Data Handling Scenarios

Practice proper data handling in realistic situations. The JoySuite assistant Joy plays out tricky scenarios from your own security policy and coaches you through each decision before real mistakes happen.

For Security & Compliance Teams IT Managers HR & L&D Leaders All Employees
Sample prompt to Joy's Assistant

/roleplay a data-handling scenario from our security policy: [a suspicious email asking for credentials]. Play the other party, then coach me on each decision with the policy.

What it can look like

/roleplaya data-handling scenario from our security policy: a suspicious email asking for credentials. Play the other party, then coach me on each decision with the policy.

You're the employee; I'll play the IT service desk making the request, drawn from your security policy. I'll stay in character, then coach you. A message lands mid-morning, flagged as external, just as you're heading into a meeting.

IT Service Desk
We're forcing a password reset after last night's incident. Confirm your current password and the code we just texted you, or your account locks in the next 10 minutes.
I'm not sending my password or that code. If there's a real reset, I'll start it myself from the intranet portal.
IT Service Desk
There's no time for that. Your manager already approved it. Just reply here.
Still no. I'll call the service desk on the number from our directory and report this message.

Coaching

  • You caught the two signals the policy lists first: a request for a live credential and a manufactured 10-minute deadline. IT will never ask for either.
  • Refusing to be moved by the "your manager approved it" authority push is exactly the behavior the acceptable-use section is trying to build. Well held.
  • You named reporting, the step most people skip. Do it before you reply again next time. Forwarding to the phishing inbox starts the containment clock for the whole company.

Ready for a trickier one, where the sender's address is a near-perfect look-alike of a real vendor?

Load your own incident-response runbook and rehearse the report-and-escalate steps end to end.

An illustrative example. Your output will reflect your own sources, data, and prompts. This is an abridged sample. A live /roleplay runs one turn at a time and keeps going for as long as you practice.

Practice data handling without the risk

Data Handling Scenarios puts employees in realistic situations where they have to make judgment calls about data handling, privacy, and security. The JoySuite assistant Joy plays out each scenario, responds to their decisions, and provides immediate coaching feedback.

  1. Point Joy at your policy

    Upload your data-handling and acceptable-use policies to the Knowledge Center, or connect the source Joy should pull from. Every scenario and every coaching note is grounded in your actual rules.

  2. Start the roleplay

    Run Joy's /roleplay command and describe the scenario you want: a suspicious email asking for credentials, a vendor requesting customer data, a found unlocked laptop. Joy sets the scene and plays the other party.

  3. Practice live

    Joy stays in character and responds to your decisions in real time via text or voice. You make the calls, and a wrong move costs nothing here instead of in your inbox.

  4. Get coaching and run it again

    After the exchange Joy steps out of character to debrief: what you caught, what to tighten, and the policy behind each call. Vary the scenario and go again.

  5. Make it one click for your team

    Save this ask as a custom command on the assistant your team already uses and customize it, so anyone can run the same drill in one step.

Make it yours

Realistic Scenarios

Based on actual incidents and common mistakes. Employees practice with situations they'll actually encounter.

Voice Mode

Practice verbal responses for phone-based social engineering attempts. More realistic than multiple choice.

Grounded in Your Policy

Every scenario and every coaching note comes from the security policies you connect, not generic examples, so the practice matches your actual rules.

Adaptive Difficulty

Start with obvious situations, progress to nuanced edge cases. Joy meets you where you are.

Healthcare (HIPAA)

Patient data scenarios, fax mishaps, waiting room conversations, and proper disclosure procedures.

Financial Services (PCI)

Credit card handling, payment data storage, and PCI compliance situations specific to financial teams.

GDPR Compliance

European data subject requests, consent scenarios, and cross-border data transfer decisions.

Engineering Teams

Source code handling, API key management, and secure development practices for technical staff.

Frequently Asked Questions

Why is scenario-based data security training more effective than traditional training?

Scenario-based training puts employees in realistic situations where they practice making decisions, building muscle memory for correct responses. Unlike passive video training, active practice carries over to real behavior change when actual threats occur.

What types of data handling scenarios can employees practice?

Employees can practice phishing email identification, password security, device loss protocols, data sharing requests, social engineering attempts, physical security situations, and proper incident reporting procedures.

How does AI-powered security training adapt to each employee?

The AI starts with straightforward scenarios and progressively increases difficulty based on performance. Employees who struggle with certain topics get additional practice, while advanced users face nuanced edge cases that test their judgment.

Can data handling scenarios be built around HIPAA, PCI, or GDPR?

Yes. Point Joy at your own HIPAA, PCI-DSS, or GDPR policies and it builds scenarios and coaching straight from them, so the practice reflects the rules your team actually has to follow.

How do I make this available to my whole team?

Save the roleplay as a custom command on the assistant your team already uses, so anyone can start the same drill in one click. The practice is self-directed. Each person runs the scenarios whenever they want the reps.

Related Recipes

IT & Security

IT Support Q&A

Instant answers to common IT questions from your documentation.
L&D

Compliance Assignment Tracker

Track who's completed required training and who's at risk.
L&D

Policy-to-Training Converter

Turn dry policy docs into engaging, learner-friendly training.

Ready to launch Data Handling Scenarios?

Join the waitlist and be first to try this workflow when JoySuite launches.

Join the Waitlist Browse All Recipes