Albert Koffi Holali AdamaviPause and Verify: a two-hour phishing awareness course
A design document for a self-paced course that teaches employees to spot, verify and report phishing. It turns a recall-based annual slide deck into realistic practice, and it treats accessibility as a design input in every ADDIE phase.
- Role
- Instructional designer, working alone
- Audience
- About 800 staff at a composite mid-sized Ontario employer
- Format
- Two-hour self-paced web course, six modules of 25 minutes or less
- Status
- Design document in progress
This is a design-stage portfolio project for a realistic composite organization, with evidence drawn from published research and government guidance.
The course in six modules
Six modules, 120 minutes in total, none longer than 25 minutes. Select a module to read what learners do.
1. Hook and stakes (10 min)
Learners make a gut-call on a realistic Friday-afternoon invoice email before any teaching, then see a short, blame-free reveal and a 120-second captioned explainer on why urgency works.
2. Learn the cues (20 min)
The Pause, Verify, Report routine and five warning signs, taught through two annotated worked examples. Learners then complete the marking themselves on two more.
3. Practise: email and web pages (20 min)
Five branching scenarios, from easy to hard, with explanatory feedback after each.
4. Practise: text, QR codes and phone (20 min)
Five more scenarios, including a text with a QR code, a voice call and a mixed case. Hints fade as scenarios get harder.
5. Verify, report and recover (25 min)
Four verification scenarios, a simulated report flow, an “I already clicked” recovery path, a short consequence case, a personal commitment and a one-page job aid.
6. Check (25 min)
A fifteen-item, untimed scenario assessment, with targeted review links. Scores are not reported to managers.
My role
I am the only designer and developer, so the document covers every ADDIE phase: analysis, five objectives, a six-module sequence, media choices, assessment, a six-week build plan, delivery, accessibility testing and an evaluation plan.
The design challenge
Awareness campaigns often raise knowledge without changing behaviour, and AI now writes polished phishing messages, so old cues such as clumsy spelling no longer give attackers away. The gap is not information. Employees need a practised routine: pause on an unexpected request, verify it through a separate channel, and report it quickly.
How I worked, step by step (ADDIE)
These stages follow the ADDIE design process. The full design document justifies every decision against research.
- 1
Analyze
I defined the gap as behavioural, not informational. I profiled a diverse audience (varied digital confidence, disability, English as an additional language, little time, fear of blame) and used a task analysis of notice, pause, verify, report and recover.
- 2
Design
Five objectives (four at the apply level) drive the sequence, with scenario practice, worked examples, faded support and a fifteen-item assessment aligned to the objectives. I budgeted the 120 minutes activity by activity, with a buffer.
- 3
Develop
One person builds it in semantic HTML, CSS and JavaScript, in vertical slices. Each scenario is written once as structured data that generates both the interactive screen and the text-only version, so the two cannot drift apart.
- 4
Implement
One link, no login, no identifying data, with progress saved in the learner’s own browser. Launch comes with a leader’s blame-free message and a note for managers, and follow-up messages go out at weeks 2 and 8 and at month 4.
- 5
Evaluate
Kirkpatrick’s four levels, with simulated-phishing click, report and time-to-report rates compared with baseline. Clear rules send findings back to earlier phases, for example when an item is missed by more than 40% of learners.
How I use AI in this course design
I use AI as a design partner on this course. It speeds up exploring options, and I decide what is used.
LMS-like learner experience
I use AI to design the front end of the training as an LMS-like learner experience: how learners move through the course, what each screen shows and how feedback appears. I set the requirements for accessibility and cognitive load, and I choose what to keep.
Scenarios
I use AI to draft realistic workplace phishing scenarios, which I shape around the learner profile.
Branching scenarios
I use AI to map the choices learners can make, the consequence of each choice and the feedback on each path, so every path teaches something.
What stays with me
I decide the learning objectives and the learner profile. I review every scenario, choice and piece of feedback before it goes into the course, and I check the design against accessibility standards.
Frameworks in this course
Merrill’s first principles
A real-world task, activation, demonstration, application and integration shape the sequence, starting with a gut-call before any teaching.
Cognitive load theory
Worked examples come before full problems, then support fades from hinted to unhinted scenarios, which lowers load for novices.
Mayer’s multimedia principles
Callouts sit on the cue they explain, narration is captioned, and there is no decorative music or imagery.
Universal Design for Learning
Learners control the pace, every key idea appears in at least two forms, and responses work by keyboard, touch or mouse.
WCAG 2.2 AA and AODA
Live text instead of screenshots, no timers, no drag-and-drop, and a text-only version of every scenario. Tested with axe, WAVE, NVDA and VoiceOver.
Spacing and retrieval practice
Follow-up practice at weeks 2 and 8 and at month 4, and a refresher at six months, because research found the benefit of phishing education fades.
In a workplace setting
A phishing course is behaviour-change training, the same job as privacy, fraud and workplace-safety training: replace a once-a-year slide deck with realistic practice, spaced reinforcement and a blame-free tone, and measure whether people act differently.
What this project shows
- I can design a corporate course from a business problem to a measurable evaluation plan.
- I choose each media element for a reason and I can name the theory and the accessibility decision behind it.
- I plan accessibility, inclusion and diverse learner needs from the first wireframe.
- I use research and government guidance as the subject-matter source.
Next case study
Reconnaissance des acquis : guide pour personnes étudiantes
Hiring for a training role, or need a course built?
Hiring
I’m open to instructional design and training specialist roles, in French and English. Send me a note, or start with my résumé.
Work with me
I design accessible, interactive online courses in Articulate Rise, Storyline, Brightspace and H5P, and I train teachers on Brightspace, SharePoint and Snagit. Tell me who the learners are and what they need to do.