Loading module…
Loading module…
Module 1 of 13
Rung one · the lens — a sensor, not a weakest link
Most serious attacks on an organisation do not begin with code. They begin with a person being asked to do something that looks, for a moment, entirely normal: reset a colleague's multi-factor authentication because "the line is down", let an inspector in "for ten minutes", pay a deposit to a new supplier before a deadline, open a CV sent for a real job advert, scan a notice about a new parking app. The course's subtitle puts it plainly — the most sophisticated cyber attacks start with a phone call or an email — and the public record agrees at the level it can be stated: recent editions of the Verizon Data Breach Investigations Report find a human element in a majority of the breaches they analyse, and the FBI's Internet Crime Complaint Center (IC3) has for years listed business email compromise among the costliest types of reported cybercrime. This course teaches social engineering — the manipulation of people into acting against their own or their organisation's interest — from one side only: the defender's. It explains how manipulation works so that people can recognise it, pause, verify and report it, and so that organisations can design processes that no single persuaded person can break. Read by a defender, every social-engineering attempt has six elements. The target is a person in a role, with the authority, access and habits that role brings; attackers choose roles, not personalities, and the service desk, accounts payable, the buyers, reception, HR and executives' assistants are targeted because of what they can do. The lever is the psychological pressure applied — authority, urgency, fear, reward, liking, social proof, reciprocity, commitment, curiosity — the force that pushes a decision from careful to quick. The pretext is the borrowed role or story that makes the request seem normal: a technician from the managed-service provider, a fire-equipment inspector, a supplier, the chief operating officer. The channel is how the attempt arrives, and this course groups channels into four lanes: email and messaging, voice and SMS, synthetic media (voice or video that may be generated by software), and the door — the physical approach to a site. The ask is the action wanted: a click, a credential, a payment, a reset, a door held open, a piece of information. And the verification gap is the place where a process lets one person act on one unverified request; it is the element an organisation controls most completely, and closing it is the most durable defence the course teaches. Defence works on every element, and it runs as a loop: recognise the lever, pause, verify by another route, report, and improve the rules and the training from what the reports show. The loop reduces to four questions that are the spine of this course: Who could be asked for what? What lever and pretext would make it feel normal? Where is the verification gap? Would we hear about it in minutes? One fictional organisation carries the whole course. Kestrel Motion, the servo-motor and drive maker you may know from earlier courses in this catalogue, has plants at Aldren and Brask in the Meridian Union, about 1,100 employees, an IT team of 9 that includes a security lead, one analyst and the service desk, a managed-service provider, Corvane IT Services, a managed detection and response (MDR) service (course 014's K6), a CFO, CEO, COO and head of HR, accounts payable and the buyers, reception at both plants, Brenholt Foundry, a subsidiary of about 210 staff owned since course 013, and the distributor portal built in course 017. Kestrel's human layer has a history, carried in here in one line each: course 014's F7, an authorised phishing simulation in which 14% of staff clicked and 4% entered credentials; course 014's Month-5 Brenholt incident, which began with credentials phished at Brenholt; course 017's CFO events, a supplier lookalike stopped by K8 in Week 3 and a voice request apparently from the CEO refused in Week 9; and course 018's AL4, a fake bank-change email in Week 16 quoting a real Lunde purchase order, refused under K8. After course 018's Week 26 review, the security lead and the head of HR agreed to own a human-layer programme jointly for 12 months — programme Month 0 to Month 12 — with the analyst as day-to-day lead, about 20 volunteer security champions, one per department and shift, and a year-one budget of about €40–60k (illustrative), mostly staff time and a training platform. The baseline at Month 0 was modest: reports went by forwarding to the service desk mailbox, and few people used it; the report rate in the course 014 simulation was about 9%; the median time from a phishing email's arrival to the first staff report was not known, because nobody had measured it; training was an annual 45-minute slideshow; the payment-change rule K8 had been in place since course 014; there was no written help-desk identity check for password or MFA resets; and visitors at Aldren and Brask signed a paper book, with no escort rule. The boundary comes first, because this subject teaches about deception. This is a defender's course. It never gives a manipulation playbook: no lure, script or pretext written so that it could be reused, no templates for phishing emails, calls or messages, nothing on impersonating anyone, cloning voices or faces, getting past reception, badges or help desks, or gathering information about targets, and no tooling for running attacks. Attacks appear only as what the target sees — the lever pulled, the red flags, the verification gap exploited — and the control that stops them. Example messages are short fragments, annotated with their red flags, never complete messages; phishing simulations appear only as an authorised, ethical, measured programme. Every judgement carries a probability from the course's seven-band yardstick — almost no chance (1–5%), very unlikely (5–20%), unlikely (20–45%), roughly even chance (45–55%), likely (55–80%), very likely (80–95%), almost certain (95–99%) — and a separate confidence of high, moderate or low (or not known); every claim is labelled fact, assessment or speculation; and every money and time figure is a range or marked illustrative.
The six elements are the periodic table of this course, and the map arranges them in the one layout that shows how they act on one another — so read it as a mechanism, not as a poster. Start at the centre, with the person in a role, because that is where every attempt is aimed. The card has four rows, and each is a reason that person is worth an attacker's effort. Role is what the person does: a buyer places orders, accounts payable pays them, the service desk resets access, reception decides who comes in, HR opens applications from strangers as part of the job. Authority is what the person may approve, and attackers borrow it by pretending to be someone who holds more. Access is what the person can reach — money, systems, doors, data — and it decides the size of the ask. Habits are the part most often forgotten: helpfulness, busyness and routine are not weaknesses of character but the conditions of ordinary work, and a request that matches a routine is processed in the routine's fast lane. That is the first question, who could be asked for what?, and it is answered role by role, never person by person: Module 6 (I6) publishes who may ask whom for what, and Module 12 (C1) maps every place where one person can act on one request. Now move left, to the four channel lanes. Each channel has a character a defender needs to know. Email and messaging gives an attacker scale, links, attachments and the look of an official document, but it also leaves a message that can be inspected, reported and searched for across the organisation; Module 4 reads it (F1–F6), including the technical controls that help — email authentication with SPF, DKIM and DMARC (course 016), filtering, and phishing-resistant MFA — and their limits. Voice and SMS gives an attacker pressure in real time: a caller can answer objections, a text arrives on a personal phone outside the email filters, and the number displayed on the screen proves nothing about who is calling (Module 5's V3). Synthetic media is voice or video produced or altered by software to resemble a real person; this course treats it at awareness level, because the defence does not depend on spotting a fake — it depends on verifying the request by another route whatever the voice sounds like (V4, V5). The door is the physical lane: tailgating, the visitor or inspector story, badges and uniforms that prove little, found media and planted QR codes (Module 7, D1–D6). The lanes matter because each one has its own verification gap and its own way of reporting, and because an attacker who is refused in one lane often tries another. Each lane carries , and every card has the same anatomy. The says who the attempt pretends to be or what story it tells. The names the main pressure — Module 3 explains why these pressures work on capable people (P1–P6), drawing on Robert 's (1984) for the principles of influence and Daniel 's (2011) for why pressure pushes decisions into fast, automatic thinking. The names the action wanted, and it is the most useful thing on the card, because the ask is what the defender can control: whatever the lever and the pretext, a reset, a payment, a door or a credential can be put behind a rule. That is the second question — — and its purpose is recognition, not imitation: a person who can name the lever in the moment ("this is urgency, and secrecy") has already begun to pause. Between the cards and the person sits the most important object on the map: the . Drawn , it means one person can act on one unverified request — the reset is done because the caller sounded right, the deposit is paid because the voice sounded like the COO, the door is opened because the uniform looked official. Drawn , it means the request must pass a (a call-back to a contact already on file, never the one in the request) or a (a manager's confirmation, a second approver for a payment, a host who booked the visitor). The gate is the third question — — and it is the element an organisation controls most completely, because it is a property of the process, not of anyone's alertness on a bad day. At Month 0 every gate on the map stood open except the payment-change gate that course 014's K8 had already narrowed; by Month 12 each lane's gate is drawn closed with the rules that closed it. Move right, to the : the lever and the red flags, because slowing down is normal and expected, by another route, in one click, and — the rules and the training learn from what was reported. Module 9 teaches the first three steps as a working habit (R1–R6), Module 10 the fourth (A1–A6), and Modules 11 and 12 the fifth (H1–H6, C1–C6). The arrow is drawn heavier than the others because it carries the fourth question — It runs to the , where reported messages are triaged, the same campaign is searched for across the mailbox estate, and containment begins; and from the queue, what was learned flows into the and the training, which close more gates. Each later module lights one part of the map: Module 3 the levers, Module 4 the email lane, Module 5 the voice, SMS and synthetic lanes, Module 6 the pretext line and the help-desk gate, Module 7 the door lane, Module 8 the payment ask and its gate, Module 9 the recognise, pause and verify steps, Module 10 the report arrow and the queue, Module 11 the people and their training, Module 12 the gates closed by process, and Module 13 the whole map, before and after.
Traced instance: Kestrel's first year of the human-layer programme. The programme starts after course 018's Week 26 review, jointly owned by the security lead and the head of HR, with the analyst as day-to-day lead and about 20 volunteer champions. At Month 0 the map is drawn honestly: one way to report, by forwarding to a mailbox; a report rate of about 9% in the course 014 simulation; no measure of time to report; annual slideshow training; K8 for payment changes; no written help-desk identity check; a paper visitor book. Between Months 1 and 4 eight programme rules close the gates. In Month 1: PR1, a one-click report button in email, plus a phone number and a chat channel, with every report acknowledged with thanks; PR2, verify by another route — any request to pay, change bank details, reset access, share sensitive data or open a door is checked through a contact already on file, never the one in the request, extending course 014's K8; PR4, two people for payments above a threshold and for any change of supplier bank details, formalising K8 and course 017's CC1; and PR8, blameless follow-up — anyone who clicked, entered a password or paid gets help, not blame, and the review asks what failed in the process. In Month 2: PR3, help-desk identity verification — password and MFA resets need a call-back to the number on file and the requester's manager's confirmation, with no resets on inbound calls alone; PR6, published request norms — what Kestrel's IT, finance, executives and suppliers will never ask by email, phone or message; and PR7, role-based micro-training in 10-minute modules each month, with extra tracks for finance, the service desk, reception, executives and their assistants, and plant engineers. In Month 3: PR5, the visitor rule — every visitor pre-booked by a host, badged and escorted at both plants: "no booking, no entry". The rules were tested by real attempts within weeks. SE1 (Month 3): a caller claiming to be a technician asked the service desk to reset a plant engineer's MFA "urgently, the line is down"; under PR3 the desk called the engineer back on the number on file and asked the manager to confirm; the engineer had asked for nothing; there was ; the attempt was reported to the MDR, and Corvane confirmed it had made no such call. a man in high-visibility clothing at the Aldren gate said he was a and asked to be let in "for ten minutes" without a booking; reception applied PR5, facilities had no booking, and the inspection firm named on his card, called on its listed number, had sent nobody; he left; the attempt was reported and facilities informed the police (fact). What he wanted is . printed notices with a inviting staff to register for a "new parking app" appeared in the Brask canteen; the first staff report arrived within about ; the analyst confirmed a credential-collecting page; the notices were removed, the page blocked and staff warned within ; people had scanned the code and entered passwords (fact). a , apparently from the , asked a buyer to move an order to a "new supplier" and pay a deposit "before the board hears"; the buyer applied PR2 and PR4, the COO had sent nothing, and ; whether the voice was synthetic is , and the response did not depend on knowing. a email to HR carried a "CV" attachment referring to a real job advert; of the HR and hiring-manager recipients, through PR1; the MDR quarantined the attachment across the mailbox estate; (fact). a supplier's genuine email account was taken over and used to send an invoice with — the supplier's breach, not Kestrel's; accounts payable applied PR2 and PR4, the supplier, called on its number on file, confirmed the takeover, was made, and the supplier was told through its known contact. Alongside the real attempts ran four , approved by the CFO and the head of HR and run quarterly by the analyst with the training provider, with no cruel lures — no bonus, layoff, health or family themes — and results reported only in aggregate (all figures illustrative, organisation-wide, no individual named or ranked): click 11%, credentials 3%, report 18%, median time to first report 14 minutes; 8%, 2%, 31%, 9 minutes; 6%, 1%, 40%, 6 minutes; 5%, 1%, 46%, 4 minutes. At the (illustrative) the record is plain: six real attempts, ; real-world reports rose from about a month to about , most of them harmless marketing or internal mail, accepted as the price of a sensitive sensor; the analyst's triage time per report was about with a simple queue; and two staff who had entered passwords in SI1 later became champions, with their agreement. The review names its as carefully as its results: Brenholt joined the programme only in Month 9 and its baseline is weaker; the night shift at Brask had the lowest training completion; executives' assistants asked for more scenarios. Its : continue for year two; bring Brenholt to parity; add for finance and IT administrators, following course 017's pattern; keep simulations quarterly; and retire click rate as a headline measure in favour of and . Notice what the map does claim. "None succeeded" is a fact about six attempts; that the programme those outcomes is an , held at moderate confidence, because nobody can rerun the year without the rules. And the synthetic-media lane stays honest: SE4 is drawn there only as a question mark, because a voice whose origin is not known cannot be called a deepfake.
The gap between the two views is the whole value of the course, and it is worth being fair to the "weakest link" view first. It is not stupid. It begins from something true — most breaches involve a person somewhere, and the Verizon report's finding of a human element in a majority of them is often quoted to make exactly that point — and it reaches for the tools that are easiest to buy: an annual course, a phishing test, a policy that tells people to be careful. The trouble is structural, and each of its habits fails in a specific way. The first is blaming whoever was fooled. People who are blamed stop reporting, and an organisation that does not hear about the attempt that worked cannot contain it; Module 3 (P6) explains why capable people fall for well-built pressure, and why that is not stupidity. The second is one annual slideshow for everyone. The service desk, accounts payable, reception and executives' assistants face different asks, and a 45-minute session a year cannot rehearse any of them; Module 11 (H1, H2) replaces it with short, frequent, role-based learning. The third is gotcha simulations with league tables. A simulation built to catch people out, using a fake bonus or a health scare, teaches staff that the security team is an adversary, and a public ranking turns a measure into a humiliation; Module 2's B2 and B3 set the line — authorised, proportionate, no cruel lures, results private. The fourth and fifth are red flags nobody can name and hurry as the norm: a person told only to "be careful" has no words for what is wrong and no permission to slow down, so the lever works. The sixth is verifying with the details in the request — calling the number in the email, replying to the message — which checks the attacker's story against the attacker's own contact details. The seventh is no easy way to report: at Month 0 Kestrel's channel was forwarding to a mailbox, few used it, and nobody knew how long it took to hear about an attack. The eighth is processes where one person can pay, reset or open a door on one request, and it is the deepest failure, because it makes the whole organisation as strong as its most tired person on its busiest afternoon. The public record shows the pattern at the level it supports. Twitter (2020): employees were targeted by phone, which led to the takeover of high-profile accounts. Uber (2022): the intrusion was reported to have begun with a contractor's credentials and repeated MFA prompts, plus a message impersonating IT support. MGM Resorts (2023): the attack was widely reported to have involved a call to the IT help desk. : an employee was reported to have transferred about after a video call with deepfaked colleagues. : the company disclosed a loss of about to business email compromise. These are public cases, stated only at the level public reporting supports; what they share is not a gullible victim but a — a reset, a prompt approved, a payment made on one channel's say-so. Kevin 's (2002), a historical account of social engineering, shows how long the pattern has been known; this course reads the same territory from the receiving end only. The replaces each habit with a discipline, and Kestrel's year shows each one at work. It : in SE3 the first staff report arrived within about 20 minutes, and in SE5 nine of fourteen recipients reported within 15 minutes, which let the MDR quarantine the attachment before anyone opened it. It (PR7), with extra tracks for the roles most often targeted. It , with no cruel lures and aggregate results, so that SI1 to SI4 measure the organisation rather than shame its members. It — urgency, secrecy, authority, an unusual channel, an unusual ask (R1) — and (R2): the buyer in SE4 was not being difficult in declining to act on "before the board hears", but following a rule everyone knew. It (PR2): a contact already on file, never the one in the request. It (PR1). It (PR3, PR4, PR5), so that no single persuaded person can complete a reset, a payment or an entry. It (PR8): the two staff who entered passwords in SI1 later became champions, which is what a blameless culture looks like when it works. And it (B4) — report rate and time to report, not only clicks — which is why the Month 12 review retired click rate as a headline. Neither view makes people immune to manipulation; the difference is what happens next. The figure makes it concrete on . In the weakest-link version, a counterfactual, the service desk hears a plausible technician, an urgent outage and a reasonable ask, and resets the engineer's MFA on the call: one person, one unverified request, a gate wide open, and nobody reports because nothing seemed wrong. In the version that happened, PR3 required a call-back to the engineer's number on file and the manager's confirmation; the engineer had asked for nothing; there was no reset; and the MDR and Corvane heard about it the same way any report is heard — because the rule made the right action the easy one.
The course is thirteen modules, and their order follows the four questions — with one deliberate choice at the start. The boundary comes before the method, because a course about deception is useful only to a reader who can be trusted with it, and because the most common harms of awareness work — cruel simulations, shamed staff, public rankings — are done by defenders, not attackers. After this orientation, Module 2, The Defender's Discipline & Boundary, installs six commitments that govern everything else, tagged B1–B6 and cited by those tags throughout. B1, defend, never deceive for gain: recognition and defence only, no reusable lures, scripts, pretexts or bypass methods. B2, authorised and ethical testing: simulations only with organisational approval, proportionate, with no cruel or exploitative lures, and never outside the organisation. B3, privacy and dignity: individual results stay private, with no naming, ranking or public scoreboards, and personal information about staff is never used as lure material. B4, evidence over anecdote: measure report rate and time to report, not only clicks, and state results honestly with their limits. B5, blameless reporting: the person who reports — including their own mistake — is thanked and helped. B6, proportion: vigilance without a culture of suspicion, so that normal helpfulness is protected by process rather than destroyed by fear. Module 2 is a gate: the rest of the course assumes it. Module 3, Why People Comply — the Psychology of Influence, answers the second question from the inside: the levers of influence, after Cialdini's principles at a general level (P1); fast and slow thinking under pressure, after Kahneman (P2); the pretext — borrowing a role, a story, a relationship (P3); helpfulness, hierarchy and workplace norms (P4); emotional triggers — fear, reward, curiosity, shame (P5); and why capable people fall for it, and why that is not stupidity (P6). Modules 4 to 8 walk the channels and the asks, answering who could be asked for what? lane by lane. Phishing, Spear Phishing & Messaging Lures covers the anatomy of a phishing message, read for red flags (F1); spear phishing — research-based targeting, seen from the target's side (F2); links, attachments, QR codes and credential pages — what the defender checks (F3); messaging apps and collaboration tools as channels (F4); the technical controls that help — email authentication, filtering, phishing-resistant MFA (F5, with course 016's R6 and course 014's K1); and the limits of filters, and why people remain the last check (F6). Voice, SMS & Synthetic Media covers vishing — the phone call as a pressure channel (V1); smishing and messaging pretexts (V2); caller-ID and sender spoofing, and why the display proves nothing (V3); deepfaked voice and video at awareness level, with the 2024 Arup case (V4); call-back on a known number and agreed verification phrases (V5); and executives and their assistants as targets (V6). covers the impersonated colleague, boss or executive (I1); the impersonated supplier, partner or customer (I2); the help desk as a target for password and MFA resets (I3); information gathering by "harmless" questions (I4); identity verification that does not rely on what an attacker can learn (I5); and who may ask whom for what — published request norms (I6). covers tailgating and held doors (D1); the visitor, contractor and inspector pretext (D2); badges, lanyards and uniforms, and why they prove little (D3); found media and planted QR codes (D4); reception, visitor management and escorting (D5); and sites, plants and shared buildings as the physical layer of course 016's map (D6). covers the anatomy of a payment fraud — the lever, the pretext, the change of bank details (W1); supplier impersonation and lookalike domains (W2, with course 017's E2 and course 018's AL4); executive impersonation and the "confidential deal" (W3); payment controls — two people, call-back, no exceptions (W4, building on course 014's K8); what to do in the first hour after money moves — bank recall, police, insurer (W5); and business email compromise as the costliest category in public reporting, after the FBI's IC3 (W6). , is the moment of the request: the red-flag set — urgency, secrecy, authority, unusual channel, unusual ask (R1); the pause, and making it normal to slow down (R2); verifying by another route, never with the details in the request (R3); the "it is probably fine" trap (R4); decision aids at the point of request — banners, checklists and agreed ways of saying no (R5); and what to do when the attacker already knows a lot about you (R6). answer the fourth question. covers one easy way to report — button, number, chat (A1); triage of reported messages in the analyst's queue (A2); from one report to many — searching for the same campaign (A3); containment — blocking, resetting, warning colleagues (A4); the blameless follow-up for someone who clicked or paid (A5); and feeding reports into detection and threat models, after course 017 (A6). covers role-based training for finance, the help desk, reception, executives and engineers (H1); short, frequent and relevant learning over long and annual (H2); authorised phishing simulations — ethics, consent and cadence (H3); measures that matter — report rate and time to report over click rate (H4); a culture of praise for reporting and no shaming (H5); and executives and leaders as role models (H6), with , the US guidance on security awareness and training programmes, as a general reference. close the gap and prove it. covers mapping the verification gaps — every place where one person can act on one request (C1); two-person and out-of-band rules for money, access and data (C2); help-desk identity verification and reset controls (C3); phishing-resistant MFA, such as FIDO2 security keys, and least privilege that limit the damage when a person is fooled (C4); visitor and site controls (C5); and reviewing the programme — attempts, near misses, changes (C6). runs the whole method on Kestrel's year — the baseline and the map, the rules and the reporting channel, the attempts that were stopped, payment and executive impersonation, training and simulations, and the Month 12 review — and compresses it into a master equation and a self-assessment. Every module from 2 to 12 is built the same way: six , the sub-techniques of its rung, each with a tag (Module 3's P1–P6, Module 9's R1–R6, and so on) and each dissected through six fixed fields — it is, its (drawn on the human attack surface map), the as a numbered procedure, its and failure modes, to use it and when not, and it connects to the rest. Kestrel is traced through every atom with labels that never collide with the atom tags: programme rules , real attempts and simulations . Earlier courses' work is cited by course: course 014's (the first simulation), (MFA), (the MDR service) and (payment-change verification); course 017's and and its portal event ; and course 018's . The world is fictional so that a whole year of a human-layer programme — attempts, simulations and gaps — can be shown without exposing any real organisation or person; Kestrel's people are named by role only. Where the course uses real-world material — the books, reports, standards and public cases named above, and MITRE ATT&CK's "Phishing" technique name — it stays at the level the public record supports, hedges its figures, and invents no statistics.
This is a dissection course, not a collection of horror stories: every defence is broken down to its mechanism and its procedure, so you finish not with a vague sense that "anyone can be fooled" but with a repeatable way to find an organisation's verification gaps, close them by process, and build a workforce that reports in minutes. Three things to hold onto as you go. First, name the lever, not the person. The red flags of a social-engineering attempt are properties of the request — urgency, secrecy, borrowed authority, an unusual channel, an unusual ask — not of the person who received it, and a defender who looks for levers can teach others to see them, while a defender who looks for culprits teaches everyone to hide. Kestrel's two SI1 password-entrants who became champions are the course's evidence that this works. Second, verify by another route, and design so that verification is not optional. A rule that says "check through a contact already on file" works only when the process will not let the action happen without it: PR3 stopped SE1 because no reset could be done on an inbound call alone, and PR4 stopped SE4 and SE6 because no single buyer or clerk could move money or change bank details. Whenever the course meets a person who must judge a request alone, it asks the third question — where is the verification gap? — and looks for the process change that closes it. Third, hear about it in minutes, and thank whoever tells you. The value of a report falls quickly with time: SE3's notices were removed and the page blocked within 2 hours because the first report came within about 20 minutes, and SE5's attachment was quarantined before anyone opened it because nine people reported within 15. Measure report rate and time to report, and say not known when it is — Kestrel's Month 0 time to report was not known, and the honest baseline is what made the Month 12 improvement credible. Two notes on scope. Every example in this course is shown from the receiving end — what the target sees, the lever it pulls, the gap it exploits, and the control that stops it — and nothing in it is written to be sent; if a passage would help someone manipulate a person, it does not belong in a defender's course. And the course teaches method, not any jurisdiction's law: wherever a question turns on employment law, data protection, monitoring of staff or contact with the police, the course's answer is to take it to counsel and, where they exist, to staff representatives. Hold those three and the rest is detailed machinery. Module 2 makes the discipline explicit first, because a course about manipulation is only useful to a defender who can be trusted never to practise it.
Before the psychology and the channels are explained, the course installs the discipline that governs the whole method. Module 2 is the social-engineering defender's boundary, in six commitments tagged B1–B6: defend, never deceive for gain — no reusable lures, scripts, pretexts or bypass methods (B1); authorised and ethical testing — simulations only with organisational approval, proportionate, with no cruel lures (B2); privacy and dignity — results private, no naming, no public scoreboards (B3); evidence over anecdote — report rate and time to report, stated honestly (B4); blameless reporting — whoever reports, including their own mistake, is thanked and helped (B5); and proportion — vigilance without a culture of suspicion (B6). The human attack surface map is a powerful instrument; Module 2 is the specification of how it may be used, and the reason a course about manipulation makes its readers harder to manipulate rather than better at manipulating.
The signature image of the course: Kestrel Motion's human attack surface at programme Month 12, read from left to right. On the left, the four channel lanes — email and messaging, voice and SMS, synthetic media, the door — each carrying the real attempts of the year as attempt cards: SE5 and SE6 in email, SE1 and SE4 on the phone, SE2 and SE3 at the door. Each card shows its pretext line, a LEVER chip (this module's reading of the main pressure, an assessment) and an ASK chip. The synthetic-media lane holds no confirmed Kestrel case: whether SE4's voice was generated is not known, and the public Arup case (2024) stands in as a dashed reference. At the end of each lane sits the verification-gap gate, drawn closed, with the programme rules that closed it. Every lane converges on a person in a role — role, authority, access and habits — whose defence loop runs recognise, pause, verify, report and improve; the report arrow flows to the analyst's queue and back into the rules PR1–PR8. The four numbered circles mark where the four questions are answered; the bottom lines contrast Month 0, when every gate was open, with Month 12.
The transformation the course produces. The "weakest link" view treats people as the problem: it blames whoever was fooled, trains once a year with the same slideshow for everyone, runs gotcha simulations with click-rate league tables, leaves red flags unnamed and hurry normal, verifies with the details in the request, offers no easy way to report, lets one person pay, reset or open a door on one request, and punishes mistakes. The "human sensor" view trains by role in short modules (PR7), runs authorised simulations with aggregate results (Module 2's B2 and B3), teaches red flags people can name and a pause that is normal (Module 9's R1 and R2), verifies by another route (PR2), makes reporting one click with thanks (PR1), puts two people and a call-back on money, resets and doors (PR3–PR5), follows up without blame (PR8) and measures report rate and time to report (B4). On SE1 (the weakest-link version is a counterfactual), one resets a stranger's MFA on the call; the other calls the engineer back, finds the engineer asked for nothing, and reports.
How the course is built. Phase 1 sets the lens and the line (Modules 1–2). Phase 2 explains why people comply — the lever and the pretext of question 2 (Module 3). Phase 3 reads the channels and the asks — who could be asked for what? — email and messaging, voice, SMS and synthetic media, pretexting and impersonation, the physical door, and payment fraud (Modules 4–8). Phase 4 is the moment of the request: recognise, pause, verify (Module 9). Phase 5 makes sure the organisation hears about it in minutes and learns from it: reporting and response, training and simulations (Modules 10–11). Phase 6 closes the verification gap by process and runs the whole method end to end (Modules 12–13). Under every rung run the six commitments of Module 2, B1–B6.