CYBERSECURITY MONTH 2026
This guide is for CISOs, training managers and internal communication teams who want to make games a driver of their awareness program. It takes you from the initial assessment to progress measurement, with concrete steps and criteria for choosing the right formats.
In brief
- Games anchor habits because they involve practice: you decide, you make mistakes without consequences, you understand why.
- A good program starts with an assessment of your teams, their jobs and their constraints.
- Each format has its role: online game for everyone, crisis escape game, simulations, on-site highlights, virtual reality.
- Rollout works best in waves, supported by internal champions.
- Progress is measured in actions: participation, reports, change in risk level over time.
Why games anchor habits
A habit is built through practice. Faced with an unexpected email or an urgent call, your employees draw on what they have already done, more than on what they have read. Games give them this practice: a situation to solve, a decision to make, immediate feedback.
Research points in this direction. A study published in 2023 in the journal Applied Sciences found that hands-on scenarios double learner engagement rates (MDPI, Applied Sciences, 2023).
Games also create a supportive setting. Mistakes become learning moments: players see the consequence of their choice, understand the right action and try again. This psychological safety encourages curiosity and questions, two allies of everyday vigilance.
Finally, games make people want to come back. A story, characters, a challenge to take on: these ingredients turn a training obligation into a moment shared with colleagues.
Step 1: assess your teams
A useful program starts from the reality of your teams. Three questions guide this first phase.
What is the starting level? A first simulation campaign, a placement quiz or a short questionnaire gives a snapshot of current habits. This baseline will serve as a point of comparison throughout the program.
Which jobs are most exposed? Roles authorized to make payments are targeted by wire transfer fraud. Human resources handle personal data. Development teams use tools and code that call for specific habits. Mapping these situations helps target the content.
What are the constraints on the ground? Shift work, shared workstations, teams without computers, distributed sites, several languages: each constraint shapes the choice of formats.
A simple segmentation helps organize what comes next:
- Employees who are learning the basics.
- Those who are ready for more subtle situations.
- Potential champions, who can promote the approach to their colleagues.
Step 2: choose the formats
Each format serves a goal. The table below helps you build your program.
| Format | Main goal | Audience | Best time |
|---|---|---|---|
| Short online game | Practice the fundamentals | All employees | Throughout the year |
| Crisis escape game | Understand roles and decisions in a crisis | Managers, executive committees, everyone | Highlight, offsite |
| Investigation or narrative game | Remember good practices through a story | All employees | Program launch |
| Phishing simulation | Practice recognizing and reporting | Everyone, then targeted groups | Ongoing, at a regular pace |
| On-site workshop | Create a shared moment, reach field teams | Less connected teams, sites | Dedicated week, internal event |
| Virtual reality | Spot clues in a realistic environment | Everyone | On-site highlight |
Online games suit the whole organization. Short sessions, available on a computer, tablet or phone, fit easily into a workday.
The crisis escape game puts players through the dilemmas of a crisis unit. Everyone understands the role of others and their own stance: isolate a workstation, raise the alert, pass on an instruction. At BlueSecure, BlackOut™ offers this experience online and as a workshop for executive committees.
The narrative game uses an investigation to teach the fundamentals. CyberCrime™, for example, invites players to find out who committed a cybercrime, with which weapon and in which room of the company.
Phishing simulations complement games with practice in real conditions. They are all the more useful when paired with a learning page and a learning path adapted to the results.
On-site workshops go out to meet teams: booths, demonstrations, team games, short talks. They reach employees that digital formats reach less easily.
Virtual reality immerses participants in an office, a factory or a hospital to spot the signs of poor cyber hygiene. Studies on virtual reality training report efficiency gains compared with classroom training (PwC, Virtual Reality Soft Skills Training Study).
A simple criterion helps you decide: choose the format that practices the target action, in a context close to your teams’ daily work.
Step 3: find the right balance between play and seriousness
Games are a means to serve a learning goal. Three principles keep this balance.
- One action per session. Each game, each mission targets a clear habit: check a sender, report a message, refuse an unusual request.
- A systematic debriefing. The end of the game recalls the good practice and explains why it protects. This is the moment that turns the experience into a habit.
- Situations close to reality. The more the scenario resembles your teams’ daily work, the more naturally it carries over to the job.
Leaderboards and badges can motivate, as long as they stay friendly. Team leaderboards encourage mutual support. Recognizing individual progress values everyone.
Step 4: roll out in waves, with champions
A gradual rollout leaves time to adjust the program and build buy-in.
- A voluntary pilot. A motivated department or site tests the first formats. Its feedback helps refine the scenarios, the pace and the communication.
- Communication focused on benefits. Announce an experience to enjoy and habits that are useful at work and at home. Compliance has its place in the program without becoming the main message.
- Successive waves. Each new group benefits from the lessons of the previous ones.
- Champions. A few volunteer employees per department promote the approach, answer questions and pass on ideas.
- Highlights. A cybersecurity month, a dedicated week or an offsite builds collective momentum and celebrates progress.
Visible support from leadership legitimizes the whole effort. A word of introduction from an executive, or their participation in a workshop, sends a strong signal.
A pace that works well combines short, regular sessions, simulations spread over the year and one or two shared highlights. Refreshing the scenarios keeps curiosity alive: new challenges, new stories, new threats to discover.
Step 5: measure progress
Measurement keeps the program alive: it shows what works and guides the next actions. Three families of indicators complement each other.
Engagement. Voluntary participation, time spent, spontaneous feedback on the content. These indicators tell you whether the formats make people want to take part.
Actions. Changes in reactions to simulations, and above all in the number of reports. An employee who reports a suspicious message becomes a sensor for the whole organization.
Trajectory. A consolidated indicator tracks the risk level over time, by department or by site. It helps target the groups that need support and report to the executive committee. At BlueSecure, the BlueSecure Risk Index™ plays this role by consolidating simulation results, learning path progress, reports and detected exposures.
To keep the measurement fair:
- Set a baseline before launch.
- Compare similar periods and similar groups.
- Share the results with teams, highlighting collective progress.
Compliance and evidence
Several frameworks expect regular, documented awareness actions: the GDPR for people who process personal data, the ISO 27001 standard for information security awareness, NIS2 for the entities in scope (a directive being transposed into French law), DORA for the financial sector.
Games fit these requirements well, as long as records are kept: participation, dates, content completed, certificates. A well-equipped gamified program produces this evidence as it goes.
Checklist to launch your program
- A measured baseline (initial campaign or quiz)
- A map of jobs and on-the-ground constraints
- Formats chosen for each group
- A target action and a debriefing for each session
- A pilot, then rollout waves
- A network of champions and an executive sponsor
- One or two highlights in the year
- Indicators for engagement, actions and trajectory
- Records kept for your audits
Frequently asked questions
How long before we see results?
Engagement shows from the first sessions. Actions, such as reporting, improve with repetition: allow several campaigns to read a reliable trend.
How do we convince leadership?
Present a limited pilot, with a measured baseline and clear indicators. A short game session with the executive committee is often the most compelling argument.
How often should we plan sessions?
Short, regular sessions, simulations spread over the year and one or two shared highlights. Adapt the pace to your teams’ workload.
Do games suit every profile?
Yes, as long as you vary the formats: online game, group workshop, demonstration, virtual reality. Everyone finds the experience that speaks to them, and on-site workshops support employees who are less comfortable with digital tools.
How do we sustain engagement over time?
Refresh the scenarios, organize challenges between teams, celebrate progress and share the results.
Should we create our own games or rely on a partner?
Creating a game requires skills in scriptwriting, instructional design and development. A partner provides ready-to-use content that is regularly refreshed. A hybrid approach adds your internal content, such as your reporting procedures.
Learn more
- Discover the games designed by BlueSecure
- Gamified content in Learning Academy™
- Organize an on-site highlight
- Track your risk trajectory
The habits that protect.
