Security X-RayA safe practice version of a real attack
Why this matters
This module is about an attack called business email compromise, or BEC. A hacker uses a normal-looking work request to make someone act. There are many kinds. This is one common example.
Your learning goal
You do not need to memorise a checklist. Practise noticing when a normal-looking request is worth stopping to check — or worth reporting.
How this module works
This is a recording of a real kind of attack, step by step. At the start you may not be able to tell whether the request is an attack or just an unusual work email. At each step, say what you would do, based on what you know so far.
Say what you notice and what you think it means. Security X-Ray asks you questions instead of giving answers.
Your answer marks where the attack could have been stopped. The replay carries on safely, so you can see every step.
How you participate
Everyday words are fine. The Security X-Ray assistant asks you questions about your thinking. It will not tell you the answers.
During the replay, turn on Security X-Ray to highlight the details worth looking at. Select each one to see what it means.
Short practice
Tell us what you think, and the scenario unlocks.
Your scenario
Alex is a made-up colleague. Alex is working with outside consultants from ACME, a made-up company, on a forecast of what AI will cost and save. Senior managers are watching the work closely. Alex is working late when an email arrives.
Safe simulation: Everything here already happened, and none of it is real. No real person, account or file is involved.
The attack replay
Two messages are unread. The request came from a real ACME user email that a hacker had got into.
Recorded message · simulation
Hello everyone,
Planned maintenance on the building's electrical supply takes place next Saturday. The office will be closed for the whole day and badge access will be switched off.
Nothing is needed from you. Please take anything you need for the weekend home with you on Friday evening.
Thanks,
Charlie
Recorded message · simulation
The attack replay continues
In the replay, Alex missed the warning signs and opened the shared folder. It held one file.
| Name | Shared By | Date Shared | Activity |
|---|---|---|---|
| AI Forecast Benefits.xlsx.urlInternet shortcutShared by Jordan Lee | Jordan Lee | Today |
The attack replay continues
The link opened a convincing sign-in page. You cannot type a password anywhere in this simulation.
to continue to OfficeHome
In this simulation, you cannot type a password here.
The attack replay continues
Alex had just typed their username and password, so an approval request in Authenticator was the next thing they expected.
What Alex knows: Alex is at home in Lakeside, more than 500 km from Northbridge.
Enter the number below in Microsoft Authenticator to sign in.
47OfficeHome · Northbridge, Fictionland · 21:49
TRAINING SIMULATION
Company account
alex@company.invalid
Enter the number shown on the sign-in screen.
The attack replay continues
This is what the hacker wanted Alex to see. A real-looking file at the end makes the earlier steps feel safe. It does not make them safe.
| Initiative | Current cost | Forecast benefit | Confidence |
|---|---|---|---|
| Support automation | $420,000 | $165,000 | High |
| Document processing | $310,000 | $98,000 | Medium |
| Forecasting | $275,000 | $84,000 | Medium |
| Total | $1,005,000 | $347,000 | Review |
What you did
These are the moments Alex could have stopped. This is not a test score.
Pick what would make you stop, and what you would do. That is the whole thing — you do not have to write anything.
What would make you stop next time?
Add a second thing, so your plan works earlier
What would you do?
Optional — your own words
One last look
Sent to your organisation's security team. How many clues you opened, your ratings and your timings are not included.