The Campaign Is Alive (And My Champions Are Talking Trash)
2026-04-14
Back in February, I wrote about launching something I called the Security Guild: a 12-week gamified security awareness program for my school district, built on D&D mechanics. Weekly quests. XP. Ranks. Trials. The whole bit.
I was nervous nobody would care.
Week 6. Midpoint. They’re CALLING each other to talk smash.
Previously On: The Security Guild
Quick catch-up for anyone who didn’t read Session Zero (go read it, I’ll wait):
I run IT for a small alternative school district. Solo act. No security team. After years of mandatory compliance training that nobody retained, I decided to try something different.
Instead of another 25-minute video with a quiz at the end, I built a campaign. Staff opted in as Security Champions. They earn XP for completing security quests: real tasks, not trivia. Report a suspicious email. Change a weak password. Catch a phishing attempt. Help a colleague. Each week the quests drop. Each week the stakes get a little higher.
The goal wasn’t compliance. It was culture.
What Actually Happened
Here’s what I did not put in the design doc: the possibility that my champions would start calling each other to talk trash.
Not mean trash. Competitive trash. The “oh I see you’re completing some quests, coming for me, huh?” kind. Light. Playful. Completely unsolicited.
They are watching each other’s progress. They are keeping score. They are invested in a way that no mandatory training has ever made anyone invested in anything, ever.
And legit I wasn’t originally going to make this a visible competition. The leaderboard wasn’t in the plan.
They asked for it. Nay, DEMANDED it.
I built this weird DnD-adjacent program and I thought I’d need to gently coax participation. Instead, they looked at the XP system, looked at each other, and said “wait, can we see where everyone stands?”
Reader, we can see where everyone stands.
That’s when I realized this stopped being my program. It became theirs. And that’s exactly what culture change actually looks like…not a policy update, not a reminder email, not a checkbox. People actually caring enough to compete.
Not Every Champion Runs the Same Build
Here’s the other thing that’s happened that I didn’t fully anticipate: some of my champions have come to me a little stressed. Worried they’re falling behind. Overwhelmed trying to complete everything before the next week’s quests drop.
Which, yeah, okay. That’s a me problem to fix, not a them problem.
Like I keep reminding them: you don’t have to complete EVERY side quest, babes. As long as you’re still on the main.
The whole point of optional quests is that they’re optional. Some champions are naturally drawn to the social quests, the ones that involve teaching a colleague something or having a real conversation about security. Some are more comfortable with the solo technical stuff. Both are valid. Both are building the same habit.
When someone tells me they’re overwhelmed, I don’t push them harder. I ask them what looks interesting and tell them to do that instead. Nine times out of ten they go knock it out immediately because it’s something they actually wanted to do anyway.
That’s not a workaround. That’s andragogy.
Adults learn better when they have autonomy over their learning path. Turns out the DnD framework isn’t just a cute hook, there’s actual learning science underneath it. But that’s a whole other post.
The Midpoint Turn
Week 6 is where it gets harder. That’s by design.
The early quests were accessible on purpose. Low barrier to entry. Build the habit, earn the XP, feel the win. But we’re past that now. The quests are leveling up. The easy XP is gone. What’s left requires more attention, more effort, more actual security thinking.
This is the part of the campaign where you find out who’s in it for the long game.
I have my suspicions. I’m watching. (That’s also by design.)
What This Is Actually Proving
I want to be careful here because I don’t have the final data yetttttt, we’re only at the midpoint, not the debrief.
But here’s what I can say with confidence: voluntary beats mandatory, baby. Every time.
I have a smaller group of champions than I would have if I’d made this required. But the engagement isn’t even in the same universe. These people are choosing to show up. They’re competing for XP because they want to. They’re calling each other because they’re genuinely invested.
That’s not something you can compliance-train into existence. That’s culture. And it’s growing on its own.
The full post-campaign debrief is coming. Results, data, lessons, what I’d change. And of course I’m working on packaging this whole thing up so other solo IT folks can run it too. Not quite ready. But coming, I promise.
Liz Gore is a Director of IT, SANS Cyber Academy graduate (GFACT, GSEC, GCIH), and the person currently watching her coworkers talk trash over security awareness XP. Find her at lizgore.com or absolutely losing it on the internet.