The Threat Model

The lessons

1. F106-01The attack taxonomyWrite your own threat model as a single sentence naming adversary, requirement, and countermeasureabout 33 min · opens on Where the money actually went in 2025
2. F106-02The psychologyName the four levers social engineering pulls, and identify which one a given message is usingabout 31 min · opens on The Genesis creditor, August 2024
3. F106-03Personal opsecTrace your own recovery chain to its root and identify which single credential currently controls your fundsabout 32 min · opens on The SEC X account, January 2024
4. F106-04Don't be a targetSeparate your exposure into what you control, what you delegated, and what is already publicabout 31 min · opens on The Coinbase insider breach, disclosed May 2025
5. F106-05Who gets targeted and howDescribe how target lists are actually assembled, and why selection is automated rather than personalabout 30 min · opens on The LastPass vaults, breached 2022 and drained for years afterwards
6. F106-06The incident runbookTriage a live incident into one of four compromise classes, because the correct first action differs for eachabout 25 min · opens on The recovery scam, as documented by the FBI

Labs

• F106-L2

  The Announced Gauntlet

  The same six to ten simulated attacks as the Gauntlet, but inside a 72-hour window the learner names in advance and consents to each time. Unannounced within the window, so the read is real; consented per window, so nobody has to accept fourteen days of ambush to earn the certificate. Same channels, same boundary, same pass standard: a 100 percent catch rate on critical-severity attempts across as many windows as it takes to deliver the set. Added 2026-09-10 so consent to the unannounced Gauntlet is freely given rather than conditioned on the credential.

• F106-L

  The Gauntlet

  Over 14 days the platform sends six to ten realistic simulated attacks across email, in-app notification, a sandboxed dApp, a mock DM, and a synthetic voice note in a voice that belongs to nobody, delivered to the same inbox. Falling for one triggers an immediate teardown and adds attempts. Pass is a 100 percent catch rate on critical-severity attempts. Runs only with the learner's informed consent, given at enrollment in the lab and revocable; the voice channel can be declined on its own; attacks never use a personal phone number, a family member or any uninvolved third party; and the learner's own voice is never recorded, cloned or imitated.