Multi-factor authentication
A second factor, and the fatigue attacks designed to get you to approve one.
MFA stops a stolen password on its own. It does not stop someone who taps approve on a prompt they did not trigger.
Would you get these right?
Real items, not examples written for a brochure — these are the same 10 questions the games draw on for this topic. Answer one and see what a player sees.
Approving an MFA prompt that appeared on its own
A prompt you did not start means someone else already has your password and is standing at the door. Approving it lets them in.
RememberUnexpected prompt: deny, change the password, report.
A code read out to a caller
Never share a one-time code with anyone
Never share a one-time code with anyone
No genuine organization will ever ask you to read a one-time code aloud. The code is the second factor; giving it away removes the protection entirely.
RememberThe code is for the screen, never for a person.
We are completing scheduled maintenance on your account. Please approve the authentication prompt on your phone so we can finish. If you do not approve within 10 minutes the process will need to be repeated.
MFA fatigue. Someone already has the password and is trying to talk you into approving the second factor for them. A prompt you did not trigger is an attack in progress, not an inconvenience.
RememberNever approve a prompt you did not personally start. Deny it, then report it.
7 games carry this topic
The same material, in whichever game your people will actually open. That is the whole design: the lesson is content, so it is not tied to one set of rules.
Threat & Defence Match
Match every risk to the habit that beats it.
Link each risk to the habit that defeats it, so the defence comes to mind with the threat.
Cyber Hygiene Run
Dodge the risky habit. Pick up the safe one.
Build the reflex to take the secure option and step around the risky one, at speed.
Spot the Threat
Judge it in the two seconds you actually get.
Tell a hostile message from a genuine one in the two seconds you actually get.
Threat Range
Report the threats. Let real mail through.
Judge before you act: report the real threats and leave legitimate messages alone.
Phishing Triage
Report it, bin it, or trust it.
Decide what to do with a suspicious message in the seconds you really have, and know why.
Security Scenarios
What would you actually do?
Choose the right response to the security situations that actually come up at work.
Cyber Tambola
Dab the control that stops the call.
Know which control stops which attack, and know when a threat is not yours to act on.