Fooling Your Friends to Make You Both Safer
Summary
In this episode, Brian Brushwood discusses "wolfmasking," a cybersecurity training method that uses gamified role-playing to inoculate employees against AI-enhanced social engineering. He argues that traditional hypothetical training is insufficient, advocating instead for safe, sandboxed exercises where participants practice deceiving others to build intuitive, System 1 defenses.
Topics discussed
Show intro and recap of previous social engineering episodes
Brian Brushwood's background and the 'scampocalypse'
Magician culture as a model for deception immunity
The siloed nature of cybersecurity vs. magic history
Limitations of hypothetical knowledge and defensive driving
The 'Wolf Masking' concept and the 'that's what I do' phrase
Practical example: Stealing cookies to learn intrusion
Treating the disease: Practicing threat recognition
Clemson University pilot program and the four-step process
Step 1: Writing the world's easiest phishing email
Step 2: Enhancing attacks and the nurtured heart approach
Step 3: Coworker attacks and mapping organizational anxieties
Step 4: PvP defense games and real-world vigilance
Expanding the method to voice phishing and other vectors
Benefits of practice and application for aging parents
Community cohorts and social networks as defense
Personal humility and the D&D metaphor for safe play
Implementation ease and the path to scalability
How to book talks or start Wolf Masking in your org
Closing remarks and show support
Listen ad-free on Castria