Handling data
Knowing what you hold, where it may go, and who may see it.
Most data loss is not theft. It is a file sent to the wrong Sam, a spreadsheet on a personal drive, or a link shared with anyone rather than named people.
Would you get these right?
Real items, not examples written for a brochure — these are the same 12 questions the games draw on for this topic. Answer one and see what a player sees.
An email autocompleted to the wrong recipient
Check the To line before attaching anything sensitive
Check the To line before attaching anything sensitive
The single most common data breach in any organization is a correctly written email sent to the wrong person.
RememberThe recipient is the field worth reading twice.
Confidential papers left in the printer tray
Use secure release and collect them straight away
Use secure release and collect them straight away
Paper has no access control and no audit trail. Once it is in the tray, it is available to everyone who walks past.
RememberPrint it, collect it. Or do not print it.
Sharing a document as "anyone with the link"
That link will be forwarded, pasted into a ticket and indexed somewhere. It has no owner and no expiry, and it works for anyone who ever sees it.
RememberShare with named people, not with whoever has the link.
7 games carry this topic
The same material, in whichever game your people will actually open. That is the whole design: the lesson is content, so it is not tied to one set of rules.
Threat & Defence Match
Match every risk to the habit that beats it.
Link each risk to the habit that defeats it, so the defence comes to mind with the threat.
Cyber Hygiene Run
Dodge the risky habit. Pick up the safe one.
Build the reflex to take the secure option and step around the risky one, at speed.
Spot the Threat
Judge it in the two seconds you actually get.
Tell a hostile message from a genuine one in the two seconds you actually get.
Threat Range
Report the threats. Let real mail through.
Judge before you act: report the real threats and leave legitimate messages alone.
Phishing Triage
Report it, bin it, or trust it.
Decide what to do with a suspicious message in the seconds you really have, and know why.
Security Scenarios
What would you actually do?
Choose the right response to the security situations that actually come up at work.
Cyber Tambola
Dab the control that stops the call.
Know which control stops which attack, and know when a threat is not yours to act on.