Defending against phishing
The Inbox
Find the fake message in a real-looking inbox, tag the tells that gave it away, and decide what to do after someone has already clicked.
Escape the Breach · security awareness training game
Security awareness training as a game your employees finish
Ready the same day.
Escape the Breach is a 30-minute security awareness escape game in your company’s brand. Each employee plays four rooms of your office on a Monday morning: phishing, strong passwords and MFA, securing devices and reporting an incident. It is based on guidance published by CISA, NIST and the FTC. Everyone who passes the quiz (9 of 11) gets a record of completion. Setup is $500 once, then $19 per person, from $199 per run.
Plays in the browser, no sign-up. The demo is set at Harborview Software, a company we made up.
How it works
Four rooms of your own branded office on a Monday morning. Every employee plays on their own device, learns by doing and gets a record of completion.
Send us your details
Your logo and colors (we read them from your website; you check them), where people report a suspicious message and your IT contact. You can add your CEO’s name for the phishing room and your policy line. You type every name; we never take people’s names from the web.
Ready the same day
We set up your branded game and send you the links, the same day. A criminal group we made up, never your company, is the attacker; your people are the defenders.
Everyone plays
Each person opens the link on a laptop or a phone, nothing to install, and plays for about 30 minutes, alone or with a few colleagues. You get the report and the records of completion.
What employees do in the game
Four rooms, about 30 minutes. A wrong move shows why it was wrong and never locks anyone out. Each room ends with a short learn card.
Strong passwords
The Vault
Pick the strong password, see why one key for two doors is a problem, and set up the second lock: multi-factor authentication.
Securing devices
The Desk
A laptop left open, an update waiting, a USB stick found in the lot, an app that asks for too much and the free Wi-Fi at an airport café.
Reporting incidents
The Phone
What to do first, who to call and why staying quiet is the trap. The end screen shows where your people report a suspicious message.
Based on guidance published by CISA (Secure Our World), NIST (SP 800-50) and the FTC (Cybersecurity for Small Business).
What you provide
Your brand
Logo, colors and company name, read from your website and checked by you.
Where to report
The address or channel for a suspicious message, and your IT contact.
Optional
Your CEO’s name for the phishing room and your policy line. Without them, the game says “your CEO” and “the IT helpdesk”.
Nothing else
No logins, no user lists, no installs: you send people the link.
Records of completion and reports
Record of completion
Everyone who passes the quiz at the end (9 of 11 right) gets “Security Awareness Training — Record of Completion” as a PDF, with their name, the date and the score. Retakes are unlimited; the best score counts.
The report
Per person, as CSV and PDF: completed, score, time, the weakest room and what was missed most, with a summary for your company.
For your auditor
Supports your training requirement under:
- HIPAA Security Rule, 45 CFR 164.308(a)(5): security awareness and training (covered entities and business associates)
- GLBA Safeguards Rule, 16 CFR 314.4(e): security awareness training
- PCI DSS v4, requirement 12.6: security awareness program
- NIST SP 800-53 AT-2 and NIST CSF PR.AT; CMMC Level 2 awareness and training (AT) practices
- SOC 2 (CC1 and CC2 training controls); NY DFS 23 NYCRR 500.14
This training and its records are evidence toward these requirements; your auditor decides what each one needs.
Thirty days after someone finishes, a five-question refresher checks what stuck: its links are in the report.
Pricing
Prices in US dollars. Nothing to buy online: we send you a quote and an invoice.
Setup, branded
$500 once
Your logo, colors and contacts.
Play, self-play
$19 per person, from $199 per run
Everyone on their own device.
Run again
Per-person price only; no annual fee
Next cohort, next year, next launch.
| Group | Setup and the first run | Each run after |
|---|---|---|
| 25 employees | $975 | $475 |
| 100 employees | $2,400 | $1,900 |
| 250 employees | $5,250 | $4,750 |
Hosted live session
On request: our game master runs a live team session. Ask for a quote.
Example: 120 staff, annual security awareness
$500 + 120 × $19 = $2,780 first year; $2,280 a year after.
Bundle: Kickoff + Security
Close the Deal + Escape the Breach: One $2,500 setup covers both; play at list.
Bundle: Training Pack
All four games, 12 months: $3,000 setup total; $15 per person per run.
Bundle: Company Pass
All four games + party catalogue, unlimited self-play runs, 12 months: $49 per employee per year; hosted events +$10 per person.
Questions
What does Escape the Breach teach?
The four topics most security awareness programs start with: spotting phishing, strong passwords and multi-factor authentication, securing laptops and phones (updates, USB sticks, apps, public Wi-Fi) and reporting an incident quickly. It is based on guidance published by CISA (Secure Our World), NIST and the FTC.
Does it count toward our security awareness training requirement?
It supports your training requirement under rules such as the HIPAA Security Rule, the GLBA Safeguards Rule, PCI DSS 12.6, NIST SP 800-53 AT-2 and SOC 2 training controls. The training and its records are evidence toward these requirements; your auditor decides what each one needs.
Who gets a record of completion?
Everyone who passes the short quiz at the end: 9 of 11 questions right. Retakes are unlimited and the best score counts. The record, “Security Awareness Training — Record of Completion”, carries the person’s name, the date and the score as a PDF, and you get every record in the report.
What does it cost?
Setup, branded: $500 once. Then $19 per person, from $199 per run. Running it again costs the per-person price only, with no annual fee. Prices in US dollars; we send a quote and an invoice.
How fast can we have it?
Ready the same day. Send your logo, where people report a suspicious message and your IT contact, and we send you the links.
Do you need our employee list?
No. You send people the link; each person types their own name (and, if you like, a work email) at the start, so the record and the report carry it. Names in the game itself, like a CEO, a warden or a team lead, are typed by you, never taken from the web.
Can we try it first?
Yes: the free Harborview demo opens a fresh game straight away, with no form and no sign-up. Harborview Software is a company we made up to show the game; your game uses your brand and your details.
Can we run it live with a game master?
Yes, on request: our game master runs a live team session, with teams playing together. Ask for a quote.
Based on guidance published by CISA (Secure Our World) and NIST. ReMotivator is not affiliated with or endorsed by any U.S. government agency. Harborview Software, its people and its office are fictional, made up for the demo.
More training games: Clear the Floor · First Week · Close the Deal (sales kickoff) · All training games and bundles
- 3,000+ teams since 2020
- Running virtual team games since 2020
Try Escape the Breach now
Tell us how many people and when your training is due. We reply within one working day.