What is it?
Part of KeenSec AI Studio. It turns a simulation interaction into a short, interactive learning page built on the cues the employee just saw.
AI Studio // Just-in-time learning
Turn the simulation itself
into an interactive teachable moment.
Most simulations end with "You failed" and a long course weeks later. AI Studio turns the moment after the click into a short, interactive lesson built on the exact cues the employee just missed.
Learning in the moment.
Not blame.
Show people what fooled them, right when it happens, and let them practise the safer habit.
● Short, in-the-moment lessons
● Supportive, not punitive
● Linked to the exact lure
APPROACH
Supportive
Explains instead of blaming
FORMAT
Short & interactive
Fits between tasks
SAMPLE LESSON PREVIEW
CUES FROM THE LURE
[CUE 01] Display name claims @vendor-corp.com, but it was sent from @v-billing-auth.net.
[CUE 02] Urgency: threatens a 4:00 PM shipment hold.
[HABIT] Verify bank details through a known contact, not links in the email.
APPROACH
Punitive
Anxiety and IT friction
LESSON TIMING
Weeks later
Generic annual videos
TYPICAL FAILURE SCREEN
PUNITIVE MODEL
[NOTICE] "ACCESS BLOCKED: You failed an IT security test."
[ASSIGNMENT] A long, mandatory slide course.
[OUTCOME] People dread simulations and hide genuine mistakes.Try it
See the lesson an employee sees.
Click the pins to find each clue.
AI Studio marks each trick in the lure and pairs it with a simple habit for next time.
Interactive sample. Scenarios and data are illustrative.
Click numbered pins to inspect clues
From:
Apex Global Logistics Billing
<remittance@apex-logistix-portal.com>
To:
ap-invoices@company.example
Subject:
ACTION REQUIRED: Revised Wire Remittance for Outstanding PO-98441
Dear Accounts Team,
Our banking partner has transitioned following a corporate entity restructuring. Effective today, all outstanding balances for Purchase Order PO-98441 must be processed to our updated remittance routing number.
Failure to confirm updated disbursement instructions by 4:00 PM EST will place automated vendor shipment dispatches on administrative hold.
Acknowledge Updated Banking Details →
Hover / Click to reveal actual target destination
STATUS: SIMULATION COMPLETED
Illustrative view · Sample data only
✦ AI STUDIO LESSON
CLUE 01 OF 03
Lookalike Domain Spoofing
WHAT THE ATTACKER DID
The attacker registered apex-logistix-portal.com (substituting 'x' for 'cs'), creating visual similarity to the authentic domain apex-logistics.com to bypass quick human inspection.
WHAT TO LOOK FOR NEXT TIME
Check the domain spelling carefully. Attackers often add words like -portal, -secure, or -support to domain names when authentic domains are already taken.
TECHNICAL CLUES
SPF / DKIM:
PASS (Attacker Domain Matches Sending Server)
Domain Age:
4 Days Old (Newly Registered Entity)
QUICK HABIT CHECK
Select the safest action:
If you received this supplier banking change today, what is the single strongest defensive step?
Right call.
Checking through a known contact, not the email itself, is the strongest defence against a fake bank change.
Sample score:
+15 pts (Vendor Wire Verification Habit Validated)
Why it works
A failure notice vs.
a teachable moment
The moment after a click builds either habits or resentment.
THE USUAL APPROACH
Punitive failure
Treats the simulation as a trap.
-
×A shaming screen
"You failed." No explanation of what fooled them.
-
×A generic course, weeks later
A long slide deck on unrelated topics.
-
×Fewer real reports
People stop reporting suspicious emails for fear of being caught out.
KEENSEC AI STUDIO
A just-in-time teachable moment
Treats the simulation as a chance to learn.
-
✓Reassurance first
"This was a training exercise." People relax, so they can learn.
-
✓Linked to the lure
Clues marked on the exact email, SMS or QR code they saw.
-
✓A quick habit check
Practises the safer action without derailing the workday.
The learning loop
Four steps from click to habit
One connected loop that respects people's time.
Stage 01
The interaction
An employee clicks a simulated email, scans a QR code or enters test credentials.
- Email, SMS, QR and more
- Channel context kept
Stage 02
The breakdown
AI Studio picks out the pretext, the cues and why this role was targeted.
- Attack cues tagged
- Role context highlighted
Stage 03
The teachable moment
The employee explores the clues on the lure itself, in a short and supportive lesson.
- Clues on the real lure
- Quick habit check
Stage 04
The follow-up
The result feeds Human Risk Analytics, and a comparable follow-up test checks the habit later.
- Progress tracked over time
- Follow-up test scheduled
Learning formats
Six ways to teach the moment
Each lesson fits the attack type and the employee's role.
01
Interactive
Clickable clue breakdowns
Step-by-step notes on the simulated email, SMS or QR code.
Format:
Short and interactive
02
Role Context
Why you were targeted
Explains why an attacker would aim this lure at their role.
Targeting:
Tailored to role
03
Sender check
Sender and domain check
Highlights lookalike characters and mismatched reply-to addresses.
Shows:
What looks wrong, side by side
04
Habit check
One-question habit check
A single decision that reinforces the right action.
Feedback:
Instant and positive
05
Your process
Your verification steps
Company-approved steps for checking a request through a known contact.
Aligned to:
Your own procedures
06
Multilingual
Multilingual lessons
Clear lessons in the learner's own language.
Coverage:
Indian, Southeast Asian, Chinese and European languages
At a glance
Key facts about just-in-time learning
What information informs the lesson?
The attack pretext and cues, the channel, the employee's role, and what they did: opened, clicked or entered test credentials.
What does the AI actually do?
It builds the clue-by-clue breakdown, the explanations and the habit check. A person reviews before anything is sent.
How does it connect with KeenSec?
Habit-check results feed Human Risk Analytics and help schedule comparable follow-up tests.
Let’s connect the dots
Turn every simulation into
a lasting habit.
Bring your awareness program, your reporting workflow, or the question your current metrics cannot answer.
Book a demo