FN-03 · Field note by Devon Norton, CISSP, GCFA

How to use the internet to become funny: a security trainer’s notes on humor that sticks

The internet is full of advice on becoming funny. Ours is narrower and more useful at work: read incident postmortems, collect real phishing lures, and learn to laugh at the attacker’s craft and the system’s quirks, never at the person who clicked. It is the most reliable way we know to get engineers and office staff to remember security training.

Published 2026-10-28 · Norton Creek Incident Triage Lab, Reston, VA

Why the compliance deck fails

Most security-awareness programs are built to be auditable, not memorable. Once a year, everyone clicks through forty slides and a ten-question quiz. The tracking sheet shows 100% completion. Three weeks later, someone approves a fake invoice because it looked exactly like the real one.

The deck measures attendance, not behavior. Security in daily work is a reflex: a small hesitation when an email feels slightly off, and the habit of pressing the report button instead of deleting it. Reflexes come from repetition and stories. People remember stories they laughed at.

Dry postmortem humor

Good incident postmortems are some of the best-written technical documents on the internet, and many are quietly funny. The humor is almost never in a joke. It is in the timeline, written flatly:

14:02 Engineer notices the nightly backup job has been successfully backing up an empty folder since March.
14:03 Engineer stops noticing things for a moment.

That kind of line teaches more about restore testing than any slide on backup policy. It is funny because it is true and because the target is the system, not the engineer. That is the blameless postmortem idea, borrowed from site reliability engineering: assume people acted reasonably with what they knew, and fix the conditions that let the mistake happen.

Reading postmortems is how you get funny in this specific way. Collect the public ones, read a few a week, and notice where the dry lines are. Then write your own internal postmortems the same way. Our own restore-drill notes, like the ones in the field notes on our homepage, are written in that style on purpose.

Tabletop phishing bingo

This is the single most popular thing we bring to client offices. Everyone gets a card with sixteen lure types. When a real one arrives in their inbox and they report it through the proper button, they mark the square. First full row wins lunch. A full card wins a long, loud mention at the all-hands meeting.

Overdue invoice from a vendor you never used
CEO needs gift cards before a meeting
MFA prompt you did not start
Shared doc from a colleague’s hijacked mailbox
New bank details for an old vendor
QR code inside a PDF
Voicemail-to-email with an HTML attachment
“Your mailbox is full”
Fake e-signature envelope
Parcel redelivery fee text
Payroll direct-deposit change request
Recruiter sends a “job brief” ZIP
Helpdesk caller asks you to read a code
Calendar invite with a link in the location
Lookalike domain: rn for m
Free square: you reported it within 5 minutes

Bingo works because it flips the incentive. People go looking for suspicious messages instead of hoping not to receive one. Report volume goes up in the first month, and every report is free threat intelligence for whoever runs the mail filter. It also makes the “report” button a normal, even fun, part of the day.

The blameless hall of fame

Once a month, we run a fifteen-minute teardown of one real social-engineering attempt that reached the organization. The format is fixed:

The lure. Show it on screen, recipient anonymized.
The pretext. Who were they pretending to be, and why would that work here?
The tell. The one detail that gave it away. Often it is tiny: a reply-to address, a font, a request that skips the normal approval path.
The save. Who reported it, and how fast. Their name goes on the hall-of-fame slide.

The hall of fame celebrates reporters. It never features the person who clicked. If someone does click, the story is told as “the lure got through,” and the fix is about controls: the mail filter rule, the payment approval process, the FIDO2 key that made the stolen password useless. Shaming people for clicking teaches them to hide it, and hidden clicks become nine-day dwell times. We see that pattern in real incidents far too often.

Rules for being funny about security

Punch at attackers and systems. The scammer who misspelled the CEO’s name is fair game. Your colleague is not.
No cruel simulations. Fake bonus announcements, fake layoff notices and fake health alerts damage trust in IT for years. Real attackers use them; your training should not.
Keep it short. A good teardown runs fifteen minutes. A good bingo card fits on one page.
Be specific. Generic jokes about passwords are forgettable. A real lure from your own inbox is not.
Let the facts be funny. You rarely need to add a punchline. The timeline usually has one.

What to measure instead

Click rate on simulated phishing is easy to collect and easy to game. We track three numbers: how many real suspicious messages people report each month, the median time between delivery and the first report, and how many reported messages led to a block or a fix. A rising report rate and a falling time-to-report mean the training is working, even if somebody still clicks now and then.

Training is one runbook among several. The others, including the endpoint baseline that makes a single click survivable, are on our triage console.

Runbook takeaways

Format: Fifteen minutes a month beats forty-five minutes a year
Material: Real lures that reached your own inboxes, recipients anonymized
Target: Laugh at the attacker and the system, never the colleague
Reward: Fast reporting, celebrated by name; clicks are never shamed
Measure: Report rate and time-to-report, not click rate alone