Most security awareness training fails for one reason: it’s designed to satisfy a checklist, not change behavior. Employees sit through it, click the completion box, and forget it by Friday.

Hack Attack: Defense works differently. Players don’t read about attacks — they experience them. When a Ransomware card hits the table and someone watches their Tech cards disappear, they’re not processing information. They’re reacting. That reaction, and the conversation that follows, is where real learning happens.

The Training Bundle gives your facilitator everything needed to run that session with confidence — whether they’re a seasoned security professional or a people manager who’s never led a security awareness activity before.

---

What’s Included

 

Hack Attack: Defense — the game

The physical card game. Supports 2–6 players per session. Run it as a standalone team activity or as part of a broader security awareness program.

Facilitator’s Guide — Version 1.0 PDF

Your complete facilitation reference, built for use before, during, and after the session:

• How to Use This Guide: Orientation page with three usage modes (before, during, after) — tells your facilitator exactly what to read and when
• Facilitator Quick Start: The full game rules in 30 seconds, table rules players will ask about, and three official difficulty variants — everything a first-time facilitator needs on one page
• Section 1 — Before You Facilitate: The philosophy, what the session accomplishes, what it doesn’t, and what you need
• Section 2 — Session Agenda: A timed 75-minute agenda you can run as-is or adapt
• Section 3 — Running the Game: The 60-second rules explanation, Attack card resolution with player-count thresholds (2, 3–4, and 5–6 player variants), User Error chain mechanic, common questions and how to answer them, and a troubleshooting table for five common facilitator situations
• Section 4 — Debrief by Category: Discussion guides for all six defense categories — Backups, Device Security, Home Network, Passwords (including passkeys), Social Engineering, Social Media — plus the full Reality Check capstone
• Section 5 — Attack Card Debrief: Facilitation notes for each of the eight attack cards, grounded in how the attacks actually work in the real world
• Section 6 — Translating to Your Organization: A fill-in framework for connecting the game scenarios to your specific systems, policies, and current threat landscape — with industry-specific framing for Healthcare, Financial Services, and Remote-first teams
• Section 7 — User Error Card Debrief: Facilitation notes for each of the eight user error cards — no shame, just recognition and habit change
• Section 8 — Action Items & Close: The One Thing framework — how to end the session with a specific, named 48-hour commitment from every participant
• Section 9 — Compliance Mapping: How this session maps to NIST CSF 2.0, ISO 27001:2022, SOC 2 Type II, PCI DSS v4.0, and HIPAA
• Appendix A — Completion Certificate: Print-ready, brandable certificate for participants
• Appendix B — Attendance Log: Documentation template for compliance records
• Appendix C — Defense Categories Quick Reference: One-page lookup for facilitators during the session

Facilitator Slide Deck — 36 slides

A branded, participant-facing presentation for the full session. Built to run on screen during the game and debrief — so your facilitator isn’t working from memory:

• Session overview and agenda
• How to play (quick reference for participants)
• The four card types — visual reference with real card images
• One slide per defense category, with the key insight and card examples
• Reality Check — full-page treatment with the session’s core thesis
• One slide per attack card, with how the attack works
• One slide per user error card
• The One Commitment close
• Resources to take home

---

Who It’s For

Security awareness managers who need a program that satisfies compliance requirements without putting the team to sleep.

L&D and HR teams who want an activity that creates real conversation — not just content delivery.

Managers and team leads running a security awareness moment for their own team, without security expertise on staff.

IT and security professionals who know the threats cold but want a better way to explain them to non-technical colleagues.

No prior security knowledge required to facilitate. The Facilitator Quick Start page gets any first-timer up to speed in under five minutes — the guide and deck carry the content, your facilitator brings the conversation.

---

Compliance Callout

(For a callout box or badge section on the product page)

Satisfies security awareness training requirements under:

• NIST CSF 2.0 — PR.AT-01 (Awareness and Training)
• ISO 27001:2022 — Control 6.3 (Information Security Awareness, Education and Training)
• SOC 2 Type II — CC1.4 (Demonstrates Commitment to Competence)
• PCI DSS v4.0 — 12.6 (Security Awareness Program)
• HIPAA — §164.308(a)(5) (Security Awareness and Training)

Attendance log and completion certificates included for documentation.