Phish Day

A 90-minute, 4-round basic Express simulation on phishing, access hygiene and the first hours of an account-compromise incident, for high-school Career and Technical Education in cybersecurity and IT support, work-based-learning placements in school technology offices and courses preparing CompTIA Tech+ and Certiport IT Specialist - Cybersecurity.

Ximena Castillo, 17, the fictional student IT intern at Pinto Creek Independent School District in Central Texas, works the week of Monday 13 September 2027 during a phishing wave aimed at staff and student accounts, after a sixth-grade teacher has typed his password into a fake sign-in page.

Round by round you decide how staff and students report fake emails and how accounts are protected, how backups are made and who has administrator rights, how the stolen account and laptop are contained and what payroll does with three direct-deposit change requests, and what is reported to the state and told to families; at each decision point the week and the next twelve months are projected again with the decisions taken so far.

Each round is scored on the cost of the week, hours of downtime, the expected loss over the next twelve months and trust and compliance, with student records exposed shown alongside; student records reached and not reported to the Texas Education Agency or not told to the families (Texas Education Code 11.175), or the list of affected students emailed to every family (FERPA, 34 CFR 99.30), caps the score.

English with Spanish.

An introductory simulation that assumes no prior knowledge of the subject, designed for undergraduate courses. It also works in vocational and high-school programmes and in onboarding sessions.