Gamified Phishing Simulations: Why a Swipe Game Beats a Slide Deck

TL;DR

• Most phishing awareness training asks people to watch something. A gamified phishing simulation asks them to decide, and tells them straight away whether they were right.
• The format matters as much as the content. Short repeated practice with immediate feedback matches how recognition skills are actually built.
• A phishing test and a gamified simulation answer different questions. One measures your current risk, the other trains people to lower it. You need both.
• Swishing is Sectricity's swipe based phishing game: sessions of five to ten minutes, realistic messages, an explanation after every decision, and a dashboard for participation and trends.
• Under NIS2 Article 21(2)(g) awareness training is a legal obligation, so whether your format produces exportable evidence is not a side issue.

Almost every organisation runs some form of phishing awareness training. Usually that means an annual e-learning module or a slide deck at a company meeting. People sit through it, the completion box gets ticked, and they go back to an inbox that looks exactly the same as it did the day before. If you are building or reviewing a security awareness programme, the useful question is not whether your people have been trained. It is whether the format you picked can produce the behaviour you need.

This article is about the format itself: what a gamified phishing simulation is, which mechanics make it work, and where it sits next to a classic phishing simulation and test. If you want a plain definition of the product rather than a comparison of methods, read What is Swishing? first.

Why the classic format does not stick

The annual e-learning module has one structural problem: it is passive. Someone reads or watches an explanation of what phishing looks like, answers a handful of multiple choice questions, and moves on. The explanation is often correct. The problem is that recognising a suspicious message in a real inbox, under time pressure, between forty other messages, is a different skill from recognising it in a training slide where you already know the answer is phishing.

The second problem is timing. A single session in January has to survive until December. Anything learned once and never practised fades, and the further away the training is, the more it fades. By the time the message that matters arrives, the module is a vague memory of a red flag list.

The third problem is engagement, and it is the one most awareness programmes quietly accept. Completion rates look fine. That is because completion measures whether someone clicked through the module, not whether anything changed.

What a gamified phishing simulation actually is

A gamified phishing simulation turns the recognition task itself into the exercise. Instead of explaining what phishing looks like, it shows realistic messages one at a time and asks for a judgement. In Swishing that judgement is a swipe: left for phishing, right for legitimate. The decision takes a second or two, which is roughly the amount of attention a real message gets.

The important part is what happens next. After every single decision the player gets an explanation: this message was safe and here is why, or this one was an attack and here is the detail that gave it away. That feedback lands while the message is still on screen and the reasoning is still fresh, which is exactly when it is most useful.

It is worth being precise about the word gamified. The point is not the leaderboard. The point is that a game format makes it acceptable to practise the same skill many times in short bursts, which a slide deck cannot do without becoming unbearable. Scoreboards and difficulty levels are there to keep people coming back, not to teach anything by themselves.

The learning mechanics, without the hype

Three well established findings from learning research explain why this format tends to outperform a single long session. None of them are security specific.

Retrieval practice. Actively producing an answer strengthens memory more than re-reading the same material. Deciding phishing or legitimate is retrieval. Watching a slide that lists warning signs is not.

Spacing. The same total practice time spread across many short sessions is retained better than the same time in one block. Weekly sessions of five to ten minutes use this directly.

Immediate feedback. Corrections given right after a decision are more effective than corrections given later, because the learner still remembers the reasoning that produced the error.

What none of this does is remove phishing risk. A trained employee is a better filter, not a control. Technical measures such as MFA, mail filtering, payment verification procedures and least privilege remain the layers that decide how much damage a single mistake can cause. We have written about that separately in how to solve phishing structurally.

A simulation is training, a test is measurement

This distinction gets blurred constantly, and it leads to the wrong tool being used for the wrong job.

A phishing test sends controlled attack emails to your own staff without warning, and measures what happens: who clicks, who reports, how long reporting takes. That is a measurement instrument. It gives you a baseline and, run again later, evidence of change. It does not teach much on its own, because the person who clicks learns one thing on one day about one message.

A gamified simulation is the opposite. Everyone knows they are training, so nobody learns anything about your real click rate. What they do get is many repetitions with feedback, which is what actually shifts recognition.

Used together the sequence is straightforward: test to establish where you stand, train to close the gap, test again to show the change. Each answers the question the other cannot.

How Swishing works in practice

Swishing runs as short weekly sessions of five to ten minutes rather than as a yearly event. Employees work through realistic email examples, swipe left or right, and get an immediate explanation for each one. Difficulty is adjustable, the examples are available in multiple languages, and the whole thing is designed to fit in the gaps of a working day without scheduling.

On the administrative side there is a dashboard with participation, scores and trends, and leaderboards per department for organisations that want the competitive element. It can also run alongside an existing training programme rather than replacing it. The practical detail on set-up and rollout is on the Swishing service page.

Where it fits

Three situations come up most often.

As a standalone team activity. Useful when awareness has been neglected and you want something people will actually do, without committing to a full programme first.

As the recurring layer in an awareness programme. Most programmes have good one off moments, a training session or a keynote, and nothing in between. A weekly five minute exercise is what turns those moments into a habit. Our security awareness training covers the deeper sessions this sits alongside.

Combined with a phishing test or a wider social engineering assessment, when you need both the behaviour change and the evidence that it happened.

Compliance: awareness training is not optional

NIS2 Article 21(2)(g) names human resource security and cybersecurity awareness training explicitly as a required measure for essential and important entities. It is not a recommendation, and an auditor will ask how you meet it.

This is where the choice of format has a practical consequence that has nothing to do with learning theory. A session where participation and results are logged automatically produces exportable evidence: who took part, how often, and how scores moved over time. A slide deck at a company meeting produces an attendance list at best. If you are also dealing with a cyber insurer or a board that wants proof rather than intent, that difference matters.

Frequently Asked Questions

What is a gamified phishing simulation?

It is an awareness training format where employees judge realistic messages themselves, one at a time, and receive immediate feedback on each decision, rather than watching an explanation of what phishing looks like. In Swishing the judgement is a swipe: left for phishing, right for legitimate.

Does a swipe game really work better than classic phishing training?

For building recognition, the format has a clear advantage: it uses retrieval practice, spacing and immediate feedback, three mechanisms that learning research consistently finds more effective than a single passive session. It is not a replacement for technical controls, and it does not measure your actual risk level.

What is the difference between a gamified phishing simulation and a phishing test?

A phishing test sends unannounced controlled attack emails to measure real behaviour such as click and report rates. A gamified simulation is announced training designed to improve that behaviour. One measures, the other trains, and most organisations need both.

How long does a Swishing session take?

Five to ten minutes, run weekly rather than annually. The short format is deliberate: spreading practice across many short sessions is retained better than the same total time in one block.

Does gamified awareness training count towards NIS2 compliance?

NIS2 Article 21(2)(g) requires cybersecurity awareness training but does not prescribe a format. What matters for an audit is that you can demonstrate it happened. Sessions are logged automatically, so participation rates and score trends can be exported as documentation.

Can it replace our existing e-learning platform?

It can, and it can also run next to one. Organisations that keep their e-learning usually do so for topics beyond phishing, and use the game as the recurring practice layer for message recognition specifically.

Related services and resources

If you want the product detail rather than the method, the Swishing service page covers how the game is set up and rolled out, and What is Swishing? gives the short definition. For the wider picture, our security awareness service explains how recurring practice fits with training sessions and role specific tracks, and Security Awareness Training: Why It Matters and How to Build a Programme That Works walks through building the programme itself. When you need measurement rather than training, look at phishing simulation and testing.