Dont Click — Kit 13

Theme: Signal Blue (dark, terminal) · Audience: office employees (all departments) · Artifacts: drill.html (2D) · 3d.html + drill.js + dc-office.js (3D office: your inbox and the queue upstairs) · shared message file mails.js

One-line: a phishing drill with three attack families and TWO deliberately genuine emails — because reflex-reporting burns trust too.

Why this kit exists

Annual security training produces slogan-recall; modern phishing is spellchecked, branded and patient. The missing layer is reflexes — including the reflex to TRUST a real email under general suspicion.

What the artifact does

Five inbox messages in random order: credential harvest, trivial-fee payment trap, CEO gift-card fraud, a genuine colleague question and a genuine IT notice from a subdomain of the company's own domain. For each, the learner names the registered domain (read right to left), then reports, verifies or trusts it. Pass = 12/15 with nothing lost and at most one genuine message reported. The 3D version puts the skill where it happens: your hot desk in Nordwind’s open-plan office, with the mail client on the laptop and the light following each message’s arrival time. You select the registered name in the sender address on the screen; the address then lifts off and re-orders right to left (ending › registered name › subdomain › mailbox) and is checked against the printed “Our domains” card on the desk. Report sends it to the security team’s queue upstairs, where a reported genuine mail visibly waits ahead of the real attacks; Verify uses your phone; Trust opens the page the attack leads to. Frames from the build are in storyboard.md.

The design decisions worth noticing

• The genuine control — the signature design choice; calibration beats paranoia, and false positives have a real SOC cost
• The IT pair — a lookalike IT mail and a genuine IT mail from it.nordwind.example: only right-to-left reading separates them
• Timing as pressure — timestamps are part of the attack design (late Friday, Sunday night), taught as pressure, not as a statistic
• CEO-fraud realism — 'discreet' and 'bypass the normal route' taught as the two magic words of executive fraud

Honest limitations

All senders/domains are fictional (reserved .example domains). Forensics are deliberately simplified — real verification belongs to the SOC; the trainer builds the reflex layer.

Part of I Wayan Usada's learning-design portfolio · all clients and scenarios are fictional composites built from realistic domain patterns · drafted with AI assistance and fully rewritten, fact-checked and owned by a human.

Process deliverables

• action-map.md — Action map — the behaviors the artifact must produce, traced to the business goal
• storyboard.md — Text-based storyboard — the scene plan written before build
• visual-mockups.md — Visual mockups & style guide — mood, type, key screens, component decisions