Security Awareness Micro-Lessons and Consent-Based Phishing Drills for Offices

The problem with security awareness in small offices

Most real losses in small organisations start with a person, not an exploit: an accounts assistant who pays a fake invoice, a receptionist who reads out an OTP to a caller claiming to be from the bank, a teacher who reuses the school email password on a shopping site. Awareness training works when it is short, frequent and relevant. In small offices it is usually a single slide deck once a year, if that.

Staff in these offices live on WhatsApp, not in a learning management system. They will read a two-minute message; they will not log in to a portal and watch a 30-minute video.

What already exists and the gap

• KnowBe4: a large awareness library and phishing simulation console, sold per user per month. Strong product, but built for organisations with an IT admin to run it.
• GoPhish: free, open source phishing simulation framework. You run your own server, DNS and SMTP, and it has no training content or scheduling of lessons.
• Microsoft Attack Simulation Training: bundled only with higher Microsoft 365 tiers.
• Hoxhunt and similar: gamified training aimed at mid-size and large companies.

The gap is a lightweight tool that delivers lessons where small office staff already are, in their language, and runs drills with consent and dignity rather than as a trap.

What you build

Three roles: office owner, staff member, content editor (you, during the project).

1. The owner invites staff by phone number or email. Each person receives a welcome message explaining the programme and asking for consent to lessons and, separately, to drills.
2. Twice a week, staff receive a micro-lesson with one quiz question. Answers are recorded.
3. Once or twice a month, opted-in staff receive a simulated phishing message. Clicking it opens a teaching page; reporting it earns a thank-you.
4. The owner sees team trends and suggested next topics based on weak quiz areas.

All drill content must be plainly harmless: no credential collection, no fake login forms that store passwords. The landing page just says "this was a drill" and teaches.

The technically interesting part

Two things make this more than a CRUD app.

First, the ethics and privacy design. You must decide what you log (a click happened, not what was typed), who can see individual results, how consent is recorded and withdrawn, and how you prevent an owner from using drill results to punish staff. Write this down as a short data protection note and show how the code enforces it, for example by storing only aggregate counts once a drill closes.

Second, reliable scheduled delivery across two channels with different rules. WhatsApp business messaging requires approved templates and has limits on messaging users outside a service window, so the scheduler must choose channel, respect quiet hours and retry safely without sending duplicates.

How to evaluate it

• Learning: a 10-question quiz before and after four weeks; report the change in mean score.
• Behaviour: drill click rate and report rate in week 1 versus week 4 for the pilot office.
• Engagement: percentage of lessons opened and quiz questions answered per channel.
• Delivery: messages scheduled versus delivered, duplicates sent (target zero).
• Acceptability: a short anonymous survey on whether staff felt respected by the drills.

Suggested plan

1. Weeks 1 to 2: interview two or three office owners, write the consent and data note, pick topics.
2. Weeks 3 to 5: lesson content, data model, email delivery and quiz capture.
3. Weeks 6 to 8: WhatsApp integration, scheduler, report flow.
4. Weeks 9 to 10: drill engine and teaching landing pages.
5. Weeks 11 to 14: pilot, measurement and write-up.

Path to a product

The first customer is a small accounting firm, clinic or school that has already had a close call with a fake invoice or OTP scam. Price per seat per month, well below enterprise tools, with a free tier of lessons only. Insurers and banks that serve small businesses are a later channel, since they benefit when their clients get scammed less.

Scope warning

Do not build credential harvesting pages, even fake ones. Do not send drills to anyone who has not opted in, or to anyone outside the customer organisation. Do not build a full learning management system.

Learn what you need on Sefism

• Full stack roadmap : the web app, background jobs and messaging integration.
• Full stack cheat sheet : quick reference while wiring front end, API and database.
• CompTIA Security+ : its social engineering coverage is good source material for lessons.
• ISC2 Certified in Cybersecurity : the security basics your lessons will simplify.
• roadmap.sh: Cyber Security : a map of topics to pick lesson themes from.

Get help with this idea

Scoping a security project is mostly about deciding what you will not defend against and how you will prove the rest works. If you want a second opinion on scope, stack or your evaluation plan, a mentor can review it with you; you still build it yourselves. New to Sefism? Create a free account first.

• Discuss this idea with a mentor
• Send a query to Tauseef
• Book a 1:1 session