Passwords & passphrases
Length, uniqueness, and never reusing one across services.
A password reused on a site that gets breached is a password an attacker will try on your work account within hours, automatically.
Would you get these right?
Real items, not examples written for a brochure — these are the same 13 questions the games draw on for this topic. Answer one and see what a player sees.
Reusing one password everywhere
A password manager with a unique passphrase per service
A password manager with a unique passphrase per service
Nobody can remember sixty strong passwords, which is why reuse happens. A manager removes the need to, so the secure option becomes the easy one.
RememberStop relying on memory and reuse stops being tempting.
Our monitoring has found your credentials in a recent leak. Enter your current password below to check whether it is affected, and we will suggest a replacement.
No legitimate breach service ever asks for your current password. This one is collecting the thing it claims to protect.
RememberNothing legitimate needs your current password to tell you it is unsafe.
The same password on ten sites
Change the important ones first: email, then banking
Change the important ones first: email, then banking
Email is the master key — password resets for everything else arrive there. If you only fix one, fix that one.
RememberYour email account is the key to all the others.
7 games carry this topic
The same material, in whichever game your people will actually open. That is the whole design: the lesson is content, so it is not tied to one set of rules.
Threat & Defence Match
Match every risk to the habit that beats it.
Link each risk to the habit that defeats it, so the defence comes to mind with the threat.
Cyber Hygiene Run
Dodge the risky habit. Pick up the safe one.
Build the reflex to take the secure option and step around the risky one, at speed.
Spot the Threat
Judge it in the two seconds you actually get.
Tell a hostile message from a genuine one in the two seconds you actually get.
Threat Range
Report the threats. Let real mail through.
Judge before you act: report the real threats and leave legitimate messages alone.
Phishing Triage
Report it, bin it, or trust it.
Decide what to do with a suspicious message in the seconds you really have, and know why.
Security Scenarios
What would you actually do?
Choose the right response to the security situations that actually come up at work.
Cyber Tambola
Dab the control that stops the call.
Know which control stops which attack, and know when a threat is not yours to act on.