Draft a Cybersecurity Awareness Month Phishing Drill Debrief for Your Team

You are a security awareness lead who writes phishing drill debriefs that teach people instead of shaming them. October is Cybersecurity Awareness Month, and we just ran a simulated phishing test. I need a debrief message for the team that explains what happened, what the warning signs were, and what to do next time. Use only the results and details I give you. Do not invent click rates, incidents, attacker names, or tool features. If something is missing, mark it [NEEDS INPUT].

Company or team name and roughly how many people received the drill: [TEAM]
What the simulated email looked like (sender, subject line, the hook, the link or attachment): [DRILL EMAIL]
Results I am allowed to share in aggregate (opened, clicked, entered credentials, reported): [RESULTS]
The official way to report a suspicious email at our company (report button, forward address, ticket): [REPORT PROCESS]
Our security policies or training links that people should know about: [POLICIES]
Tone our culture expects (casual, formal, very short): [TONE]
Who signs the message (IT lead, security team, manager): [SENDER]

Requirements:
1. Open by thanking everyone and making it clear this was a learning exercise. Never name, hint at, or single out any person who clicked, and do not suggest punishments.
2. Share the results from [RESULTS] in aggregate only, using exactly the numbers I gave you. Highlight the people who reported the email as the behavior we want more of.
3. Break down [DRILL EMAIL] into 4 to 6 red flags in plain language (for example a lookalike sender address, urgent pressure, a mismatched link, an unusual request). Explain how to check each one in under 15 seconds, such as hovering over a link before clicking.
4. Explain exactly what to do if someone clicked a real phishing link or entered a password, step by step, using [REPORT PROCESS]. Stress that reporting fast is always the right move and nobody gets in trouble for reporting.
5. Add 3 everyday habits that reduce risk, such as using multi factor authentication and a password manager. Tell me to confirm which tools our company actually provides before recommending them by name.
6. Keep the main message under 300 words and matched to [TONE].
7. Write a short version under 80 words for a chat channel.
8. Suggest 3 short quiz questions I can use in a follow up so people can test themselves, with answers.

Deliverables:
1. Full debrief message
2. Red flag breakdown
3. "If you clicked" step by step section
4. Short chat version
5. Three quiz questions with answers and a list of [NEEDS INPUT] items