If you’ve ever sat through a corporate cybersecurity awareness module, you know the feeling. A man in a polo shirt explains what a phishing email is. There’s a quiz at the end. You click through it as fast as legally possible. You learn nothing. You forget everything. Three months later, you click a dodgy link about a parcel and your manager has to have a quiet word with IT.
I work in cybersecurity. I’ve watched this happen – to colleagues, to friends, to family – for years. And I’ve watched the industry keep producing the same training, the same modules, the same earnest videos, expecting different results.
So I’m building Cyberlingz. A free browser-based cybersecurity awareness game launching in three weeks. Built because I believe the way we teach this stuff is broken, and I’m done pretending otherwise.
The two ways cybersecurity training fails
There are two failure modes most awareness training falls into, and the industry has been ping-ponging between them for two decades.
The first is fear. Doom-laden statistics. “You could be next.” Headlines designed to make you feel one keystroke away from total ruin. The intent is to motivate; the result is paralysis. People shut down when they’re scared, and scared people don’t learn – they just feel hopeless and click “next” until the module ends.
The second is condescension. Cartoonish “click the safe link!” exercises. Oversimplified to the point of being insulting. Quiz questions written as if the audience can’t be trusted with a complete sentence. People switch off when they’re patronised, and patronised people resent you. They click through the training, certify completion, and continue exactly the behaviour the training was meant to prevent.
Neither approach works. We’ve known they don’t work for years – Verizon’s annual Data Breach Investigations Report consistently finds that the human element is involved in the majority of breaches, year after year. The industry keeps making the same training anyway.
I’ve written before about why cybersecurity awareness training is so boring – the short version is that it’s been optimised for compliance rather than learning, and those two things produce very different results.
What does work, in basically every other field
Engagement. Story. Curiosity. A character you actually want to spend time with. Real stakes that pull you into a world rather than browbeating you about a checklist.
This isn’t a wild new idea. It’s how Duolingo turned learning a language into something millions of people do daily. It’s how every good teacher you’ve ever had taught you anything. It’s how kids learn maths from games, how adults learn history from podcasts, how anyone has ever learned anything they actually wanted to learn.
It just somehow never made it to cybersecurity awareness.
Meet the Cyberlingz
Cyberlingz is set in Cyber City. Two characters – Willow and Kai – are the people you play as. They’re chibi cyberpunk-styled, somewhere between a K-pop music video and a Saturday morning cartoon. They’re not lecturing you. They’re not asking you to identify which of these four emails is “suspicious.” They’re trying to keep their city from glitching, and they need backup.
There’s also ARIA. ARIA is the AI who runs Cyber City. ARIA is sarcastic. ARIA has reviewed your password and the review was: brief. The finding was: no. Please try again. The game is built so that the actual cybersecurity skills – spotting phishing, building good password habits, understanding what a scam looks like in reality – emerge from gameplay. You don’t sit through a lesson on phishing and then take a test. You spot a dodgy email mid-mission because if you don’t, the mission fails. The skill builds because the game requires it, not because a quiz at the end demands it.
Who it’s for
Cyberlingz is built to work for anyone who uses the internet. Which is, currently, almost everyone.
The mechanics scale across difficulty levels. The humour is the same across all audiences – ARIA is sarcastic regardless of who’s playing. There’s an Easy mode that works for a curious nine-year-old. There’s a Hard mode for the working adult who’s done a thousand awareness modules and wants something that can actually challenge them. The Family plan lets parents set up profiles for up to three kids, with a dashboard that gives them visibility into what their kids are learning without turning into surveillance software.
That last part matters more than it sounds. A lot of “parental control” software treats kids as suspects and parents as wardens. Cyberlingz treats kids as players and parents as coaches. The dashboard isn’t there to bust your kid; it’s there to give you something to talk about with them. The premium tier even includes weekly conversation starters from ARIA – gentle prompts about what your kid is learning that you can bring up at dinner without it becoming a lecture.
A note about older audiences
I want to flag something about the people the cybersecurity industry serves worst, because it’s the bit that frustrates me the most.
A lot of awareness content aimed at older adults is actively patronising. It assumes confusion. It uses phrases like “even you can do this.” It treats decades of life experience as if it were a disability. The Stay Sharp Online and Safe & Connected book series – which are next in the willowbesecure roadmap, after Cyberlingz launches – will not do that. Older adults are not digitally illiterate. They simply didn’t grow up with these specific threats. Neither did anyone else when they were new. Respect is the bare minimum, and it’s a bar a startling number of cybersecurity educators can’t clear.
What’s free, what’s paid, why
The free tier of Cyberlingz is genuinely useful. Not crippled-free. Forever-free. One adult player or one parent-and-child setup, with Easy and Normal modes, the basic parent dashboard, and a monthly progress email. That tier alone is more than most paid awareness training delivers.
For families who want more – multiple kids, Hard mode, the full dashboard, the weekly ARIA insight email – there’s a Cyber+ Family plan. The first 200 sign-ups in each region get founding member pricing locked in for the lifetime of their subscription. That’s not a marketing trick. It’s a thank-you to the early adopters who took a chance on something new.
There are no ads. No loot boxes. No pay-to-win. No data sold to third parties. Player safety is the architectural decision the whole product was designed around, not a marketing line.
When and where
Cyberlingz launches in three weeks at cyberlingz.com. Free to play in your browser. No download. No installer. Click and play.
If you want to be one of the first people in – and lock in founding member pricing if you decide to upgrade – there’s an email reservation form on the site.
If you want to follow the build between now and launch, we’ll post on:
- LinkedIn (the long thoughts)
- Instagram (the Cyber Dictionary, twice a week)
- X / Twitter (the dry one-liners)
- YouTube (where things will end up once we work out what video looks like for us)
