Enabling Secure-Work-From-Home Through Engaging Gamified Scenarios

An office protects its people whether or not they think about it. The network is managed, the printer sits behind a firewall, and nobody has to decide whether the router is a risk. Move that same work into someone home and every one of those protections becomes a personal decision made by someone who was never asked to make it.

When remote working expanded rapidly during the pandemic, a leading software company came to our team with the question underneath all of this. How can a home be as safe as the office? It wanted its employees to take the right precautions and follow IT best practices, and it wanted them to absorb and apply those practices through an immersive, experiential program driven entirely by scenarios and stories.

The Challenge

Security awareness training has a well-earned reputation for being ignored, and the reason is structural rather than stylistic. Most of it lists rules without ever showing the moment where a rule applies, which leaves employees able to recite good practice while still plugging a work laptop into an unsecured home network.

The requirement here explicitly ruled that approach out. The learning had to run purely on scenarios and stories, which meant the best practices could not simply be stated. They had to be discovered inside situations learners would recognize from their own homes.

How the Solution Was Built

Wrapping the content in a game

Our first step was to wrap the essential content carefully inside a gamification concept, both for easier understanding and for greater recall. Wrapping is the right word for what happened. The security content was not diluted to fit a game. The game was built around it so that the same material arrives through a route learners are willing to follow.

Starting with what actually changed

The program opens by comparing the office environment with the remote one, letting learners move a slider between the two and see how the picture around employees, clients, and other assets shifts. Beginning here answers the question every learner brings with them, which is what is different now, before any specific practice is introduced.

A home learners can explore

Best practices were presented in real-life contexts through characters and their stories. Learners are placed in the home of a character named Jack and asked to explore his surroundings, examining the router, the VPN, the open-source software on his laptop, and the other connected devices scattered around the house.

This screen is the heart of the design. It reproduces the actual conditions of remote work, which is a working day happening in a room that also contains a family printer, a smart device, and a laptop left open on the sofa. A learner clicking through Jack home is doing exactly the audit they should be running on their own.

Gamified scenarios with something at stake

An intriguing narrative, gamified scenarios that give learners a competitive edge to play for, and sound effects all lift engagement through the program. Learners work through locations in a Secure City Challenge and earn badges for the decisions they get right, with the option to retry a location they do not clear.

Allowing a retry rather than simply marking an answer wrong matters on this subject. The aim is a learner who understands why a choice was unsafe, not one who has been scored and moved on.

Custom visual design built for the brand

We created customized, visually appealing designs matched closely to the company brand so the program would resonate with its employees, and kept the interactions simple but impactful. For a software company whose staff work with well-designed products all day, a course that looks generic would have undermined its own message before the first screen finished loading.

The Strategies Behind the Design

Four strategies power the solution.

• Scenario Based Learning
• Story Based Learning
• Custom Visual Design
• Gamification

Delivery combines microlearning and mobile learning through the client LMS and LXP, which suits a program aimed at people who are, by definition, not in the office.

The Impact

Learners related to the course and reported that they were able to understand the concepts well, which is the minimum bar for security training and one that a surprising amount of it fails to clear.

More substantially, the program changed how learners perceived cyber security while working from home, and best practices were taken up by a growing number of employees. Shifting perception is the outcome that matters here, because home security decisions are made continuously and privately, in moments no policy document reaches.

The success of the training also led the company to launch a series of similar programs supporting its functional, organizational, and ethical growth.

Build Security Training People Act On

Remote and hybrid working made every employee home part of the corporate attack surface, and that has not reversed. Training that lists rules will not change what people do there. This program worked because it put learners inside a home that looked like their own, gave them something to play for, and let them get a decision wrong and try again. If you need security awareness training that changes behavior rather than logging completions, Liberate can help you build it. Get in touch to talk it through.

‍