The spoofed sender
An email “from your CEO” whose address is one letter off your company’s domain: the lookalike domain.
Escape the Breach · the Inbox room · phishing awareness game
Phishing game for employees
A phishing game is security awareness training you play instead of watch. Ours is the Inbox, the first room of Escape the Breach, rebuilt in your company’s logo and colors from your website in about a minute: spot the fake among real-looking emails and prompts, and see the tell behind every wrong click. It is free to play. The full 30-minute game adds passwords, devices and reporting, a quiz and a certificate.
Already have one? Play the demo at Harborview, a company we made up.
What’s in the phishing game
The urgent payment request
Gift cards or a changed bank account, today, and “don’t call me”: urgency, authority and an unusual request.
The MFA-fatigue prompt
Sign-in approval requests you did not start, one after another, until someone taps Approve to make them stop.
The QR-code phish
A QR code in an email or on a poster that leads to a fake sign-in page, out of sight of your email filter.
The reply-all leak
A spreadsheet of personal data about to go to the whole list, or to an outside address that looks internal.
After a click
Someone already opened the link: who to tell, how fast, and why deleting the email helps the attacker.
Every wrong click shows the tell you missed, and nothing locks you out. At the end: your score and the tell that caught you out most.
The full game: three more rooms and the quiz
- The Vault: Strong passwords and multi-factor authentication
- The Desk: Securing devices: a laptop left open, an update, a found USB stick, free Wi-Fi
- The Phone: Phone scams (vishing) and reporting an incident
- The quiz: 11 questions, 9 right to pass, unlimited retakes.
Based on guidance published by CISA (Secure Our World) and NIST. ReMotivator is not affiliated with or endorsed by any U.S. government agency.
Why a phishing awareness game, not a video
A video tells people what a phishing email looks like; a game makes them find one, in an inbox that looks like their own, with their own company’s name on it. Each decision is theirs, each mistake shows its tell straight away, and the record shows who finished. The content follows CISA’s public guidance on recognizing and reporting phishing.
Phishing training for employees: what it supports
Supports your training requirement under:
- HIPAA Security Rule, 45 CFR 164.308(a)(5): security awareness and training (covered entities and business associates)
- GLBA Safeguards Rule, 16 CFR 314.4(e): security awareness training
- PCI DSS v4, requirement 12.6: security awareness program
- NIST SP 800-53 AT-2 and NIST CSF PR.AT; CMMC Level 2 awareness and training (AT) practices
- SOC 2 (CC1 and CC2 training controls); NY DFS 23 NYCRR 500.14
The free phishing game is one room; the requirement is supported by the full game and its records. Your own policies, simulations and risk assessment stay yours.
Price
Prices in US dollars.
Free play
$0
The phishing game (the Inbox room) in your brand. No sign-up.
Single seat
$29
One person: the full Escape the Breach, the quiz and a Certificate of Completion. Only an email address needed.
Pair
$49
Escape the Breach plus bloodborne pathogens or HazCom training, a certificate for each.
Teams
from $199
$19 per person, from $199 per run + $500 once branded setup: the dashboard, the roster and due dates.
Company Pass
$49 per employee per year
All four games + party catalogue, unlimited self-play runs, 12 months
Single-seat checkout opens soon: leave your email and we send you the link.
A sample certificate and the team roster
Sample: a fictional person
Certificate of Completion — Security Awareness Training (based on CISA Secure Our World / NIST SP 800-50 guidance)
- Name
- Jane Doe
- Date
- November 3, 2026
- Score
- 10 / 11
- Valid for annual refresh by
- November 3, 2027
- Check it
- /verify/<certificate number>: a page with the name, course, date and score
The team roster
One row per person: the date completed, the score, the weakest room and the next due date. Export as CSV or PDF, next to your phishing simulation results.
| Name (sample) | Job title | Completed | Score | Next due |
|---|---|---|---|---|
| Jane Doe | Account manager | Nov 3, 2026 | 10 / 11 | Nov 3, 2027 |
| John Doe | Designer | Nov 4, 2026 | 9 / 11 | Nov 4, 2027 |
| Sam Doe | Intern | — | — | Not started |
Sample only: Jane Doe, John Doe, Sam Doe and Harborview Software are made up.
Questions
Is this a phishing simulation?
No. A phishing simulation sends test emails to your staff’s real inboxes; this is a phishing training game they play. Many companies use both: pair it with your simulation tool, and we export the roster of who played and passed.
Is it a phishing awareness game or a full security awareness course?
Both. The free phishing game is the Inbox room. Escape the Breach, the full game, is security awareness training content delivered as a game: its four rooms cover CISA’s four Secure Our World behaviors (recognize and report phishing, use strong passwords, turn on multi-factor authentication, update software), then an 11-question quiz.
How long does it take?
The phishing game takes about 8 to 10 minutes. The full game takes about 30 minutes plus the quiz, on a laptop or a phone.
Is it a phishing certification?
No. There is no official phishing certification. Passing the full game’s quiz (9 of 11) gives a certificate of completion with your name, the date and your score, and a verification page an employer can check.
Can we use our own phishing examples?
Yes. Custom examples, such as the suppliers and tools your people really use, are part of the $500 branded setup.
Does it work on phones?
Yes. It plays in the browser on a laptop, a tablet or a phone. Nothing to install, no account.
Is there a free phishing quiz or game?
The phishing game itself is free to play in your own brand: type your company’s website at the top of this page. The full game, the quiz and the certificate are paid.
Is this a cyber security escape room?
Yes: Escape the Breach is a cybersecurity escape room for employees. Your branded office on a Monday morning, four rooms, a criminal group we made up as the attacker and your people as the defenders.
Supports your training requirement under the frameworks above. ReMotivator is not affiliated with or endorsed by CISA, NIST, DHS or the FTC. A training game is not a phishing simulation and does not test your staff’s real inboxes.
Escape the Breach, the security awareness training game · Bloodborne pathogens certification (the pair) · OSHA training online · All training games
Train your whole team
Tell us how many people and when your training is due. We reply within one working day.