Our work / Spot the phish
Compliance · Interactive activity
Spot the Phish: security training people actually finish
Instead of 30 slides about cyber threats, staff get a real-looking inbox and have to find the warning signs themselves.
Sample project · Meridian Credit Union is a fictional organizationThe challenge
Meridian’s annual security training was a long slide deck with a quiz at the end. Completion was mandatory, but staff clicked through it as fast as possible, and simulated phishing tests showed little improvement.
- Training felt like a box-ticking exercise
- Staff could recite the rules but missed real red flags
- Content needed to be easy to refresh every year
Our approach
We replaced the slides with practice. Staff inspect a realistic email and click anything that looks suspicious.
- Hotspot hunt: find five red flags hidden in one email
- Clicking a normal part of the email gets a response too, so guessing doesn’t work
- A rapid round of “phish or legit?” builds quick judgment
- New example emails can be swapped in each year without a rebuild
Try it
Find the red flags
This email landed in your inbox this morning. Click everything that looks suspicious.