chain re·ac·tion/ˌtʃeɪn riˈæk.ʃən/nounWhen one "eh, it's fine" online habit tips over the next, and the next, until a stranger is reading your email. Come watch the dominoes fall, then find the one that stops them all.

Step 1 of 4 · about 30 seconds

Think like an attacker for 30 seconds.

Pick a target (each one shows a different kind of attack), then click commands at the attacker's terminal to see what each one reveals. This first step is called . Two commands turn up nothing useful. No typing needed.

recon: simulation only, no real people or data

The chain so far

0 of 4 links

    Field noteQuietly collecting public information is the first stage of the Cyber Kill Chain, the attack model used across the security industry. Source: Lockheed Martin

    Step 2 of 4 · the idea in four pictures

    How an attack chain works

    Attackers rarely need one big mistake. They link a few small ones. Break any single link and the chain falls apart.

    1 They look

    A stranger reads what you post in public: your job, your email, your pet, your plans.

    Security term:

    2 They message

    They send something you would expect, like a recruiter or a delivery text, built from those details.

    Security term:

    3 You sign in

    The link opens a copy of a real login page. Whatever you type goes straight to them.

    Security term:

    4 They get in

    With your password they open your email, then reset everything else. asks for a code they do not have.

    Security term:

    Field noteIn a Microsoft Research study of real accounts, turning on multi-factor authentication cut the risk of an account being compromised by 99.22%. Source: Microsoft Research, 2023

    Step 3 of 4 · map of your digital life

    Five places attackers look

    Every habit the full assessment asks about lives in one of these five areas. Click an area to see what it covers.

    Your public profile0 habits Your passwords0 habits Phone and wifi0 habits Daily habits0 habits Smart home0 habits

    Field noteThe FTC has warned that scammers stick their own QR codes over the real ones on parking meters, so the scan opens a fake payment page. Source: FTC, Dec 2023

    Step 4 of 4 · your turn

    Pick how deep you want to go

    Nothing you click is stored or sent anywhere. It all runs in this browser tab.

    Field notePhishing was the most reported cybercrime to the FBI in 2024, with 193,407 complaints. Total reported losses that year reached $16.6 billion. Source: FBI IC3 2024 report

    Quick check · about 1 minute

    One ordinary day. Six small moments.

    Walk through a normal day and say which moments sound like you. After each one you'll see why it matters, and your map fills in as you go.

    Meanwhile, Phil Ishing the attacker

    0 clues

    Phil: "Let's see what this ordinary day gives me..."

    Dee Fault's exposure map

    Dee is you, roughly. Each "yes" lights up the part of Dee's life it belongs to and draws a line in.

    Hi, I'm Dee Fault. Watch my map with me.

    Attacker log analyst mode · last 4 lines
    Step 1 of 4 · pick your habits

    Five areas of your life. Tick what's true.

    Go through one area at a time. Most people tick four to six things. Your map fills in as you go.

    Show me why these five areas

    Attackers rarely need one big mistake. They combine small things from different parts of your life: something public to start, a way in, and a weak lock to finish. These five areas cover the 24 everyday habits the simulator knows about.

    Or start from someone like:

    Your exposure map

    The area you're looking at pulses. Each tick draws a line to you. In analyst mode, the techniques your ticks enable are listed below the map.

    Field noteA Microsoft Research study of real accounts found that authenticator apps protect accounts better than codes sent by text message, though both beat having no second step. Source: Microsoft Research, 2023