Cyber Security Awareness Month · October
Hackers Against Humans
A party game for people who click things.
Your team builds the phishing emails. Then they argue about which one would actually have worked on a real person. Every one of the 104 cards carries a real security tip, which is the entire point of it.
- Free
- 104 cards
- 3+ players
- No security knowledge needed
-
Print it
14 pages on a normal office printer. Cards come out at proper poker size, so they shuffle like real ones.
-
Play it online
One screen passed around the table, or everyone on their own phone with a room code.
Four parts make a fake email.
Two are dealt to the table. Two come out of your hand. You commit before you know how the email ends, which is where the comedy comes from and also the lesson.
-
The pretext
Whoever is the Inbox this round turns over a Prompt. It is a half-written email with three blanks in it.
-
Your move
Everyone else plays a Sender and a Hook face down. The tax office? Your manager? Santa Claus?
-
The ask
The Inbox turns over the Ask, what the email actually wants, then reads every finished email out loud.
-
Two winners
Catch of the Day is the one most likely to work. The Red Herring is the funniest. Then you read the security tips.
104 cards, four decks.
-
24 Prompts
The pretext. The urgent boss favour, the IT ticket, the delivery notice.
-
20 Asks
What they actually want. Approve the wire. Share the code we just texted you.
-
32 Senders
Who it claims to be from. The CFO, HR, your bank, the front desk.
-
28 Hooks
The pressure. Keep this between us. Your password expires today.
Nobody has ever finished the training module.
Awareness training tells people to watch out. It rarely shows them what they are watching out for, and it never lets them hold the thing in their hands.
Writing the attacks yourself works differently. You start noticing which combinations feel plausible and which fall apart, and the tell is almost always the same one. A sender who would never make that ask.
Is it actually free?
Yes. No trial, no demo call, no card. Print it as many times as you like and play it inside your organisation.
Do we need anyone technical?
No. That is the design brief. If someone on the team has an email address, they can play.
How do we play it online?
Two ways. Gather round one screen and pass it along, or one person hosts a room and everyone else joins from their own phone with a five-character code. Nothing to install either way.
Can we print it properly?
The download is set up for a normal office printer. If you want a real boxed deck for a team event, get in touch.
Have your plan ready.
Or at least have something your team will actually turn up to.
Made by StrongestLayer for Cyber Security Awareness Month