Security training is easier to remember when people practise a decision they might really face. A short exercise can help a small team test how it reports a problem, verifies a request, and asks for help. It does not need a complicated simulated attack.
Understand the idea
Choose one situation, such as an unusual invoice or a lost work phone. Set aside a short session and ask people what they would do next, using their real contact lists and procedures. Record where the process becomes unclear. The purpose is to improve the work, not to embarrass a participant.
- Scenario
Choose a disruption the team understands.
- Decision
Ask participants to make the next operational choice.
- Follow-up
Record gaps, owners, and a date to check progress.
A practical example
Imagine eight colleagues discussing a suspicious bank-detail change. Finance knows the callback rule, but the substitute approver does not know where supplier numbers are stored. The team fixes that gap and repeats the decision using the updated information.
What to do next
- Choose a familiar decision. Use one situation the team might face, such as an invoice change or a lost phone.
- Use the real procedure. Ask participants to locate the actual contact, approval rule, or reporting route they would use.
- Introduce one complication. For example, make the normal approver unavailable and ask how the team would proceed.
- Close the useful gaps. Assign a small number of changes with owners and dates, then test the revised process.
How to check the result
End with a few assigned improvements and a review date. The useful evidence is that the team can follow the revised process, not simply that everyone attended a session.
Everyone agreed we would contact support. Is that a useful result?
Confirm the actual contact route, the person authorized to use it, and what happens if that person is unavailable. Turn vague agreement into a checkable action.
Sources and useful guides
The following resources provide background and more detailed guidance. Use the sections that match your service and situation.
