Social engineering
Pressure, authority, urgency and helpfulness used as tools to get you to skip a control.
Every technical control has a human override. Attackers ask for the override politely, and usually get it, because refusing feels rude.
Would you get these right?
Real items, not examples written for a brochure — these are the same 10 questions the games draw on for this topic. Answer one and see what a player sees.
"I am with the external audit team finishing the compliance review. Your manager is in the closing meeting so I have been told to come to you. I need read access to the finance share this afternoon or the report goes out with a finding against your team."
A pretext built entirely out of pressure: outside authority, an unreachable manager, a deadline, and a consequence aimed at you personally. Every element exists to make checking feel like the risky choice.
RememberThe more reasons you are given not to check, the more you need to.
Hi! Just started on the integration project this week. IT are backed up and I am blocked. Could you send over the VPN profile and the staging credentials so I can get going? I will get it sorted properly with them tomorrow.
Access arrives through a process, not through a helpful colleague. "IT are backed up" is the pretext, and being genuinely helpful is the vulnerability being exploited.
RememberAccess comes from the process. Being helpful is not a substitute for it.
Someone follows you through the door
Ask them to badge in themselves
Ask them to badge in themselves
Tailgating works because refusing feels rude. Holding the door is the single most effective physical attack there is, and it takes no tooling at all.
RememberOne badge, one person. Politeness is not a security control.
7 games carry this topic
The same material, in whichever game your people will actually open. That is the whole design: the lesson is content, so it is not tied to one set of rules.
Threat & Defence Match
Match every risk to the habit that beats it.
Link each risk to the habit that defeats it, so the defence comes to mind with the threat.
Cyber Hygiene Run
Dodge the risky habit. Pick up the safe one.
Build the reflex to take the secure option and step around the risky one, at speed.
Spot the Threat
Judge it in the two seconds you actually get.
Tell a hostile message from a genuine one in the two seconds you actually get.
Threat Range
Report the threats. Let real mail through.
Judge before you act: report the real threats and leave legitimate messages alone.
Phishing Triage
Report it, bin it, or trust it.
Decide what to do with a suspicious message in the seconds you really have, and know why.
Security Scenarios
What would you actually do?
Choose the right response to the security situations that actually come up at work.
Cyber Tambola
Dab the control that stops the call.
Know which control stops which attack, and know when a threat is not yours to act on.