What is Swishing?
Swishing is a gamified phishing awareness game. This article explains how it works, how it differs from a normal phishing simulation, and why a game format changes employee behaviour for the long term.
What is Swishing? Gamified phishing awareness that actually changes behaviour
Most phishing training runs the same loop. A fake email goes out, a dashboard shows who clicked, and a few weeks later nobody remembers it happened. Swishing works differently. It turns phishing awareness into a game, so people practise catching attacks in realistic situations and actually keep what they learn.
Here is what Swishing is, where it parts ways with a standard phishing simulation, and why the game format sticks with people long after an annual test would have faded.
TL;DR
- Swishing is a gamified phishing awareness game from Sectricity that teaches employees to recognise phishing through realistic, interactive scenarios.
- Unlike a one-off phishing simulation, it drives lasting behaviour change through practice and instant feedback.
- It supports Microsoft single sign-on, so employees join with their existing work account.
- It fits into a layered awareness programme alongside phishing simulations, training and the Escape Truck.
- Human validation stays central: the game builds recognition, realistic testing and coaching turn it into behaviour.
The problem with traditional phishing training
Awareness fatigue is real. When training feels like a box to tick, people race through it and keep almost nothing. A single annual phishing test measures one moment, not a skill. It tells you who clicked last Tuesday. It does not build the instinct to slow down and check the next time a convincing message lands.
The problem is not knowledge. Most employees already know phishing exists. What they lack is recognition under pressure, mid-task on a busy afternoon, when a message looks like any other. That instinct only comes from practising the real thing, again and again.
How Swishing works
Swishing drops people into a run of realistic phishing scenarios and asks them to make the same calls a real inbox forces on them. Is this sender who they claim to be? Does that link go where it says? Should this rushed payment request be trusted? Each choice gets instant feedback, so people learn exactly what made a message safe or suspect.
Because it is a game and not an exam, the tone stays friendly instead of punitive. Nobody is being caught out. They are practising. That shift lifts participation and retention well above a standard simulation, and it lands across the whole workforce, from someone on their first week to the board.
The platform supports Microsoft single sign-on, so people join with the account they already have. Swishing is one of several security awareness services Sectricity offers, and it is designed to slot into a broader programme rather than stand alone.
Why gamification changes behaviour
Learning science is clear on this. People retain more when they practise actively, get things wrong somewhere safe, and see the feedback straight away. A game gives you all of that. Scenario after scenario, employees start to notice the tells: the small inconsistency, the urgency that does not fit, the sender that is close but not quite right.
That is the recognition that saves you on a real Monday morning, when a genuine attack shows up looking exactly like routine work. A slide deck will never build that instinct. Repeated, engaging practice does.
Where Swishing fits in a wider programme
Swishing is not a silver bullet, and Sectricity does not position it as one. It works best as part of a layered approach that also includes realistic phishing simulations and hands-on training. The game builds the recognition skill; targeted testing measures whether it holds up under real conditions.
Human validation sits at the centre of it. Games and simulations generate the practice and the data, but people are what turn that into steady judgement. The follow-up coaching on what went wrong is where awareness becomes a habit instead of a number on a dashboard.
Frequently Asked Questions
What is Swishing?
Swishing is a gamified phishing awareness game from Sectricity. Instead of the usual one-off phishing simulation, employees play through realistic phishing scenarios in a game format, learn to spot the signals, and get immediate feedback on their choices. The goal is lasting behaviour change, not a one-time click score.
How is Swishing different from a normal phishing simulation?
A standard phishing simulation sends a fake email, records who clicks, and hands you a report. Swishing turns that into an interactive game where people actively practise spotting phishing across a range of scenarios. Because it invites people in rather than catching them out, participation and retention run higher, and staff walk away with skills that stick.
Who is Swishing for?
Swishing suits any organisation that wants stronger phishing resilience across the whole workforce, from reception to the board. It works for companies with an awareness programme already running who want something people will actually engage with, and for teams starting from zero. It also sits comfortably alongside frameworks like NIS2 that expect you to show real awareness activity.
Does Swishing support single sign-on?
Yes. Swishing supports Microsoft single sign-on, so employees can join with their existing work account without creating separate credentials. This lowers the barrier to participation and keeps access management simple for IT.
How does gamified awareness lead to behaviour change?
People learn faster when they practise somewhere low-stakes and get feedback on the spot. A game lets employees make mistakes without real fallout, see straight away why a message was suspect, and build up recognition across repeated scenarios. That kind of practice sticks far better than a slide deck or one annual test.
How does Swishing fit into a wider security awareness programme?
Swishing is one piece of a layered approach. It works well next to phishing simulations, in-person training and the Security Awareness Escape Truck. Human validation stays central throughout: the game builds the recognition, and realistic testing plus follow-up coaching turn that into consistent behaviour on the job.
Related services and resources
If you want to raise phishing resilience across your team, start with Swishing, the gamified phishing awareness game. It pairs naturally with our
phishing simulation and testing for realistic measurement, and with the
Security Awareness Escape Truck for an unforgettable in-person experience. For the strategy behind it all, read our