TURN SECURITY INCIDENTS INTO LEARNING OPPORTUNITIES
Employee cybersecurity training must go beyond an annual PowerPoint presentation. Security culture improves when you turn incidents into teachable moments. How do you do so effectively without pointing fingers?
The scenario:
A client experienced a phishing attack. You need to communicate lessons learned without shaming anyone.
The prompt:
You are the senior account manager of an MSP, drafting a post-incident education email to a client’s employees. Here’s the incident report:
[ paste incident report ].
Write 150–170 words that:
Open with appreciation for participation and honesty.
Share the top three red flags missed.
Explain what to do next time: Hover, verify sender, report quickly.
Include the reporting method or a link to a short refresher.
End on a positive note.
Write in an upbeat, supportive tone. Don’t use technical jargon.