HUMAN-CENTERED ADVERSARY SIMULATION ● EDUCATION MODE
root@simulated-adversary:~$ ./demo03 --personalization▌
THE EMAIL THAT
KNOWS TOO MUCH.
Watch a generic phishing-style message gain credibility as familiar details are added. Everything in this lab is fictional and stays in your browser.
01 / CONSTRUCT THE SCENARIOFictional training data
Choose what the message knows about this employee.
No real emails are sent. No entered information is stored or transmitted.
03 / REVEAL THE METHODEDUCATION, NOT EXPLOITATION
FAMILIARITY IS NOT AUTHENTICATION.
Correct details may be publicly available, shared in conversation, or exposed in a breach. The clues below explain why the example might feel authentic.
THE DEFENDER'S PLAYBOOK
- Question unexpected urgency, access requests and changes to normal workflows.
- Verify via your organization's known portal, directory or help desk—not the contact information in the message.
- Check the full sender domain and destination. A convincing display name is not proof.
- Report suspicious messages. Early reporting is a positive outcome.
REMEMBER: YOU WERE BEING TAUGHT, NOT TESTED.
TRY A QUICK DECISION
A message mentions your manager and real project, then asks you to sign in through an unfamiliar link. What is the safest next step?