Welcome detectives… you have 20 minutes to escape.
How Corrupted: Cyber Escape Room turned discovery into a serious business when it comes to cyber awareness.
Look closely at the picture. People discovering.
When we discover or have enjoyable experiences, we tend to remember them more than maybe a lecture or being shown a PowerPoint.
These colleagues are discovering in the name of cyber security and that’s critical in them remembering the key messages we in the ITV Cyber Team need to land with them.
Cyber crime is a constant and major threat to any business, large or small. Criminals are out to steal data, get to our finances, hold us to ransom both in our work lives and outside.
Over recent years, companies have invested more and more in defending themselves with powerful tools, stringent processes and talented people to monitor and protect.
All of these are in place against the backdrop of a war that cannot be won, because we need to continually be better than the criminals in how we defend ourselves while they are getting better at trying to attack us. There is no time to stand still.
However, while we can have the best of all the above, a company’s cyber security team needs to be as big as the whole organisation. It just takes one employee to click on something that could lead to a virus spreading across the network.
Safe human behaviour online is as critical as all the tools, firewalls and processes.
Awareness and the cultural fit
This is where cyber awareness comes in. Awareness is the crucial word, because it means many crucial things.
Awareness is not simply that we know about the threats and what to do when we see one, but it changes our behaviour so that when a dodgy email drops in asking us to urgently click on a link, we automatically pause, think and report it, or when we’re sending sensitive or confidential information we automatically encrypt it.
It’s incumbent on every company not just to tell people, but to ask themselves “what can we do to make sure our colleagues understand”
Critically, it’s important to innovate our approach, and truly understand what will work for the culture of the company?
The Escape Room — you have 20 minutes to discover
Working with many parts of ITV, we built an experience that worked for the culture of the company with ‘discovery’ the driving principle. Our people are creative, smart and inquisitive so we wanted to play to those strengths.
We worked with the Metropolitan Police, who were on a similar journey to us, to devise an experience that empowered colleagues to find out what the methods of cyber safety were, wrapped around a compelling narrative that reflected what we do.
In summary players got together in teams of four, and had 20 minutes to solve seven cyber security tasks based on a storyline of themselves playing detectives trying to clear their name after being accused of a data breach. The teams were helped along by some of ITV’s iconic TV detectives.
Once the team had completed the escape room, a debrief followed which re-emphasised the key learnings they had. We also gave them a team photo that carried the learnings for them to keep on their desks — a permanent reminder in the corner of their eye.
What it did for ITV’s cyber security
The impact of Corrupted, we saw an uplift in key metrics ranging from identifying a phish to better password security following surveys we carried out a few months after they took part.
Additionally, colleagues told us that they thoroughly enjoyed the escape room and wanted a longer experience next time and commented that it was a great exercise for team bonding too.
Time is precious for colleagues and so it was important that we took Corrupted to them and the escape room was deliberately designed to travel and set up in any meeting room as part of an ongoing programme rather than a one-off event.
From May 2019 to March 2020, we took Corrupted to five countries, with over 2000 colleagues playing over 500 escape rooms before halting because of COVID-19. We were fortunate enough to pick up an Internal Communications Brilliance award in December along the way.
An experience they’ll remember
Recently, I was in a completely unrelated meeting, when the subject of Corrupted came up. A colleague in Belfast then showed everyone his team photo carrying all the key messages, still close to hand at his home.
We went there with the escape room in September a full eight months earlier and he still remembered.
That captured, for me, the moment that fun really has an impact on lasting behavioural change.
