Security Scenarios
What would you actually do?
▶ Play nowA caller who says they are from IT. A USB stick in the car park. A colleague who needs a file "quickly". Rapid multiple choice on the situations people really meet, with the reasoning shown after every answer.
How to play
Pick the best response before the bar runs out. The right answer is always revealed, with the reasoning, so a wrong guess still teaches you something.
Choose the right response to the security situations that actually come up at work.
Every round is drawn from a content deck, and every answer comes with the reasoning behind it. Your organization can point this game at its own material without any change to the game itself.
Play with a friend
Open the game and choose “Play a friend” to get an invite link. Everyone races the same board at the same time and the highest verified score wins. If nobody joins before the countdown ends, a bot takes the empty seat so you can still play.
Controls
Tap an option, or press 1 to 4.
11 security topics
The game does not know any of them. It knows what SHAPE of content it can show, and the library supplies the rest — which is why your own material drops straight in.
This is what a round asks you
Real items from the library, answerable right here. Every one explains itself — that is the difference between a quiz and awareness training.
You hover over a link and the address is "aurora-retail.example.com.login-secure.ru". Where does it actually go?
Read a web address right to left. The owner is the part immediately before the final suffix — login-secure.ru. Everything to the left of it is chosen by whoever owns that domain.
RememberThe real destination is at the END, just before the first single slash.
You emailed a spreadsheet of customer records to the wrong Sam in the address book. What comes first?
Recall usually fails and always takes time you do not have. Reporting starts the clock on notification duties and lets people who can actually contain it do so. Then, by all means, ask them to delete it.
RememberReport first. Recall second. Never wait and hope.
Is it safe to let your browser or password manager remember work passwords?
The realistic alternatives to a manager are reuse and weak passwords, both of which are worse. Use the one your organization provides, protect it with a strong passphrase, and turn on MFA for the manager itself.
RememberA password manager is not a risk. Reuse is.
Themed versions
Every version below runs the exact same game logic. Only the configuration differs.
Security Scenarios
Aurora Security Scenarios
Security Scenarios — Champions
Bluepeak Security Scenarios
More games
Phishing Triage
Report it, bin it, or trust it.
Decide what to do with a suspicious message in the seconds you really have, and know why.
Threat & Defence Match
Match every risk to the habit that beats it.
Link each risk to the habit that defeats it, so the defence comes to mind with the threat.
Threat Range
Report the threats. Let real mail through.
Judge before you act: report the real threats and leave legitimate messages alone.