Phish-or-Pass, a new hire’s first inbox
I wrote this for new hires in their first week, who join in onboarding cohorts of 8 to 15 a month. Their general awareness training taught them to report anything that looks transactional. They report genuine mail as readily as real attacks, and the security team ends up sorting noise.
I want them to judge each message on its tells: the display name against the real address, the link under the cursor, and whether the message was expected.
The case runs in a copy of the Outlook inbox, where that decision is made. One of the four messages is a genuine DocuSign envelope that Sarah from People Operations announced an hour earlier, and nobody passes without keeping it.


