ASK&DOBehavioural security
How it works ↘Get in touch
THE GRAMMAR OF ACTION

Every request leaves a trace.

Ask&Do makes the chain between a message and its consequence legible — before the valuable thing changes hands. Pick a world, pick a request, and follow it through.

  1. 01WORLD
  2. 02ASK
  3. 03YOU
  4. 04DO
  5. 05VALUE
EXPLOREPick a world

then choose one of its 4 requests below

01 / SIGNAL SPACE

Your Inbox World

A familiar sender can still carry an unfamiliar ask.

4 requests in this worldINBOX / TRACE 01
02 / REQUEST → 03 / CONSEQUENCE

Ask Do

If this action completesCRITICAL
02 / THE ASK
JL
ceo@work.comExternal route · display name matched
“”
August_Invoice.htmlAuthority + urgency
YOUDECISION
03 / PROPOSED RESPONSE
“”
You · Accounts payableReady to act
A checkpoint is an independent verification step — a call-back on a known number, a second pair of eyes. It contains some of these attacks outright. Against others it only stops the clock, and the card will tell you what actually works.
SIGNALSNew beneficiaryNo-call requestArtificial deadline
LEGITIMATE PROCESS

New vendor payment

Verify the vendor and call back on a known number.

AVAILABLE
ATTACKER’S PLAN

Impersonate the CEO

Rush a payment to a newly controlled account.

CRITICAL
05 / PROCESS MAP

It lands on
one desk.
It never stops
there.

The attacker borrows C-Level identity to move Accounts / Finance. Stopping it safely needs Managers and IT too — which is why training one desk in isolation tends to leave the rest of the route untouched.

The six questions a hardened process passes
Have they been trained on this attack?
Yes — on this one, not on phishing in the abstract.
When was their last training?
It could have been the day after the attack was first seen in the wild.
Do they understand how they will be manipulated?
Well enough to recognise it under pressure, rather than only in a quiz.
Do they know what action to take here?
Yes — and so does everyone else in the process.
Have the impersonated and the targeted actually spoken?
Yes. They have had the chance to agree how this gets checked.
Is the process’s resilience self-healing?
It is. When someone leaves and someone new arrives, they are brought up to speed by design.
  1. 01 / THE THREAT ARRIVESceo@work.comInbox · Authority + urgency
  2. 02 / WEARING AN IDENTITYC-LevelA colleague, borrowed
  3. 03 / IT LANDS HEREAccounts / FinanceWhere the ask has to be judged
  4. 04 / THE PROCESS CROSSESManagers and ITEveryone a safe answer depends on
Across the organisation
  1. BoardNot involved
  2. C-LevelIdentity borrowed
  3. ManagersIn the process
  4. ITIn the process
  5. HRNot involved
  6. AdminsNot involved
  7. SalesNot involved
  8. Accounts / FinanceReceives the ask
  9. HelpdeskNot involved
APPLIED TO ALL 4 DESKS IN THIS PROCESS — NOT TO EVERYONE, AND NOT TO ONE
Specific training

Built for this attack, not for attacks in general.

Communication

The impersonated and the targeted have actually spoken.

Process hardening

The stopping point is in the process, not in someone’s memory.

THE MODEL

Five parts.
One chain.

Every incident above is the same five links in a row. Naming them is what lets a team argue about where to put a control, instead of arguing about whose fault it was.

02 / ASK

What you are told

The story, instruction or pretext that asks for belief.

Trace it live ↗
FOUR SIGNAL SPACES

Same grammar.
Different trust.

WHAT NEXT

Trace your own requests.

If you want this run against the asks your people actually receive — in your channels, with your assets — start a conversation.

j@james-linton.com