Training your people will actually finish.
Zuno is a tutor your employees learn with through conversation. It finds out what each person already knows, explains one idea at a time in the context of their work, and checks they've understood before moving on.
A profile name containing <img src=x onerror=…> should just appear as text. If the page tells the browser to read it as HTML, the error handler runs as code.
In your own words, what goes wrong when a name becomes an attack rather than just being shown?
The site trusts the name as HTML, so the browser runs it as code instead of showing it.
What XSS is: understood
Starts from what they know
A short warm-up about each person's role and experience sets the level, so experts skip the basics and newcomers aren't lost.
Explained in their context
Examples come from the work each person actually does, with diagrams, tables and quick checks where they help.
Progress you can trust
An outcome is marked understood only when someone explains it back, and team leads can see what's been covered.