What an awareness game gains when the score is shared
Wordle is played alone. Five letters, six tries, done. None of that explains why the game was in every conversation by the end of 2021.
What pushed it was one small feature its creator, Josh Wardle, added late that year, a grid of coloured squares anyone could paste into any chat to show how it had gone without giving the word away. The result became shareable and the game turned into a talking point in offices, family groups and social feeds. In January 2022 The New York Times bought it.
An awareness program lives the same problem in reverse. The content is there, the platform delivers it, each person does their part and closes the tab. That is where it ends. What we learned never comes up in any conversation again, and conversation is the only part of the program that costs nothing.
A security awareness game breaks that solitude for a simple reason. It leaves a result. A finished module gives nobody anything to talk about (nobody leaves their desk to announce they completed module four), while a score does, and it does so far more when there is another score sitting next to it.
What is a shared game in a security awareness program?
A shared game is a video game that each person plays alone and whose result stays visible to everyone else, whether that is the score, the leaderboard position or each team’s participation.
The word multiplayer shows up fast in these conversations and leads somewhere else. A game with simultaneous matches, teams connected at the same hour and sync between players is a different product and a different budget. Here what gets shared is the result, and for that it is enough that the game records what happened.
That raw material is usually available before anyone thinks of using it. In the SMARTFENSE awareness video games catalogue every game states its estimated length, never above fifteen minutes, its level and the security topics it covers, and every session is recorded from start to finish. Those records feed a score distribution and a leaderboard. The gamification dashboard shows each person their badges, their progress, their points and their ranking. What tends to be missing is the decision to read all of that as a group.
Why does the conversation a game leaves behind do half the work?
Telling someone how a session went forces you to go back over the content without anyone asking.
Whoever lost a life for picking up a piece of data they thought was sensitive has to explain which one it was and why they got confused. Whoever finished two points behind first place will want to tell you exactly which question slipped away, in detail and with some outrage. That retelling is a return to the material, and this time the person does it on their own and gladly.
The hallway is the best repetition channel an awareness program has and also the only one that cannot be scheduled from the platform. What is within our reach is giving it something to talk about. Content dosing handles how often the topic shows up; the conversation handles making the review happen outside, where the decisions that protect us are taken later on.
There is a second thing that happens when a game circulates. The person who never opens a security item because it feels foreign to them joins in anyway, because their team is playing and they would rather not be the one missing. It is light social pressure and it works better than reminder number seven.
What should be compared and what should stay private?
The practical rule is to compare the effort and the participation, and to keep individual performance out of everyone else’s sight.
I made this point when we went through the gamification mechanics that change behaviour, and it is still the most repeated mistake in this field. A named ranking of scores keeps whoever sits at the top engaged, and everyone else works out in two seconds that this tournament is not for them. With the comparison placed on the team, each person’s contribution adds up without being exposed.
| What gets compared | What it produces | What to avoid |
|---|---|---|
| Participation per team | Light social pressure, of the “we’re the only ones missing” kind | Publishing who did not take part, by name |
| Improvement over the previous round | A team with a weak start also has something to win | Comparing only absolute scores between teams of different sizes |
| Security topics the team has already played | Conversation about what is left to cover | Reading coverage as proven learning |
| Individual score, visible to each person | A reason to try again | Turning it into a named table for the whole organisation |
The fourth row is the one that gets debated most. Your own score motivates precisely because it is yours, and the moment it goes public it changes function and starts ranking people.
How do you set up a round across teams?
A round is a short window with a closing date, two or three chosen games and the results read by team. Five decisions and it is ready.
- Pick two or three short games. Five to ten minutes each, on different topics, so the path is not always the same kind of challenge.
- Build the groups by team. They are built on the people who have a platform account, so it pays to check beforehand which teams end up genuinely represented.
- Set a start and a closing date. Two weeks is enough. With no end date the round dissolves and nobody knows when it finished.
- Announce it with something at stake other than money. Breakfast, the right to choose next month’s topic, a ridiculous trophy that moves from desk to desk. What matters is that there is a reason to look at the table.
- Close in public with the results per team. One message, three lines, the team that took part the most and the one that improved the most.
The closing weighs more than the kick-off. A round that starts with an announcement and ends in silence teaches the organisation that the next one can be ignored.
What can be measured when the round ends?
Video game reports show the participation, the score distribution and the leaderboard, and with groups built by team that reading opens up per group. It answers who played, how much and with what relative performance.
The limit is worth stating before someone reads the table backwards. The round does not prove that a person will recognise a fraudulent email next month. It moves the participation, the attention and the recall, which are conditions for learning to happen. Behaviour in a situation close to the real thing is measured with simulations and followed through the risk score, and that is a different reading which scores from a game do not replace.
Saying it that way also helps when the report goes up to management. A report that presents participation as participation and behaviour as behaviour is harder to argue with than one where everything appears mixed into the same chart.
When is a round across teams a bad idea?
There are three situations where it is better not to run one.
When mistakes are punished in the organisation. If getting it wrong has a cost, comparison across teams becomes one more reason not to take part, and the game loses the only thing that makes it useful, which is permission to try and fail. That permission is what makes getting it wrong while playing teach anything.
When access is unequal. If part of the workforce has no account and no screen of their own, the table will show entire teams sitting empty for a reason that has nothing to do with willingness. For that audience the road is a different one and we already walked it in the piece on awareness for people without a desk.
When the round is all there is. An occasional competition pays off when there is a program behind it that is already moving, with its own rhythm and content.
The grid of coloured squares
Wordle handed the same word to everybody on the same day, and with that it gave a lot of people a reason to talk about the same problem at once. The dictionary was already there. An awareness program can achieve something similar with what it already has in its catalogue. It is enough to let the score be seen.
If you want to try it, pick two short games, build the groups by team and give it a closing date. What happens in the office kitchen that week will never show up in a report, and it is the part that pays off most.
Leave a Reply