The attack that knew your name.
Phishing training usually teaches people to spot a clumsy email from a stranger. The attacks that work now are neither clumsy nor from strangers.
The challengePhishing training built for yesterday’s attacks
The client needed every employee to detect, avoid and report phishing in every form it takes: email, text messages, phone calls, QR codes. The usual answer is a list of warning signs and a quiz, and most people finish it believing phishing happens to careless people. Meanwhile, attackers do their homework. They know your name, your job and what you care about, and they write without a single spelling mistake. Training that is less personal than the attack prepares people for the attack of ten years ago. And there was a second problem. People who get caught tend to stay quiet, out of embarrassment, which is exactly what attackers count on.
What we deliveredPhishing awareness training that attacks you first
- 1An Alignment Brief with the client’s security team: the three things people had to do, detect, avoid and report, and the one that mattered most, making reporting a habit.
- 2A Story Blueprint built on one idea: the course attacks you first and teaches you afterwards.
- 3A 20-minute interactive phishing eLearning course in three scenarios, a phone call, an email and a QR code, each one built on what the learner had just told the course about themselves.
- 4A host character who unpacks each attack after it happens, tips people can save as a PDF, and a final quiz that tests judgement, not vocabulary.
The idea, and why it workedA personal attack first, then the lesson
Before the course begins, it asks three questions: your name, your role and one small personal preference. A few screens later, the phone rings. The caller says they’re from your bank, uses your name, confirms that small preference to prove they’re genuine, and asks for your email address to cancel a suspicious payment. Then a job applicant writes to you about a position exactly like yours, CV attached. Then a flyer with a QR code turns up in the car park. Every scenario uses what you shared, the way a real attacker uses what you post. If you spot the trap and press report, the course congratulates you, then politely asks you to click anyway, for the sake of the lesson. After each attack, it shows you which feeling was used against you, urgency, fear or curiosity, and what to do instead: pause, verify, report. At the end, the details you gave are deleted. That’s the last lesson.
It worked because people stopped looking for typos and started noticing how a message made them feel. A personal attack is hard to imagine until you’ve lived through one. Better to live through the first one in a course.
