Six emails, ready to send.

Hi everyone, October is Cybersecurity Awareness Month. This year at [Your organization], we're treating it like an investigation. Most cyberattacks don't start with clever hacking. They start with a rushed message, a familiar voice, a reused password or a doubt someone keeps to themselves. Our security tools do a lot, but our judgment makes the difference. Over four weeks, we'll open one case file a week: • Case File 01, The Rush Job (phishing, texts and calls): Oct. 1 to 9 • Case File 02, The Familiar Voice (AI and deepfakes): Oct. 13 to 16 • Case File 03, Keys Under the Mat (passwords and data): Oct. 19 to 23 • Case File 04, The Cost of Silence (reporting): Oct. 26 to 30 One reflex ties them all together: E·V·A. Examine what looks off. Verify through a channel you trust. Alert right away. What we're asking: about 5 minutes a week to read the tip sheet and take the quick quiz, plus 30 to 40 minutes if your team runs the team investigation. And our commitment to you: no one will ever be blamed for reporting a concern or an honest mistake. Quite the opposite. Thanks for being part of the investigation. [Name] [Title]

Hi, Our first case file: The Rush Job. An email from the “CEO” demanding a payment before 4:30. A “Canada Post” text asking for a $1.99 fee. A “technician” who wants to take over your computer. Same playbook every time: pressure pushes you to act before you think. This week's golden rule: urgency is a clue, not a reason to act. Your E·V·A reflex: • Examine: the sender's full address, the link before you click, the request itself. • Verify: contact the person through a channel you already know. • Alert: report the message to [[email protected]], even if you didn't click. This week: → Read the “Spot the Hook” tip sheet (2 minutes): [link] → Take the Case File 01 quiz (3 minutes): [link] → Team investigation “The Friday Wire”: ask your manager! Happy hunting, [Signature]

Hi, Hope you had a good Thanksgiving weekend. Case File 02 is open: The Familiar Voice. A few seconds of recording is now enough to imitate someone's voice. Video calls can be faked. And AI writes flawless messages in any language. The old warning signs aren't enough anymore. This week's golden rule: if the request is unusual, a familiar voice isn't enough. Your E·V·A reflex: • Examine: spot what's out of the ordinary (the request, the channel, the timing). • Verify: hang up and call back on the number you know. Every time. • Alert: report any attempt to [[email protected]]. A word on AI tools: only approved tools [list or link] can be used with internal information. Never put personal information, contracts or passwords into a public tool. This week: → “Unmask a Deepfake” tip sheet: [link] → Case File 02 quiz: [link] → Team investigation “Safe Prompt or Data Leak?”: with your manager See you next week, [Signature]

Hi, Case File 03: Keys Under the Mat. Your dog's name, your anniversary, your favourite team: it's often all on social media. And when an online store's database gets stolen, those same logins are tried automatically everywhere, including your work email. This week's golden rule: passwords aren't for sharing. Or reusing. Three moves, about 15 minutes, real impact: 1. A passphrase: four unrelated words, easy to remember. 2. A password manager [tool name], so every account gets its own. 3. Multi-factor authentication (MFA) wherever possible. And if you get an MFA prompt you didn't trigger: deny it and report it. Privacy reminder: an email with personal information sent to the wrong person can be a privacy breach. Report it right away to [[email protected]] so the organization can assess it in time. This week: → “Lock Down Your Accounts and Data” tip sheet: [link] → Case File 03 quiz: [link] → Team investigation “Connect the Dots”: with your manager [Signature]

Hi, Our last case file, and maybe the most important one: reporting. In most incidents, someone saw something early and said nothing. They didn't want to look naive, figured “it's probably nothing,” or assumed “someone else already reported it.” This week's golden rule: reporting isn't confessing. It's protecting. When? As soon as you have a doubt. You don't need to be sure. How? [[email protected]] · [ext. 1234] · [report button] What to say? What happened, when, on which device, and what you've done since. That's it. Our commitment hasn't changed: a report made in good faith is always welcome, even when it's about your own mistake. Especially then. This week: → “Report in 60 Seconds” tip sheet: [link] → Case File 04 quiz: [link] → Team investigation “Two Timelines”: with your manager [Signature]

Hi everyone, All four case files are closed. Thank you for taking part: [X] team investigations took place and you made [X] reports this month. What stood out for me this month: • [A highlight or exemplary report, without naming anyone unless they agree] • [An improvement we've decided on, e.g. a call-back rule for payments] Three things to keep: 1. Urgency is a clue, not a reason to act. 2. Verify unusual requests through a channel you already know. 3. When in doubt, report it: [[email protected]]. The E·V·A reflex (Examine, Verify, Alert) doesn't stop on October 31. It's with us all year. Got two minutes to help us do even better next year? [survey link] Thank you, [Name] [Title]