Conventional security training and awareness has failed us. It's often tedious and boring, consisting of video lectures, quizzes, and annual reviews that no one pays attention to. But what if we could make security awareness fun? By gamifying security education, we can create an environment where people actually want to learn about security and retain what they have learned.

Gamifying security is not a new concept. It has existed for quite some time, most notably in the form of Capture the Flag, which enables participants to attempt and subsequently learn about real-world security exploits in a controlled environment. Microsoft has even developed their own game, Elevation of Privilege, where players learn threat modeling techniques through a competitive card game.

In this session, we will explore these games and how gamification techniques can be a successful training tool to educate employees on security best practices.