When thoughtful people dismantle their own walls

In Christopher Nolan's Odyssey, the Trojan Horse sits half-buried in sand. In an interview with Jon Stewart, Nolan said he built it that way so it “doesn’t look like something that’s meant to be carried into the city.”

The trick was telling a story that made it feel safe to bring inside.

Attackers excel at that.

They learn who you trust, how you communicate, what you're working on, and when you're under pressure. Most of that's now public: A new hire announces the job on LinkedIn. A site like Glassdoor provides a window into how the employees actually work and which teams could be targets. Years of social media posts supply context, names, relationships, vocabulary, and events.

Spotting the fake was never a reliable control. Emails with spelling mistakes have been replaced with messages written in an executive's voice. And deepfakes allow an attacker to video chat wearing someone else’s face while speaking in their voice.

A dangerous request is now nearly indistinguishable from a routine one.

In the ancient texts, Troy's king Priam, didn't believe he was compromising his city when he accepted a defector's story. And the Trojans didn't believe they were dismantling their defenses when they broke open part of the wall to bring the horse inside. Everyone believed they were doing the responsible thing after ten years of war.

That's how it usually goes. The person who approves the risky integration is the responsive one, the one who doesn't want to be the bottleneck, the one weighing a real obligation against a policy that feels procedural. The failure isn't ignorance of the rule. It's that the task, in the moment, feels more important than the rule.

Yet most security training still teaches rules.
Don't click suspicious links!
Check the sender address!!
Don't share or reuse your passwords!!!

Then we deliver the same module next year and document that everyone completed it.

That teaches compliance, not judgment. Rules only help when something looks wrong.

What if training looked like a case instead?
Here's what happened.
Here's what the employee knew.
Here's the pressure they were under.
Some of the cases are attacks. Some are legitimate. You don't get told which.

And given only that information:
What would you do?
Where would you stop?
What would you verify?
What evidence would change your mind?
And what do you do if you have already clicked, approved, downloaded, or disclosed?

Good judgment prevents incidents. It also keeps a mistake from becoming a catastrophe.

Stories like the Trojan Horse let us rehearse those decisions without shaming whoever got it wrong.

Next up: What happens when someone recognizes the danger, but doesn't feel safe saying so?