> Kit 13 · Don't Click · deliverable · designed and built by Wayne — instructional design portfolio

## The goal

Employees apply four suspicion reflexes to real inboxes within two weeks — flag-rate on attack mail up, false-flag rate on genuine mail flat.

## What people do instead

Awareness training taught slogans; employees either click everything or suspect everything — neither survives contact with a real inbox.

## The actions that close the gap

| # | Behavior | What it looks like | Where the artifact trains it |
|---|---|---|---|
| 1 | **Check the sender path before the message** | sender-domain inspection precedes reading | inbox drill |
| 2 | **Verify unexpected payment/gift-card requests out-of-band** | any payment ask triggers channel switch | attack family 2-3 |
| 3 | **Trust a genuine email — and say why** | genuine mail cleared with stated evidence | the genuine control |

## What this training will not do

It will not teach IT policy or run a phishing simulation on real staff — the drill is a safe inbox with designed families.

## How the artifact scores the actions

Debrief scores the four reflexes per email and names the one that was missed — slogans are never used.