This article explains what SMARTFENSE video games are for, why their score does not measure knowledge or behavior, and how each video game in the catalog works: mechanics, when it ends and how the score is calculated.
What video games are for
SMARTFENSE video games are audiovisual content created by experts in cybersecurity and Game Based Learning. Their goal is to raise users' awareness of good information security habits in an engaging and fun way.
- Users complete each video game in a short time.
- At the end, they see a leaderboard that encourages healthy competition within the organization.
- All video games combine skill or strategy challenges with feedback designed to help users adopt secure behaviors.
All video games in the catalog can be played on computers and mobile devices.
What video games are not for
Video games are an awareness tool, not an assessment tool. In video games that have a score, that score cannot be taken as a measure of users' knowledge or behavior.
To assess, use the appropriate component:
- Knowledge: exams.
- Opinions: surveys.
- Behaviors: simulations.
Each player's performance and final score are independent of how much they have absorbed the knowledge and behaviors covered by the video game, for two main reasons:
- The score depends, to a greater or lesser extent, on the user's skill, which is independent of their knowledge or behavior.
- Video games provide positive reinforcement. Even when users make mistakes and do not score points, they receive feedback, learn and adopt a secure behavior.
Video game catalog
| Video game | What it reinforces |
|---|---|
| Fast and Secure | General information security knowledge. |
| Pass Slam | Telling secure passwords from insecure ones. |
| Whack-a-Hack | Understanding the damage attacks cause and how hard they are to contain. |
| Gupi's Adventures | Recognizing fake URLs before clicking. |
| Phishing Detective | Detecting the signs of a phishing email. |
| Sudden Change | Recognizing good and bad security practices in the office. |
| Match Pairs and Match Pairs - Lite | Basic cybersecurity terms. |
| Bugger | Telling secure passwords from insecure ones. |
| Data Invaders | Identifying which information is personal data (PII). |
| Cyber Tetris | Combining defenses and closing vulnerabilities in time. |
| Real or AI? | Identifying AI-generated faces (deepfakes). |
| Drag and Drop | Good practices on social media. |
| Triviados and Triviados Lite | Knowledge of different areas of cybersecurity. |
| Summer Passport | Threats associated with travel. |
| Ninja Slash and Ninja Slash: Extended Training | Stopping and verifying when a message shows warning signs. |
| Night Round | Leaving the workspace, physical and digital, protected. |
Fast and Secure
Sury is competing in a race and needs the user's help to win it. For each information security question the user answers correctly before time runs out, they earn a power-up: a boost at the start, super speed or super tires.
How it is played
- Questions are organized into three rounds. Each correct answer earns a power-up.
- All answers include feedback, to reinforce the correct one or explain the incorrect ones.
- At the end of each round, the user races against three other cars and can use the power-ups they earned.
When it ends: when the user finishes the last race. All phases have a time limit: if the user takes no action, the game moves forward with default options until it requires user input to continue.
Score: the total number of seconds the user needed to finish the three races. The lower the score, the faster they reached the finish line. Answering correctly increases the chances of a good time, but the result also depends on how the user uses the power-ups.
Pass Slam
Sury plays tennis against cybercriminals. The user hits each ball toward the "secure" or "insecure" basket, depending on the password it carries.
How it is played
- The user classifies passwords with the left and right arrow keys.
- The game has three rounds, each on a different court. At the end of each round, the user sees a summary of their performance and feedback on incorrect classifications.
- Each correct classification earns points based on when the key is pressed and the type of ball (normal or fast). Each incorrect classification costs a life.
When it ends: when the user classifies the last password of the last round.
If the user loses all their lives before the end, the video game is not considered completed.
Score: depends on the number of passwords classified correctly, the skill to hit the ball at the highest-value moment and the number of fast balls in the game (a chance factor).
Whack-a-Hack
Sury needs help defending the system. The user whacks the cybercriminals that appear with a click, without hitting their colleagues, and collects shields to earn extra lives.
How it is played
- It is mainly a skill game: the user clicks on the characters that represent the threats.
- Each of the three rounds represents a real attack scenario the organization could face.
When it ends: when the user loses their life or completes the video game successfully.
Score: the sum of the life the user keeps at the end of each round.
Gupi's Adventures
Gupi's favorite food is squid, but some of them are bait to catch him. The user analyzes the URL hidden in each squid and decides whether it is legitimate or fraudulent.
How it is played
- The user classifies URLs with the help of a wise fish that gives hints on demand.
- URLs are distributed in three rounds, each with more URLs than the previous one.
- The user receives immediate feedback on each classification and general feedback at the end of each round.
When it ends: when the user classifies the last URL of the last round.
If the user loses all their lives before the end, the video game is not considered completed.
Score: considers the number of URLs classified correctly and the total time of each round. Classifying correctly in less time gives a higher score.
Phishing Detective
Sury dresses up as a detective and needs help reviewing her inbox. The user inspects each email (sender, links and attachments) and decides whether it is legitimate or a phishing attempt.
How it is played
- The user classifies emails, with hints from Sury on demand.
- Emails are distributed in three rounds.
- The user receives immediate feedback on each classification.
When it ends: when the user classifies the last email of the last round. There are no lives or time limits that make the user lose; it only ends earlier if the user quits.
Score: considers the number of emails classified correctly, the total time of each round and the number of hints requested. Classifying correctly, in less time and with fewer hints gives a higher score.
Sudden Change
The workday is over and Sury wants to go home, but the exit code has changed for security reasons. In this escape room, the user solves challenges and clues so that Sury can turn on the PC and see the new code.
How it is played
- The user analyzes the elements on screen, saves items in their inventory and solves puzzles and clues to get out of the office.
- Along the way, good and bad security practices appear that the user can interpret and adopt.
When it ends: when the user escapes from the office. There are no lives or time limits that make the user lose.
Score: this video game has no score.
Match Pairs
Gupi needs to recover his home, the sea, from a virus that threatens it. For each round completed, he receives part of the antidote.
How it is played
- The user matches each fish, which carries a cybersecurity concept, with the coral that contains its definition. Clicking a fish reveals the concept, and clicking a coral reveals the definition.
- If the pair is correct, the fish enters its coral. If it is incorrect, a hook comes down and the user loses points.
- Pairs are distributed in three rounds.
When it ends: when the user completes the three rounds, or when time or lives run out.
Score: considers the number of pairs matched correctly. Each incorrect pair subtracts points.
Match Pairs - Lite
It is a short version of Match Pairs, with the same mechanics, the same story and the same score calculation.
When it ends: when the user completes all rounds, or when time or lives run out.
Bugger
BUG needs to reach her shelter, but the path is full of obstacles and weak passwords. The user guides her to catch the strong password and dodge the weak ones.
How it is played
- The user moves BUG along a path with moving obstacles to one of the five shelters at the end.
- To enter a shelter, BUG must first catch the strong password on the path. Each attempt has a 30-second limit.
- The user has three lives. They lose one if they hit an obstacle or a weak password, if time runs out, if they arrive without the strong password or if they do not enter a free shelter.
When it ends: when the user fills the five shelters (wins) or loses all their lives.
Score: considers the number of shelters reached, the time remaining when reaching each one and a bonus for catching the extra item that appears in some shelters.
Data Invaders
The user guides a character through a platform scenario and must collect only personal data (PII), avoiding information that is not.
How it is played
- Each piece of personal data collected adds points, and collecting several in a row increases a multiplier.
- Each incorrect item subtracts points and takes away one of the three lives.
When it ends: when the user collects all the personal data in the scenario (wins) or loses all their lives.
Score: correct items add points and incorrect ones subtract them, with a streak multiplier. When winning, the user gets bonuses for time, lives kept, not collecting incorrect items and completing the mission.
If the user loses with a negative score, 0 is recorded.
Cyber Tetris
The system is under threat and the user must keep it running. At the end, they receive an incident report with the results of the game.
How it is played
- The user arranges falling pieces to complete lines. Each piece represents a cybersecurity element, and certain combinations in a line activate defense protocols that add extra points.
- Ransomware infects blocks on the board, and uncovered gaps act as vulnerabilities. Both reduce the system's health, which recovers when lines are completed.
- The game advances through levels as the user completes lines.
When it ends: when the user completes 21 lines (wins), or when the system's health reaches zero or the pieces reach the top of the board (loses).
Score: considers the lines completed at once, the level reached, combos for completing lines quickly and bonuses for strategic moves, such as applying a mitigation.
Real or AI?
The user receives friend requests on a social network and must decide whether each profile photo is real or AI-generated.
How it is played
- The game has 15 images and the user has 10 seconds to answer each one.
- After each answer, the user sees the details they should have noticed.
- If the user does not answer in time, the image counts as incorrect and the game continues.
When it ends: when the user finishes the 15 images, with any result.
Score: considers the number of correct answers and how quickly each one is answered. Incorrect answers do not add points.
Drag and Drop
Hermit needs to clean up the sandbank, and the user helps him over three rounds about social media.
How it is played
- The user drags each item (a post, a piece of personal data or a behavior) to the regular bin, if it is safe, or to the shredder, if it is risky.
- If the user is right, they earn points and receive a message that reinforces the decision. If they are wrong, a seagull takes the item away and points are subtracted.
- The rounds cover what is safe to share, which behaviors are safe or risky, and how to protect a personal profile.
When it ends: when the user completes the three rounds, or when time or lives run out.
Score: considers the number of items placed in the correct container. Each mistake subtracts the points that item would have added.
Triviados
The user spins the wheel, answers multiple-choice questions and accumulates correct answers in each category to capture them all.
How it is played
- The wheel selects a cybersecurity category and the user answers a question on that topic in 20 seconds.
- Each answer includes educational feedback.
- By accumulating correct answers in a category, the user captures it. Each incorrect answer takes away one of their five lives.
When it ends: when the user captures all categories (wins) or loses their five lives.
Score: considers the number of correct answers, the streak of consecutive correct answers (multiplier of up to x5) and the speed of each answer.
Triviados Lite
It is a short version of Triviados, with the same mechanics and score calculation. The differences are:
- With one correct answer in a category, the user captures it.
- The user has three lives.
When it ends: when the user captures all categories (wins) or loses their three lives.
Summer Passport
The user goes through the seven stages of a trip, from booking to returning home. Each challenge completed adds a stamp to the passport.
How it is played
- The user opens seven doors in order. Each one presents a challenge linked to a stage of the trip, such as an AI-generated accommodation listing, a malicious QR code, a scam email or a fake call from the bank.
- Completing a door unlocks the next one.
- Each correct decision adds points and each incorrect decision subtracts them.
When it ends: when the user completes the last of the seven doors. There are no lives that make the user lose.
Score: considers correct decisions, which add points, and incorrect ones, which subtract points without the total dropping below 0. A final bonus is added if the user makes no mistakes.
Ninja Slash
The user slashes with the katana the signs that require stopping before acting on a message (urgency, a request for data or money, and contact through a new channel) and lets through what arrives through the usual channels.
How it is played
- Before each round, the user answers a question about a suspicious message. A correct answer adds a bonus.
- The game has three 30-second rounds.
- If the user slashes three incorrect objects in a row, the round ends early.
When it ends: when the last of the three rounds ends. Each round ends when time runs out, so there are no lives that make the user lose.
Score: considers the correct objects slashed, with a multiplier for slashing several in a row (up to x8), the penalty for slashing objects that do not apply and the bonus for each round's question.
Ninja Slash: Extended Training
It is an extended version of Ninja Slash, with the same slashing mechanics, duration and ending. The difference is that before each round the user answers three questions in different formats: identifying the sign, true or false, and what to do in a given case. Each answer shows an explanation.
Score: the same as in Ninja Slash, with a bonus for each question answered correctly before each round.
Night Round
The user helps the office ghost check what was left exposed after the Halloween party.
How it is played
- The user goes through three floors of the office and checks objects and devices to resolve risk situations, such as a door left propped open, a fake QR code, an AI assistant that is still recording, a postponed update or a party photo ready to be posted.
- Each floor has a 90-second time limit, represented by a candle. The floor ends when the user resolves all the risks or the candle burns out.
When it ends: when the user finishes the last floor, either because they resolved all the risks or because time ran out. There are no lives that make the user lose.
Score: considers the number of risks resolved on each floor and the candle time remaining at the end.
💡 Best practices
- Use video games to reinforce topics already covered in interactive modules or videos, and as a playful complement within the awareness program.
- Choose the video game according to the topic you want to reinforce, using the catalog table as a reference.
- Choose the short versions (Lite) when users have little time or for reinforcement campaigns.
- Do not use the score or the leaderboard to assess users: to measure knowledge, opinions or behaviors, use exams, surveys or simulations.
- Present the leaderboard as an incentive to participate, not as a ranking of security performance.