Trust by Design: When Deception becomes Education

Security awareness is often measured by outcomes: who clicked, what was detected, and whether a training objective was met. This talk takes a different perspective. It explores how deception-based learning can be designed to educate without shaming, and why ethics should be part of security design from the very beginning. Drawing on anonymized lessons from high-security practice, Brigitte reflects on phishing simulations, feedback culture, privacy by design, and data separation as parts of one broader question: what are we really teaching when we build these systems? The session is structured around three short deep dives that build on one another. First, it examines the ethics of deception in educational settings: where is the line between a realistic simulation and a harmful dark pattern? Second, it explores the design and architectural choices that shape safer outcomes, including privacy by design, strong separation of sensitive data, and the responsibility to build systems that do not amplify a single user mistake. Third, it focuses on the feedback loop: how tone, framing, and user experience can determine whether a simulated incident becomes a moment of shame or a moment of learning. This is a reflective, practical talk for developers, engineers, security professionals, architects, and anyone interested in human-centered security. Rather than presenting a product walkthrough or implementation-specific case study, it translates practical experience into broader patterns that can be applied across different contexts. Attendees will leave with a clearer framework for designing security systems that strengthen people, support learning, and embed ethics from the start.