You can set assignment strategies for new users in your organization. There are four different assignment strategies available, and you can choose your preferred assignment from the ones below.

Overview of Assignment Strategy:

1. None:
   
   No activities will be automatically assigned to new users. Choose this option if you prefer to manually assign activities to specific teams or individual users as needed.
   Note: If you select this option, refer to this article for step-by-step instructions on how to assign activities manually on an ad-hoc basis using the Simple Assignments.

2. Initial Plan:
   This option is for organizations that want to roll out a custom Secure Coding Program. New users are assigned initial Labs/Learning Paths based on the organization’s pre-defined Training Plan. If a Training Plan is not available or no iterations are in scope, a fallback is assigned based on the 'Initial Path' strategy.
3. Initial Path:
   The option assigns an initial learning path tailored to the user's core technology, based on the technology selected during the onboarding questionnaire. With a 60-day completion window, it establishes a baseline of competency across various vulnerability classes, fostering timely progress and foundational skill growth.
4. Initial Labs:
   With this option, new users are assigned two initial labs based on the technology selected during the onboarding questionnaire

Initial Plan

If you choose the Initial Plan as your assignment strategy, you’ll need to create a training plan that users automatically receive when they onboard the platform. The training plan becomes active after the user completes the onboarding wizard.

Define a Training Plan for Your Organization

Create a training plan that aligns with your organization’s goals and the time your developers can commit.

We offer three suggested training plan formats:

• Lightweight Plan (10h - 16h)– suitable for organisations doing a secure coding program for the first time.
• Standard Plan (18h - 16h) – Balanced approach; ideal for most organisations.
• Intensive Plan (26h - 40h )– Comprehensive coverage; recommended for  security champions.

Choose the plan that best aligns with your objectives, then configure it using training iterations.

Each activity shown in the infographic below—except tournaments—must be created as a training iteration after the program launches. Training iterations are the core components of a training plan. You can stack them sequentially to build a structured, goal-driven experience.

Note: Check out this article on how to configure tournaments.

Setting Up a Training Plan

You can set an automated training plan for an entire year on the platform. To set up your training plan, please follow the steps below. 

Step 1: Navigate to the Management Interface and in the left navigation panel under Manage, click on Organizations. Then, select the Details button.

Step 2: In the Organizations Details page click the Assign Activities button under the Training Activities section and a modal window will appear.

Step 3: Click the Training Plan tab in the Modal window and then click the Add Iteration button.

A new training iteration setting page will open in the model window.

Step 4:

The training plan works by defining a list of training iterations. Training iterations can be based on dates or duration. Assignments are performed every eight hours and automatically applied to newly onboarded users if the Initial Plan strategy is selected.

Creating Iteration by Dates

You can specify a start and end date for the training iteration. This option is especially useful if you want to train a specific number of users within a defined timeframe (e.g., from now until December 31st).

To create an iteration based on dates, select Timeframe “by Dates” and provide start and end dates.

Creating Iteration by Duration

Step 4b: If you want to create an iteration based on duration, select “by Duration” and provide the number of days. Enter the number of days to pause before the next iteration begins.

Note: It’s not possible to have both iterations based on Dates and iterations based on Duration active at the same time.

Note: If you're onboarding users in phases, using the duration option rather than date-based iterations is recommended. With date-based iterations, newly onboarded users are automatically assigned to the iteration based on when they join. The duration option ensures users are assigned to the same training iteration regardless of when they are onboarded.

With the duration option, you can set the number of days for both the training iteration and the pause period once the iteration is complete. The next iteration will begin after the pause. Iterations will run in the order they are defined, but you can reorder them by drag-and-drop in the interface and select the "Update Order" button.

Training Iteration Activities

Using either Dates or Duration, you can assign Learning Paths or individual Labs. Labs are selected through our adaptive training algorithm.

Note: A Learning Path combines Knowledge Base articles and videos with our hands-on Labs to create comprehensive courses. After setting the initial baseline, you can use individual Labs through Adaptive Training to address any gaps and improve existing metrics.

Assign Learning Paths

To assign learning paths to users, select Learning Paths under Activities.

Under Assigned Based On, choose how the platform should determine which users receive each learning path:

1. Technology: Assign learning paths based on the core technology selected by each user during onboarding.
2. Tag: Assign learning paths based on tags already applied to users.

Assign Learning Paths by Technology

Use this option to automatically align learning paths with the core technology selected by each user.

Step 1: Under Activities, select Learning Paths.

Step 2: Under Assigned Based On, select Technology.

Step 3: In the table on the left, click Choose next to the required technology. The available learning paths for that technology appear in the table on the right. Click Select next to the learning path you want to assign.

For the first training iteration, you can use the default technology based assignments. Click Baseline to automatically populate the recommended learning paths.

When users first sign in, they select their core technology during onboarding. The platform uses this selection to assign an initial learning path designed to establish a baseline for their training metrics across common vulnerability categories.

You can also override the default selection and assign a specific learning path to a technology. Select the technology, then choose the required learning path from the table on the right.

Custom learning paths also appear in the learning path table. You can assign them to specific technologies or use them with tag based assignments.

Refer to the related article for instructions on creating a Custom Learning Path.

Step 4: Review your selections, then click Save.

Assign Learning Paths by Tag

Use this option when you want to assign learning paths to groups of users based on tags.

Before using tag based assignments, make sure the relevant tags are already applied to the users you want to include.

Step 1: Under Activities, select Learning Paths.

Step 2: Under Assigned Based On, select Tag.

Step 3: In the table on the left, click Choose next to the required tag. The available learning paths appear in the table on the right. Click Select next to the learning path you want to assign to that tag.

If some users do not have any tags, use the link in the warning message to view those users. Apply the appropriate tags before continuing so the platform can include them in the assignment.

Step 4: Review your selections, then click Save.

Assign Labs

To assign labs to users, select Labs under Activities.

The Adaptive assignment option is selected by default. Adaptive Assignment automatically selects labs for each user based on the security topics and vulnerability categories where they have the lowest competency scores.

You can specify how many labs to assign to each user. The platform then uses the Adaptive Assignment algorithm to select the most relevant labs based on each user’s current competency metrics.

We recommend assigning between three and five labs per iteration. Lab based iterations can also be shorter, typically lasting between 30 and 45 days.

For best results, consider using Adaptive Assignment after users have completed one or two learning path iterations. This gives the platform more training data to identify weaker competency areas and provide more targeted lab assignments.

Step 1: Under Activities, select Labs.

Step 2: Under Assign, confirm that Adaptive is selected.

Step 3: Enter the number of labs you want to assign in the input field. We recommend assigning between 3 and 5 labs per iteration.

Step 4: Review your selection, then click Save.

Note: The Adaptive Assignment algorithm selects labs for each user based on the security topics and vulnerability categories where they have lower competency scores.

Adding a Label to a Training Iteration

We recommend adding a label to each training iteration to make it easier to identify and manage.

When you create a new iteration, enter a descriptive name in the Label field. The label is then used throughout the platform to help distinguish one iteration from another.

Labels also appear in reports, making it easier to review and compare training data. In the Training Plan Progress Tracking report, you can use the label as a filter to quickly find the iteration you want to review.

Re-Assign a Training Iteration

You can re-assign expired activities by selecting the Re-Assign If Expired toggle. Users will be re-assigned training activities included in this iteration, which have been completed in the past but have now expired.

Reset Previously Completed Activities

If you want users to redo previously completed activities, create a separate iteration and toggle the 'Reset Previous Progress' option to 'Reset’.

Inclusions/Exclusions

Use the Inclusions/Exclusions options to control which groups of users are included in or excluded from a training iteration.

You can apply any of the following rules:

1. Exclude Users with any of these Tags
2. Exclude Users in any of these Teams
3. Only Include Users in these Teams
4. Only Include Users in these Subscriptions
5. Only Include Users with any of these Tags

These options allow you to target training more precisely by combining team, subscription, and tag criteria.

Note: If you use more than one inclusion or exclusion option, the platform applies them as an AND condition. This means a user must meet all of the selected criteria for the combined rules to apply.

For example: Exclude Users with any of these Tags AND Only Include Users in these Teams

Update a Training Iteration

You can edit, pause, or delete the iteration if necessary. When editing a training iteration, you can select the Replace Assignments toggle. If selected, any incomplete activities assigned to users will be updated with the revised selections. If not selected, changes will only apply to new users.

Note: This option will be visible only when you are editing a training iteration.

Activate/Deactivate a Training Iteration

Use the Activate or Deactivate button to change the status of a training iteration.

A status indicator shows whether the iteration is currently active:

• Green dot: The iteration is active. Click Deactivate to make it inactive.
• Red dot: The iteration is inactive. Click Activate to make it active.

The available button changes automatically based on the current status of the iteration.

Additional Help

If you require additional help setting up a training plan, please contact your Customer Success Manager or the Customer Success Team via success@secureflag.com to help create a plan tailored to your learning objectives.