This resource provides digital security training facilitators with a technical simulation to use to teach journalists how to more securely open documents while providing them with a safe, controlled environment to practice in. This technical simulation uses canary tokens (embedded within files, links, etc.) which simulate or mimic the behavior or malware. This guide walks through the full simulation and provides step-by-step instructions for facilitation. This resource was developed under Internews’ Journalist Security Fellowship project.