We mailed puzzles to a few new CISOs this month. I couldn't get one to you, so here's the digital version.
3 rounds, about 2 minutes. Each round has one real and one fake. Pick the fake, then see the attacker's trick.
That's how we train at Anagram: people make the call themselves, then see the attacker's trick. Our modules work the same way, a few minutes each, across 45+ topics.
I'd love to hear how you're thinking about human risk and where training falls short. Open to 20 mins in the next few weeks? I'll work around your calendar.