Explore Social Engineering

You already believe you'd catch it — the bad grammar, the weird link, the too-good-to-be-true ask. That confidence is exactly the gap. AI-written phishing reads clean now, voice cloning needs three seconds of audio, and the median time from email delivery to click is 21 seconds. Nugget doesn't test whether you know that fact. It puts you inside the moment where knowing it stops mattering.

A session starts with an artifact: Nugget lays out a real-looking invoice thread, a vendor email chain, a decision tree with a CFO asking for an urgent wire. You're not staring at a blank inbox — you're walking a structure Nugget built, and it asks you where the trust got established, where the urgency got inserted, what verification step got skipped. You argue your read; it pushes on the part you glossed over.

This is the part school rarely covers in depth: BEC exploits your payment workflow, not your firewall, and no amount of DMARC configuration stops a compromised-but-authenticated account from asking for a wire transfer. Nugget works that distinction until you can explain, in your own words, why out-of-band verification is the control that actually breaks the chain — not a bureaucratic afterthought.