Attack Chain drills

An Attack Chain drill shows a coordinated attack: the same story arrives by email, then a text message, then a phone call, each one pushing harder. The learner handles each contact, then looks at the whole timeline to see how the pieces connect.

Attack Chain drills are on the Attack Chain Drills tab under Content Management → Microlearning. You need Manage Attack Chain Drills.

What learners experience

1. Scene: a short setup explains their role and the week’s context.
2. The chain: each contact appears in order (email, text, call), and they choose how to respond to each one.
3. Timeline review: the whole campaign on one timeline. They tap what connects the contacts.
4. Reveal: red flags found and missed, plus how each decision was rated (Good call, Risky or Unsafe).
5. Response: report the whole chain together, not just one message.
6. Quiz.

Building an Attack Chain drill

Click Create Drill and pick a template: Vendor Bank-Change Campaign, Executive Wire Campaign, IT Account-Takeover Campaign, Auditor Data-Request Campaign or Custom Template. Then fill in:

• Scene & Persona: Drill Name, Scene Title, Scene Description, the Impersonated persona and their Claimed organization / role.
• The Chain: for each contact (Touch 1 — Email, and so on):
  • Timeline connective (optional), for example “Forty minutes later, your phone buzzes.”
  • Sender / caller shown and Address / number shown.
  • For an email, the Subject and Message body. For a text, the Message body. For a call, the Call script (one line per row).
  • The Decision prompt and each option (What the employee does), its rating (Correct, Risky or Wrong) and Feedback (shown in reveal).

The order of the contacts comes from the template. You can edit their content but not add, remove or reorder them.

Red flags

Under Configure Red Flags, choose from One Story, Three Mouths, Touches Vouch For Each Other, Channel Escalation, Compounding Deadlines, Identity Inconsistency and Unusual Channel For the Sender.

Scoring

Each decision rated Correct, each red flag found, the correct response and each correct quiz answer earns a point. Marking something harmless counts against the score. The drill is passed when the score reaches your Quiz Completion Threshold.

Tips

• Use this drill after people have done single-channel drills (Phishing, Smishing, Vishing). It teaches how the channels combine.
• Finance and executive assistants are the usual targets of the wire and bank-change scenarios.