The cover becomes a risk attestation draft, dull enough to pass under the eye without raising its pulse. It promises nothing dramatic, only a small procedural clarification before the next review: language that sounds like housekeeping, not temptation. ![[risk-attestation-cover.svg|EX-06, attestation PDF cover]] You choose filenames the way you choose clothes for a court date: nothing flashy, nothing memorable, nothing anyone would screenshot for a joke. That is the bait. Not urgency, but responsibility. Not greed, but diligence. The kind of document a recipient feels professionally obliged to open, because unread attachments become tomorrow's problems. You preview the PDF and feel a sick pride you hate. The cover is set. Now draft the risk attestation to sell the lie: [[Risk Attestation Draft|Draft the risk attestation]]. <details> <summary>🔎 Behind the curtain: why dull beats urgent</summary> <p>Awareness training mostly teaches people to distrust panic, the "your account closes in 24 hours" scare. Skilled attackers go the other way. A boring, responsibility-flavoured document ("please review before the next cycle") slips past that reflex, because opening it feels like doing your job, not dodging a threat. Year after year, breach studies put a human element in the large majority of incidents, and phishing stays a top way in precisely because the best lures feel like ordinary work.</p> <p><b>Defender's lesson:</b> train for the quiet lure, not just the loud one, and make reporting a suspicious file as easy as opening it.</p> </details>