Run a 30-minute security awareness game
A practical plan for one session with Breach, Tailgater or the security basics quiz. It fits a team meeting, a lunch-and-learn or a slot in Cybersecurity Awareness Month. Print it, or keep it open next to the big screen while you host.
Free for quizzes with up to 100 players and party games with up to 15.
Before you start
- Sign in at lumibout.com with your email; there’s nothing to install.
- Choose Host a game, then the Breach tab, or the Undercover tab with the Tailgater theme. For the quiz, open the security basics quiz template.
- Have your own reporting steps ready: where to report a suspicious email, and who to call about a lost badge.
- Test the projector or the screen share, and make sure people have their phones.
Agenda by minute
| Time | What happens | What you do |
|---|---|---|
| 0:00–0:03 | Welcome and join | Put the PIN and the QR code on the big screen. Everyone joins at lumibout.com with a nickname. Say why you’re here: phishing and tailgating rely on people being helpful. |
| 0:03–0:06 | Explain the game | Breach: a few players are hackers; after hours they pick a colleague to phish, the Security analyst checks someone’s logs and IT helpdesk turns on MFA for one person. Tailgater: one or two people have a slightly different badge word. Hold the card to peek, and keep your phone to yourself. |
| 0:06–0:20 | Play | With the default timers a Breach round takes about 3 to 4 minutes (45 seconds after hours, 2 minutes of morning standup, 40 seconds of security review), and the game ends after at most 4 rounds. Jot down the tips the big screen shows. Use Next to move on or +30 s if a table needs more time. |
| 0:20–0:27 | Debrief | Walk through two or three moments from the game and the tip that went with each (below). |
| 0:27–0:30 | Close | Show your own reporting steps on the screen, thank everyone, and say what you’ll send afterward. |
Tailgater runs at a similar pace: each person gets 20 seconds to introduce their badge word, then 40 seconds for the badge check. Phases end early once everyone has acted. If time is short, set fewer rounds (3 to 8, default 4) when you open the room, and a shorter discussion (Breach) or less time per speaker (Tailgater).
Which game for which group size
| Group | Play | Good to know |
|---|---|---|
| 1 to 3 people | Security basics quiz | Breach and Tailgater need more players. |
| 4 or 5 people | Tailgater | Breach needs at least 6. |
| 6 to 15 people | Breach or Tailgater at one table | The Free plan covers party games with up to 15 players. |
| 16 to 100 people | Breach or Tailgater by table, or the quiz | Big rooms split into tables that play at the same pace (9 per Breach table and 7 per Tailgater table by default). Party games with more than 15 players need Plus, Pro or an Event Pass; quizzes are free up to 100. |
| More than 100 | The same, by table | Plus takes 300 players, Pro 2,000, and an Event Pass 500 or 2,000 for one event. |
| Remote or hybrid | Any of the above | Share the big screen on the call; everyone joins on their phone with the PIN. For several tables, open one breakout room per table. |
Players who are out stay in the game: they can predict who goes next and score points for it, so nobody sits idle.
How to debrief with the tips
The big screen shows one short, true tip after each round, tied to what just happened. Use those tips as your script: name the moment, read the tip, then ask the room one question.
| In the game | The tip on the big screen | Ask the room |
|---|---|---|
| IT helpdesk turned on MFA and the phish was blocked | MFA stops most password attacks. Never approve a sign-in prompt you didn’t start. | Has anyone had a sign-in prompt they didn’t expect? What did you do? |
| A hacker blended in at the morning standup | Attackers often pose as executives; confirm odd requests another way. | How would you check an urgent request from a manager? |
| A colleague was phished overnight | Report a suspicious email even if you already clicked; the sooner, the better. | Do you know where to report one here? |
| The tailgater’s badge word was almost right | A uniform or a clipboard isn’t proof that someone belongs. You can be polite and still ask to see a badge. | What would you say to someone you don’t know at a secure door? |
Finish with your own steps, not the game’s: where to report, who to call, and that reporting a false alarm is always fine.
What to send afterward
Send a short note the same day, while the game is fresh. Replace the [brackets] and keep it to the tips people saw.
Subject: Thanks for playing [Breach / Tailgater] today
Thanks for joining today’s security awareness game. Three tips from the big screen to keep in mind:
1. Real IT will never ask for your password.
2. Never approve a sign-in prompt you didn’t start.
3. Don’t hold the door for someone you don’t know.
To report a suspicious email: [your report button or address].
Lost your badge, or saw someone without one? [who to contact].
Next session: [date and time].
- Share the tips with the whole group, not individual scores. If you ran the security basics quiz, its results download as a CSV at the end of the game.