Fictional client — portfolio build · targets, not field results
Phishing Recognition Drill: Report, Trust, or Delete
Modern phishing is spellchecked, branded and patient. Annual training teaches slogans; attackers write Friday-afternoon emails.
The Audience
Office employees (all departments) in quarterly security awareness — plus security teams shifting training from slogan-recall to reflex-building.
Responsibilities
Attack-pattern modelling · genuine-control design · tell taxonomy · timestamp-as-tactic teaching — reflexes over slogans.
The Build
Email forensics simplified for training · distractor design · AI-assisted drafting (disclosed)
How I used AI in this case
AI generated phishing-email draft variants across the three attack families, all rewritten for calibration; attack-pattern modelling, the genuine-control design and the reflex taxonomy were authored by me. Disclosed.
LO1 · Apply
Identify the three attack families by their tells: domain construction, urgency + authority + secrecy, timing as tactics.
LO2 · Discriminate
Trust the deliberately genuine colleague email — reflex-reporting burns trust too.
LO3 · Perform
Read a sender domain right-to-left and catch lookalike construction.
By the end of this experience a learner can do the three things above — assessed by full-run correct calls (4/4 including the genuine control). Every interaction in the build exists to create the evidence for one of them.
Annual security training fails on two fronts simultaneously:
The gap: employees can recite "check the sender" but can't read a domain right-to-left, don't know that urgency+authority+secrecy is the signature, and have never practiced trusting a real email under suspicion.
Spellcheck
era is over — attacks are branded, patient, well-written
Reflex
reporting burns trust — false positives have a cost too
Timing
attacks cluster at Friday 16:47 and Sunday 21:34 — the human hours
The problem was the client's. These were mine — the design and build constraints that shaped the solution.
One email must be genuine
Reflex-suspicion that flags legitimate mail destroys the trust security depends on. Designing a genuinely safe colleague email that still looks suspicious — and scoring the flag as the error — was the hardest calibration in the kit.
Tells that survive scrutiny
Each attack family needs real, findable tells — timestamp anomalies, payment paths — without collapsing into a spot-the-difference game.
Reflexes over slogans
The debrief teaches four behaviors you can do, not five things you should fear. Every reflex maps to a specific moment in the drill.
A phishing drill with three attack families (credential harvest, trivial-fee payment trap, CEO gift-card fraud) and one deliberately genuine colleague email — because reflex-suspicion that flags legitimate mail destroys the trust security depends on. The debrief teaches four real reflexes, including reading timing as tactics.
The build itself, not a video about it — open it, make the calls, and read what each one costs.
From attack-pattern research to a playable drill — the stages below are the actual production sequence.
Mapped from how annual security training fails twice at once: employees recite 'check the sender' but can't read a domain right-to-left — and were never trained to trust a real email either. The map includes the genuine control on purpose.
The instructional-design foundations that informed this build:
Action Mapping (Clark)
Every behavior the kit produces is traced back to a business goal and a specific practice activity. See the linked action map for the full chain.
Cognitive Load Theory
The Three.js scene reduces extraneous load by visualising abstract systems. Learners focus on the decision, not the interface.
Situated Cognition
The environment matches the real context. Practice happens where the skill will be performed.
Kirkpatrick L1-L4
Evaluation designed for all four levels: reaction, learning, behavior, results. See the linked evaluation plan.
Pre-committed targets (agreed with stakeholders before build, not retrofitted):
"I will never read a sender the same way" — staff pilot, ≥4/5
L1 · Reaction
"I will never read a sender the same way" — staff pilot, ≥4/5
L2 · Learning
Full-run correct calls: 4/4 including the genuine control
L3 · Behavior
Phishing-report rate ↑; false-positive rate stable or ↓
L4 · Results
Successful phish compromise rate ↓ quarter-over-quarter
Annual security training produced slogan recall and nothing more — while the phishing arriving daily was spellchecked, branded, and patient. The missing layer was reflexes, including the reflex to trust a genuine email under general suspicion. The proposal was an inbox drill with a genuine control: four real-shaped messages — credential harvest, trivial-fee trap, CEO fraud — and one authentic colleague question that must NOT be reported, because false positives burn trust and cost the SOC real hours.
The annual awareness e-learning refresh considered · rejected
Already scheduled, already budgeted. Rejected because it had produced a decade of exactly the current click rates — awareness modules teach the words 'think before you click' and leave the 16:47 Friday reflex untouched.
A 'report everything suspicious' rule considered · rejected
Simple and memorable. Rejected because calibration beats paranoia: a desk that reports every genuine email trains itself out of credibility, and the SOC drowns in false positives while the real attack gets lost in the noise. The genuine control IS the lesson.