INBOX / PRIORITY
to me · 9:17 AM
⋯
This message was sent outside your organisation.
TEACH YOUR PEOPLE TO
attack.
WATCH THEM LEARN TOdefend.
BattlePhish turns phishing awareness into a team competition. Everyone attacks. Everyone defends. Then everyone learns why the message worked.
PLAY AROUND↘
RED TEAM / ATTACKING180
ROUND02OF 03
BLUE TEAM / DEFENDING165
01 / PLAY A ROUND
The battle is the hook.
The learning is the point.
Take the attacking side for one round. Choose the message, see what happened, then break open the psychology behind it.
PHASE 01 / ATTACKER BRIEF
Pick the phish.
The Red Team are attacking. Choose the message most likely to survive a busy inbox.
YOUR PICK
PHASE 02 / LIVE EXERCISE
The message lands.
The winning message is sent through the phishing test tool your organisation already uses. The defending team clicks, reports - or lets it pass.
ROUND CLOSES IN02:47:18
DELIVERED24
RESPONSES— —
REPORTS— —
Make it belong.
Shape the belief.
Trigger the action.
“Pause before the Do. Verify the Context somewhere else.”
MANIPULATION TACTICS
02 / THE CORE INSIGHT
PASSIVE TRAINING ASKS
“Can you remember this?”
BATTLEPHISH ASKS“Can you use it against us?”
You learn what makes a message convincing.
Authority. Urgency. Familiarity. Timing. The structure stops being invisible.
You recognise the same structure in your own inbox.
One round on the other side teaches you more than another ten simulations would.
03 / CAMPAIGN RHYTHM
Three rounds.
Both sides.
One lesson that sticks.
A full campaign runs two to three weeks. Long enough for a bit of a story, short enough that people don’t drift off.
CAMPAIGN / 14–21 DAYS
ROLES SWITCH EVERY ROUND
ROUND 01
ATTACKRed Team
VS
DEFENDBlue Team
INTENSITYWarm-up
TEMPLATEFamiliar workflow
ROUND 02
ATTACKBlue Team
VS
DEFENDRed Team
INTENSITYEscalation
TEMPLATEConvincing copy of an internal email
ROUND 03
ATTACKRed Team
VS
DEFENDBlue Team
INTENSITYFinal
TEMPLATETeam-proposed scenario
RUN IT RARELY.
Every 6–12 months keeps it special. Run it monthly and it turns into another phishing test.
PLAYBOOK RULE / 0304 / SCOREBOARD LAB
Vigilance scores.
Convincing attacks score too.
The scoring system rewards people who report - and gives the attacking team credit when a message slips through. Both perspectives matter.
Example scoring
DEFENCE
−
ATTACK
=
ROUND SCORE
05 / FIELD NOTES
What running it taught me.
BattlePhish has been run for real. The rough edges are where these rules came from.
of people voted in the first run.
The campaign needed more pre-launch energy. The target is 80%+, supported by team identities and 1–2 weeks of hype.
Don’t use Netflix.
Consumer brands in work inboxes feel like spam. Use Slack, Jira, GitLab, calendars and internal workflows.
Make teams memorable.
“Team A” disappears from memory. Real names give people something to rally around.
Protect the reveal.
The scoreboard is satisfying. The psychology breakdown is the training. Never rush it.
06 / THE PLAYBOOK
Everything needed to run the battle.
BattlePhish is a format, not another phishing platform. It sits on top of the tools you already use and gives the campaign a structure people care about.
Try the formatWORKS WITH YOUR EXISTING PLATFORM
KNOWBE4+PROOFPOINT+GOPHISH+YOUR TOOL
They send and track. BattlePhish makes people care about what happened.
THE UNDERLYING MODEL
Context → Ask → Do
BattlePhish is the accessible way into Ask&Do thinking: understand the world, examine the request, and pause before the consequential action.
Explore Ask&Do