Loading...
safety

Cybersecurity Awareness Challenge

A department-based Cybersecurity Awareness Challenge that turns quiz completions and security training into a month-long contest. Use it to drive verified learning activity during Cybersecurity Awareness Month without relying on manual scoring.

See it in MangoApps

Trusted by frontline teams 15 years of frontline software

Built for: Technology · Financial Services · Healthcare · Manufacturing · Professional Services

Overview

This Cybersecurity Awareness Challenge template is a department contest for October that rewards verified learning activity, not self-reported effort. Departments earn points when their members pass security quizzes or complete assigned courses, and the standings are normalized per capita so smaller departments can still compete fairly.

Use it when you want to raise completion rates for mandatory security awareness training, phishing education, or policy refreshers without building a manual spreadsheet contest. The template is a good fit when the audience is broad, the actions are already tracked in your learning or security system, and you want a clear finish line for a seasonal campaign. It is especially useful when security, HR, and internal communications need one shared format that is easy to explain and easy to audit.

Do not use this template for open-ended leaderboards, for external metrics the platform does not track, or for punitive ranking of individuals. It is not meant for sales, wellness, fundraising, or other manual KPI races, and it should not be turned into a bottom-shaming exercise. Because the goal type is highest_score and the scoring mode is metric-based, the contest works best when every point comes from a verified action such as quiz.passed or course.completed. That keeps the standings simple, fair, and resistant to Goodhart’s-law problems.

Standards & compliance context

  • Because this is a cooperative training contest, it is easier to align with works-council-sensitive environments than a punitive ranking format.
  • Scoring is based on verified system actions, which supports auditability and reduces disputes about who completed training.
  • The template should be reviewed against internal security policy, HR policy, and any local labor or employee-relations requirements before launch.
  • If the contest is tied to mandatory training, make sure participation incentives do not conflict with required completion deadlines or compliance obligations.

General regulatory context for orientation only — verify current requirements with counsel or the relevant agency before relying on this template for compliance.

How to use this template

  1. Set up the contest for a 31-day October window and choose department as the team scope so every department enters the same seasonal challenge.
  2. Connect the scoring rules to the verified actions quiz.passed and course.completed so points are awarded only when a learner actually completes training.
  3. Publish the standings with per-capita scoring enabled so departments of different sizes compete on a fair basis.
  4. Assign the prize as points and explain how those points will be used, redeemed, or recognized at the end of the contest.
  5. Launch the contest with a short message that tells employees which quizzes or courses count, how the standings work, and when the challenge ends.
  6. Review the final standings after the month closes, recognize the top departments, and capture any lessons for the next awareness campaign.

Best practices

  • Keep the contest seasonal and time-boxed so it feels like a campaign, not a permanent leaderboard.
  • Use only verified learning actions for scoring so the standings cannot be inflated by self-reported activity.
  • Explain per-capita scoring up front so smaller departments understand why they can still win.
  • Tie the contest to a small set of named quizzes or courses so employees know exactly what counts.
  • Avoid individual public rankings unless the audience explicitly wants opt-in competition and the culture supports it.
  • Announce the finish date before launch so managers can plan reminders and follow-up.
  • Use the contest to reinforce learning, not to pressure people who are already overloaded with required training.

What this template typically catches

Issues teams running this template most often surface in practice:

Departments delay participation until the last week, which makes early reminders and manager nudges important.
Teams sometimes assume all security activities count, when only quiz.passed and course.completed are scored in this template.
Smaller departments may disengage if per-capita scoring is not explained clearly at launch.
Organizers sometimes forget to define the exact end date, which weakens the contest structure.
Manual spreadsheets create disputes when the platform already tracks the relevant actions automatically.
Publicly ranking individuals instead of departments can create resistance in mixed-seniority or privacy-sensitive workplaces.
If the training catalog is too broad, employees may complete low-value courses that do not support the campaign goal.

Common use cases

IT Security Team Running October Awareness Month
An IT security team launches the contest across all departments to drive completion of phishing and policy quizzes during October. The per-capita standings keep finance, operations, and support departments on equal footing.
HR-Led Mandatory Training Push
HR uses the template to turn required annual security courses into a visible department challenge. The verified scoring helps HR avoid manual tracking while still giving managers a simple way to encourage completion.
Healthcare Compliance Education Campaign
A healthcare organization uses the contest to reinforce safe handling of sensitive information and phishing awareness. The department format works well where broad participation matters more than individual competition.
Manufacturing Site Security Refresh
A manufacturing company runs the challenge across plant and office departments to improve completion of short security modules. The time-boxed format fits shift-based teams that need a clear start and finish.

Frequently asked questions

What is included in this Cybersecurity Awareness Challenge template?

This template is a department contest built around verified learning actions: quiz.passed and course.completed. It uses a highest_score format with per-capita scoring, so larger departments do not have an automatic advantage. The prize is points, and the duration is set for a 31-day Cybersecurity Awareness Month run.

Who should run this contest?

It is usually run by security, HR, or internal communications, with support from managers who can encourage participation. Because scoring is based on system-verified actions, the organizer does not need to collect screenshots or manually tally results. That makes it practical for a small program owner as well as a larger awareness team.

How often should this contest run?

This template is designed for a 31-day seasonal cadence, which fits Cybersecurity Awareness Month well. It works best as an episodic contest rather than an always-on leaderboard, because contests need a clear start and finish. If you want a recurring format, clone it for future awareness campaigns instead of leaving it open-ended.

Why is per-capita scoring important here?

Per-capita scoring helps departments of different sizes compete fairly, since a large team should not win just because it has more people. That matters in workplace gamification because raw totals can discourage smaller departments from participating. This template is specifically set up to avoid that problem.

Can I use this for phishing simulations or other security activities?

Yes, as long as the activity produces one of the tracked verified actions in the template, such as a passed quiz or completed course. If your phishing simulation platform records a completion event that maps to one of those actions, it can fit well. If you need to score external metrics that the platform does not track, this template is not the right mode.

What are the most common mistakes when launching this contest?

The biggest mistake is using manual scoring for a metric the platform already tracks, which adds work and creates disputes. Another common issue is forgetting to set a clear end date, which turns a contest into a leaderboard. It also helps to avoid public bottom-ranking if your audience includes mixed-seniority departments.

Can this be customized for different departments or regions?

Yes. You can keep the department team scope and adjust the copy, prize points, and onboarding language for different regions or business units. If some groups have different training requirements, make sure the contest still scores only comparable verified actions so the standings stay fair.

How does this compare with an ad-hoc training reminder campaign?

An ad-hoc reminder campaign may increase awareness, but it usually does not create a visible finish line or team momentum. This template gives you a defined contest, standings, and a clear scoring rule, which makes participation easier to understand. It also reduces admin work because the platform counts completed actions automatically.

Does this create any compliance or employee-relations concerns?

The format is designed to be cooperative and non-punitive, which is safer for works-council-sensitive environments. Because it rewards verified training actions rather than shaming low performers, it is easier to position as engagement support instead of discipline. You should still review local policy and labor guidance before launch.

Go deeper on the topic

Related guides

Ready to use this template?

Get started with MangoApps and use Cybersecurity Awareness Challenge with your team — pricing built for small business.

Get Started