The Office Birthday Card Is a Phishing Exercise

hr sent a digital birthday card that asked everyone to click and sign. looked exactly like a credential harvest. reported it. was right. real card. still terrifying. if security and sentiment use the same ui, users lose. i wrote a one-pager. nobody read it. cake was good though. the ticket queue had fourteen items labeled urgent and three labeled urgent!!! which is not a severity scale, it is panic handwriting. i reset another password for someone who swore they never clicked the link. the link was in their sent folder. training does not fail. people fail training and still need help without humiliation. incident report filed in triplicate while the actual incident took four minutes. compliance loves paper trails. i ate lunch at my desk watching a phishing simulation fail in real time across the company chat. the gif reactions were the most honest security culture moment this quarter.

HR sent a digital birthday card that asked everyone to click and sign. It looked exactly like a credential harvest.

I reported it. I was right that it was suspicious. It was also real.

Still terrifying. If security and sentiment use the same interface, users lose every time.

I wrote a one-pager about distinguishing internal tools from phishing. Nobody read it. The cake was good though.

Office life is a series of small trust exercises. My department sees threats. Everyone else sees inconvenience. Both views are partially correct and completely exhausting.

The story continues in the body after the words stop. Shoulders lower, or they do not. Tomorrow arrives with its own list. I am still here, which is not nothing.

I do not need a moral. I need an honest next step. Sometimes that is rest. Sometimes it is showing up again before you feel ready.

The story continues in the body after the words stop. Shoulders lower, or they do not. Tomorrow arrives with its own list. I am still here, which is not nothing.

Know someone who should read this?