Reporting & response
What to report, how fast, and why a false alarm is welcome.
The difference between an incident and a catastrophe is usually minutes. People report quickly when they are confident they will not be blamed for being wrong.
Would you get these right?
Real items, not examples written for a brochure — these are the same 6 questions the games draw on for this topic. Answer one and see what a player sees.
You reported an email and it turned out to be genuine. What should happen?
A security team would rather assess a hundred genuine messages than miss the one that mattered. Any culture that makes people feel foolish for reporting gets fewer reports and slower ones.
RememberA false alarm costs minutes. A missed report can cost the organization.
A call that felt wrong but you cannot say why
Report the feeling — the pattern matters more than proof
Report the feeling — the pattern matters more than proof
Three vague reports of the same pretext is how a campaign gets spotted. Nobody is expected to arrive with evidence.
RememberYou do not need proof to report something.
A colleague acting oddly on email
Report the account, not the person
Report the account, not the person
A compromised mailbox sends real messages from a real colleague. Reporting the behaviour protects them; assuming they made a mistake keeps the attacker inside.
RememberOdd behaviour from a known account is a compromise signal.
3 games carry this topic
The same material, in whichever game your people will actually open. That is the whole design: the lesson is content, so it is not tied to one set of rules.
Threat & Defence Match
Match every risk to the habit that beats it.
Link each risk to the habit that defeats it, so the defence comes to mind with the threat.
Security Scenarios
What would you actually do?
Choose the right response to the security situations that actually come up at work.
Cyber Tambola
Dab the control that stops the call.
Know which control stops which attack, and know when a threat is not yours to act on.