Kit 13 · Don't Click · deliverable · designed and built by I Wayan Usada — instructional design portfolio
Employees apply four suspicion reflexes to real inboxes within two weeks — flag-rate on attack mail up, false-flag rate on genuine mail flat.
Awareness training taught slogans; employees either click everything or suspect everything — neither survives contact with a real inbox.
| # | Behavior | What it looks like | Where the artifact trains it |
|---|---|---|---|
| 1 | Check the sender path before the message | sender-domain inspection precedes reading | inbox drill |
| 2 | Verify unexpected payment/gift-card requests out-of-band | any payment ask triggers channel switch | attack family 2-3 |
| 3 | Trust a genuine email — and say why | genuine mail cleared with stated evidence | the genuine control |
It will not teach IT policy or run a phishing simulation on real staff — the drill is a safe inbox with designed families.
Debrief scores the four reflexes per email and names the one that was missed — slogans are never used.
Prefer the source? Download the raw markdown.