certificate is re-issued with the new completion date.

You don’t have to set anything up for this. The cycle comes with the system path.