Phishing Triage
Report it, bin it, or trust it.
▶ Play nowThe decision people actually face at work. A message lands — an email, a text, a chat — and you have a few seconds to report it, delete it, or carry on. Every card explains itself the moment you answer, so the instinct you leave with is the point rather than the score.
How to play
Read the message, then choose Report, Delete or Looks legitimate before the bar runs out. Reporting a genuine message costs you as much as missing a real one — over-reporting has a price too.
Decide what to do with a suspicious message in the seconds you really have, and know why.
Every round is drawn from a content deck, and every answer comes with the reasoning behind it. Your organization can point this game at its own material without any change to the game itself.
Play with a friend
Open the game and choose “Play a friend” to get an invite link. Everyone races the same board at the same time and the highest verified score wins. If nobody joins before the countdown ends, a bot takes the empty seat so you can still play.
Controls
Tap an action, or press 1 to report, 2 to delete, 3 to trust.
8 security topics
The game does not know any of them. It knows what SHAPE of content it can show, and the library supplies the rest — which is why your own material drops straight in.
This is what a round asks you
Real items from the library, answerable right here. Every one explains itself — that is the difference between a quiz and awareness training.
Congratulations! Complete a short survey to claim your reward. Limited slots remain.
Junk rather than a targeted attack. It is worth deleting, and it is not worth the security team's time — reporting everything makes the reports that matter harder to find.
RememberReport what targets your organization. Bin the rest.
As agreed in the planning call, the segment export is in the shared folder — access is restricted to the campaign team and expires at the end of the month. Shout if you need someone added.
Data handled properly: named access, a stated purpose, a time limit, and a route to request more. This is the behaviour a campaign should be reinforcing, not just the failures.
RememberNamed people, clear purpose, an end date. That is good handling.
We are completing scheduled maintenance on your account. Please approve the authentication prompt on your phone so we can finish. If you do not approve within 10 minutes the process will need to be repeated.
MFA fatigue. Someone already has the password and is trying to talk you into approving the second factor for them. A prompt you did not trigger is an attack in progress, not an inconvenience.
RememberNever approve a prompt you did not personally start. Deny it, then report it.
Themed versions
Every version below runs the exact same game logic. Only the configuration differs.
Phishing Triage
Aurora Phishing Triage
Bluepeak Phishing Triage
Phishing Triage — Champions
More games
Security Scenarios
What would you actually do?
Choose the right response to the security situations that actually come up at work.
Threat & Defence Match
Match every risk to the habit that beats it.
Link each risk to the habit that defeats it, so the defence comes to mind with the threat.
Threat Range
Report the threats. Let real mail through.
Judge before you act: report the real threats and leave legitimate messages alone.