High-risk user training: He’ll Say Yes

High Risk User Training training in a 2:47 animated story. It covers Executives: whaling, deepfakes, travel, assistants. In English and Arabic, with captions you can switch on or off, and a scenario quiz at the end.

What your team will learn

Identify the four levers in a call aimed at a senior person: a face and voice you know, urgency, secrecy and a new number.
Respond to an urgent or secret request from a new number: hang up, call back on a number you already know, and let it wait if you can't reach them.
State that attackers study senior people and their assistants first, from public sources, and keep a leader's travel and schedule away from callers, public posts and out-of-office replies.
Report every attempt to the security team, even if nothing was sent.

The story

“He'll Say Yes” is the story at the heart of this course. Faisal (operations director) is the lead character; the learner watches the situation unfold, spots the warning signs, and sees the right thing to do. Set in Nakhlora Group, a fictional Gulf company.

Sample quiz question

A caller 'from the forum' asks Hessa for Faisal's hotel and his flight home. What should she do?

Give the hotel only, since the forum invited him there.
Share nothing about his travel; tell Faisal and report it.
Take the caller's name and email, then send the details.
Give the flight time but keep the hotel name private.

Correct answer: Share nothing about his travel; tell Faisal and report it.

Why: Never give a leader's travel or schedule to a caller, whoever they say they are. Hessa shared nothing, told Faisal and reported the call.

Full transcript

Transcript of the English video. The Arabic transcript is on the Arabic page.

He'll Say Yes [0:01] Attacker: He'll be busy. He'll know the voice. He'll say yes. [0:12] Hessa: Someone 'from the forum' called, asking for your hotel and your flight home. I said nothing and reported it. [0:23] Impersonator: Faisal, it's Jassim. New phone. Send me next year's draft budget, here, now. Keep it between us. [0:32] Faisal: Jassim, I'll call you back on your usual number. [0:36] Impersonator: No time, Faisal. This line only. [0:39] Faisal: Then it waits. [0:45] Faisal: It's Faisal. Did Jassim just call me?… In the board meeting since two? So it wasn't him. Thank you. [0:55] Faisal: Security team? Faisal Al Harthy. A video call with Jassim's face and voice, from a new number. I sent nothing. [1:05] Narrator: Urgent, secret, or from a new number? Hang up, and call back on a number you already know. [1:12] Narrator: And report every attempt to your security team, even if nothing was sent. [1:19] Narrator: The attackers knew Faisal's hotel, the CEO's face and voice, and when to call. Where did each come from? [1:30] Narrator: All three were public: the forum's welcome post, the CEO's four-minute keynote, and the forum's timetable. [1:39] Faisal: Hessa, thank you for saying nothing. Attackers study people like me first: our talks, our travel, our assistants. [1:48] Faisal: Four minutes of public video was enough to copy Jassim's face and voice. I knew the voice, and checked anyway. [1:56] Faisal: A new number, 'here, now', 'keep it between us'. Any one of them, and I stop. [2:04] Faisal: Ask the forum to take my hotel off their post. And my out-of-office should say I'm away, not where. [2:12] Hessa: And if it's really you, from a new number? [2:16] Faisal: Then you call me back on my usual number. If you can't reach me, it waits. [2:25] Narrator: Work for a leader? Never give their travel or schedule to a caller. Lead a team? Thank people who check. [2:34] Narrator: One habit: urgent, secret, or from a new number? Call back on a number you already know. Can't reach them? It waits.

Key facts

Length (English)	2:47
Length (Arabic)	3:15
Languages	English · العربية
Captions	WebVTT
Quiz bank	14
Questions shown	10
Pass mark	80
Lead character	Faisal — operations director
LMS id	2070