Catalog

The fully customizable cyber competition: custom game flow, boss fights and a public leaderboard. Lue lisää→ Cabinet

The security awareness arcade cabinet. Configured online, delivered turnkey. Lue lisää→ Game

The CISO stress-buster: one control, ~2 minutes, and screaming into the mic multiplies your score. Lue lisää→ Competition

The fully configurable reflex competition: timed mini-games, cyber, AI or mixed universes, arcade mode. Lue lisää→ Experience

The deepfake photobooth: allow your webcam, watch an AI transform you live, and never look at an image the same way again. Lue lisää→ Encyclopedia

The AI-generated visual cyber encyclopedia: explore every topic, endlessly. Lue lisää→ Bot

The bot that trains your workforce in the messaging apps: micro-lessons that show up on their own, signed Jack. Lue lisää→ Training

The cyber training path as a progress map: short chapters and a built-in arcade quiz, with no account to create. Lue lisää→ Simulation

The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password. Lue lisää→

Toolkit

Coming soon The CISO’s toolbox, coming soon.

Game

The narrative game that teaches cybersecurity through play: ten chapters, a level map, with nothing to install. Lue lisää→

Use cases

Tell us what you are trying to do, we point you to the right product.

Competition

The fully customizable cyber competition: custom game flow, boss fights and a public leaderboard. Lue lisää→ Competition

The fully configurable reflex competition: timed mini-games, cyber, AI or mixed universes, arcade mode. Lue lisää→ Cabinet

The security awareness arcade cabinet. Configured online, delivered turnkey. Lue lisää→

Cabinet

The security awareness arcade cabinet. Configured online, delivered turnkey. Lue lisää→ Game

The CISO stress-buster: one control, ~2 minutes, and screaming into the mic multiplies your score. Lue lisää→ Experience

The deepfake photobooth: allow your webcam, watch an AI transform you live, and never look at an image the same way again. Lue lisää→

Training

The cyber training path as a progress map: short chapters and a built-in arcade quiz, with no account to create. Lue lisää→ Bot

The bot that trains your workforce in the messaging apps: micro-lessons that show up on their own, signed Jack. Lue lisää→ Game

The narrative game that teaches cybersecurity through play: ten chapters, a level map, with nothing to install. Lue lisää→

Bot

The bot that trains your workforce in the messaging apps: micro-lessons that show up on their own, signed Jack. Lue lisää→

Competition

The fully configurable reflex competition: timed mini-games, cyber, AI or mixed universes, arcade mode. Lue lisää→ Experience

The deepfake photobooth: allow your webcam, watch an AI transform you live, and never look at an image the same way again. Lue lisää→ Bot

The bot that trains your workforce in the messaging apps: micro-lessons that show up on their own, signed Jack. Lue lisää→ Encyclopedia

The AI-generated visual cyber encyclopedia: explore every topic, endlessly. Lue lisää→

Simulation

The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password. Lue lisää→ Training

The cyber training path as a progress map: short chapters and a built-in arcade quiz, with no account to create. Lue lisää→

Toolkit

Coming soon The CISO’s toolbox, coming soon.

These products open very soon. Tell us about your needs: we let you know the moment they open, or give you an early preview.

Features

What each Brain product does, product by product.

Cyber Cup

The fully customizable cyber competition: custom game flow, boss fights and a public leaderboard.

Fully customizable competitions

Custom game flow, lives, duration, boss fights, scoring mode: configure every detail.

Content Studio

Review and localize your own question bank with your team, on credits.

14 formats + boss fights

Passwords, phishing, WiFi, social media, deepfakes… 4 boss fights and 2 bonus modes, over 7,000 questions.

Skills map

Track your teams’ progress theme by theme, with export, and connect your directory over SAML SSO.

Arcade mode

Turn the cup into an event kiosk: no identity to enter, anonymous leaderboard.

Brain Arcade

The security awareness arcade cabinet. Configured online, delivered turnkey.

Built-in cyber game

Timed quiz with score and anonymous leaderboard. Idle mode with an attract video.

3D configurator

Text and logo customizable on every face, in real-time 3D, config shareable with a link.

Live hacking demos

Rogue WiFi access point and QR phishing: two teachable modules to run right on the cabinet.

Admin console

Network, system status and video content, all manageable, shipped with the cabinet.

Super CISO Destroyer

The CISO stress-buster: one control, ~2 minutes, and screaming into the mic multiplies your score.

One control

Click or any key. Everyone knows how to play in a second.

Scream = multiplier

Mic detection turns volume into a score multiplier, from ×1 to ×3.

10 satirical scenes

Slap the board, chase the vendor, smash the on-call phone… 3 more intense scenes on demand.

~2-minute runs

6 random scenes per run, perfect at a booth or between two meetings. Playable on mobile.

Super Challenge

The fully configurable reflex competition: timed mini-games, cyber, AI or mixed universes, arcade mode.

Configurable reflex mini-games

50 per run by default, drawn from a bank of over 2,000 items: decisions in seconds.

Three universes

Cyber, AI or mixed: the same mechanics serving both topics, for around twenty themes.

Adjustable lives, time and bosses

1, 3 or 5 lives; speed, countdown or free mode; optional boss fights.

Skills map

Track your teams’ progress theme by theme, with export, across all 9 languages.

Arcade mode

The competition as an event kiosk: instant start, anonymous leaderboard, no identity.

Deepfake Studio

The deepfake photobooth: allow your webcam, watch an AI transform you live, and never look at an image the same way again.

Live

The transformation happens in real time on the webcam feed, not on a delayed photo.

Ready-made characters or your face

Faces and styles to try, or upload your own face for the demonstration.

Nothing is kept

No image is stored: real-time processing, an “AI-generated” watermark on captures.

Zero friction

No account, no install: a browser and a webcam are enough.

Cyberpedia

The AI-generated visual cyber encyclopedia: explore every topic, endlessly.

A copilot before you generate

The AI shapes the topic’s angle with you before producing the plate: fewer wasted generations.

Endless exploration

Every click on an image element generates the child page, visually anchored to the previous one. No depth limit.

10 visual styles

Isometric, infographic, poster, bauhaus, watercolor, storybook… per book or per page.

Share with a link

Every book can be published and shared through a public link, no account needed on the reader side.

Chat with Jack

The bot that trains your workforce in the messaging apps: micro-lessons that show up on their own, signed Jack.

Native to the messaging app

Slack, where your teams already work. Microsoft Teams and Google Chat coming later.

30 scripted lessons

5 minutes each, bilingual FR/EN, personalized (first name, company, executives).

Narrative campaign

“The Rise of the Hacker”: 12 episodes in 4 acts, plus 2 branching gamebooks.

Reporting reflex

Forwarding a suspicious message to Jack = a real behavioral signal, without simulation.

Cyber Journey

The cyber training path as a progress map: short chapters and a built-in arcade quiz, with no account to create.

Progress map

A visual progression by chapters, at your own pace, that makes you want to finish.

Built-in arcade quiz

An arcade quiz built into the path, drawn from over 3,000 questions.

No account creation

The learner gets in through a link and a code: nothing to install, nothing to create.

Organizer management

Path assignment, leaderboard and progress tracking.

Super Phisher

The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password.

A ready-to-use catalog

Over 1,300 scenarios sorted into around twenty pretext families, filtered by your company profile.

Today’s attacks

The fake email, but also the booby-trapped QR code, the fraudulent attachment and the fake verification page.

A controlled setting

Signed mandate, verified domain, test send to yourself, and never any password captured.

The debrief that matters

Who clicked, who reported, reporting rate: the measure that moves your teams forward.

Cybersecurity is not a game

The narrative game that teaches cybersecurity through play: ten chapters, a level map, with nothing to install.

A level map

You progress chapter by chapter, at your own pace, like in a game.

Ten chapters

From the brain facing risk to malware: phishing, passwords, social engineering…

In the browser

Nothing to install: you play directly, in French or English.

Organizer tracking

An admin console tracks progress and exports results.

Frequently asked questions

The questions we hear most, product by product.

Cyber Cup

The fully customizable cyber competition: custom game flow, boss fights and a public leaderboard.

Through a simple link (or QR code). They pick a nickname and play, no account creation, and in arcade mode, even the nickname becomes optional.

The game flow (which formats, how many questions, where the bosses go), the number of lives, the run duration, the scoring mode, and even your own question bank through Content Studio.

Yes: the skills map shows where each team is progressing, theme by theme, with export. SAML SSO connects your company directory.

Brain Arcade

The security awareness arcade cabinet. Configured online, delivered turnkey.

No. The cabinet runs on its own: attract mode, free-play game, and a leaderboard that keeps the competition going.

In the online 3D configurator: pick a preset or compose your faces (text, logo, images), share your configuration with a link (with a designer if needed), then order.

The 4G router + SIM option (1 year included) makes the cabinet fully independent from the site’s network.

Volume discounts apply: 10% off from 3 to 9 cabinets, 20% off from 10 cabinets. Get in touch and we’ll put together a tailored quote.

Super CISO Destroyer

The CISO stress-buster: one control, ~2 minutes, and screaming into the mic multiplies your score.

It’s first a stress-buster, and a conversation magnet about the daily life of security teams. At events, it’s the booth everyone stops at.

No. Without a mic, the game runs at ×1. With it, screaming amplifies the score, up to ×3.

About 2 minutes: 6 scenes drawn at random from a pool of 10.

Super Challenge

The fully configurable reflex competition: timed mini-games, cyber, AI or mixed universes, arcade mode.

Cyber Cup is a knowledge arcade quiz; Super Challenge tests reflexes against the clock, with lives. Both share the same engine and launch from a link.

Spotting generated content, catching a deepfake, judging a prompt, checking a source: the everyday AI reflexes. The mixed universe combines cyber and AI.

Yes: depending on the setting (1, 3 or 5 lives), every mistake costs one. That’s what keeps the competition tense.

Deepfake Studio

The deepfake photobooth: allow your webcam, watch an AI transform you live, and never look at an image the same way again.

No. The feed is processed in real time and nothing is recorded or kept. Captures carry an “AI-generated” watermark.

No: open the link, allow your webcam, see yourself transformed. The session is deliberately short.

To make people live the deepfake instead of explaining it: once you have watched your own face lie on screen, you never look at a video call the same way.

Cyberpedia

The AI-generated visual cyber encyclopedia: explore every topic, endlessly.

The AI first thinks the topic through with you, then generates the main illustration and the text, grounded on Wikipedia to stay factual.

Yes: an editor creates a book on their topic, structures it by exploring, picks a visual style, then shares it with a link.

Each generation uses credits shared by your team: one common pool per workspace, no per-user subscription.

Chat with Jack

The bot that trains your workforce in the messaging apps: micro-lessons that show up on their own, signed Jack.

Because the reflex that matters is reporting, not punitive distrust. Jack measures a real signal: the suspicious messages people forward to him.

5 minutes per lesson, about one a month by default. The cadence is set per campaign.

No: every lesson is scripted and reviewed. Jack’s voice is written, not improvised.

Cyber Journey

The cyber training path as a progress map: short chapters and a built-in arcade quiz, with no account to create.

No: the learner gets in through a link and a code, with a simple email and an alias. Nothing to install, nothing to create.

You move along a progress map, chapter by chapter: short lesson screens, a built-in arcade quiz and reflex cards to keep within reach.

Through path assignment, a leaderboard and progress tracking on the console side.

Super Phisher

The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password.

No: Super Phisher is an awareness tool. No password is captured, every campaign requires a signed mandate and a verified domain, and you can send the lure to yourself before any launch.

The fake email, but also the booby-trapped QR code, the fraudulent attachment and the fake verification page. Each recipient gets a scenario matched to their language.

The debrief shows who clicked and above all who reported the attack, with your teams’ reporting rate, campaign by campaign.

Cybersecurity is not a game

The narrative game that teaches cybersecurity through play: ten chapters, a level map, with nothing to install.

No: the game plays directly in the browser, with nothing to install and no account to create. An email is enough to get started.

Ten chapters, from how the brain handles risk to malware, by way of passwords, the man-in-the-middle, social engineering and phishing.

Yes, in French and English, chosen right when you enter the game.

Compare

Annual e-learning, phishing simulation, one-off workshops, games: four ways to raise awareness in your teams, what each one brings and what Brain adds.

Criterion	Annual e-learning	Phishing simulation	One-off workshop	Brain
Format	An online module to complete, often once a year, hosted on the LMS.	Simulated phishing emails sent to inboxes, with a training page for those who click.	A workshop, a talk or an escape game, in person or remote.	A collection of small tools: competitions, mini-games, messaging bot, learning path, encyclopedia, arcade kiosks.
What the employee experiences	They go through the module to the end and pass a quiz.	They receive a simulated phishing email and practice spotting and reporting it; if they click, they see a short reminder right away.	They take part in a group session led by a speaker.	They play for one minute or five, compare themselves with colleagues on a leaderboard and come back.
Getting started	LMS integration, enrollments, completion reminders.	Mail system setup, distribution lists, scenarios.	A quote, a date, a room or a video call, a speaker.	A free self-service account, a link or a QR code to share. Zero install.
Rhythm	One campaign a year, sometimes quarterly.	Waves of emails through the year.	One or two highlights a year.	Highlights (cybersecurity awareness month, AI Spring, trade show) and a year-round thread, in small doses.
What you measure	Completion rate and quiz scores.	Click rate and reporting rate.	Attendance and on-the-spot satisfaction.	Participation, progress and completion, with exports provided by default.
Topics	The chosen catalog program, mostly cyber.	Phishing and its variants.	The topic of the session.	Cyber and AI, enabled separately.
Employee data	A named account per learner.	Email addresses and each campaign’s results (clicks, reports), by name or aggregated depending on settings.	An attendance sheet.	In competitions and on kiosks, no player account: a nickname and a score.
Pricing model	Most often a license per user per year.	Most often a license per user per year as well.	A quote per session.	Public prices: free to test, credit packs paid per participation, unlimited annual plan on quote.
On site	Rarely: the module is taken online, on a computer or phone.	Not usually: it happens in the inbox, sometimes via text message or QR code.	Yes, that is its home ground.	Yes: a real arcade kiosk in the lobby, on top of online play.

A complement, not a replacement

Brain replaces neither the mandatory module nor your phishing simulations: it adds what they are not designed to do (highlights, competition, on-site presence) and gives you the record of a living program.

Tutustu valikoimaan See pricing

The Brain Platform

Each Brain tool can be used on its own. The Brain Platform brings them together in a single cybersecurity and AI awareness program: the program owner sets a goal, each employee takes part in the format that suits them, and a training record keeps track of participation. It is not self-service: there is no account to create online; we set it up with you after a conversation with our team.

Ota yhteyttä tiimiimme

Frequently asked questions

No. The mandatory module remains useful for compliance. Brain comes on top: highlights, competition and on-site presence to create engagement, with participation, progress and completion exports to keep the record.

Yes. Products open for signup can be tried in self-service, with a free account and no credit card, and prices are public. Some products are already deployed with customers and are available by appointment: we set them up with you after a conversation with our team. A call is also needed for the Brain Platform, a kiosk, an unlimited subscription or a specific need.

Pricing

Public prices, excluding VAT, with no quote needed for most of it: you choose a volume, you pay, you launch. Products open for signup are tried free first, with no credit card.

Getting started: free

A free account, no credit card, with the admin console, which uses no credits. Cyber Cup and Super Challenge include five free test accesses, the Brain Arcade configurator can be tried with the same account, and Super CISO Destroyer and Deepfake Studio are free to play, with no account. For the other products, each catalog page says how to get access.

Cyber Cup and Super Challenge: credit packs

One credit is one run for one participant. It is used at the participant’s first actual login: if they log in again or finish later, it is still one credit. A new run or a new edition uses a new credit.

Pack	Price excl. VAT	Discount
250 credits	450 €	baseline
500 credits	750 €	−17 %
1 000 credits	1 200 €	−33 %
2 000 credits	1 900 €	−47 %
5 000 credits	3 000 €	−67 %
10 000 credits	4 200 €	−77 %

Valid 12 months from purchase, usable on Cyber Cup and Super Challenge alike, with the balance shown in real time in the console.
No subscription, no renewal: when the credits run out, you decide whether to buy more.
Above 10,000 credits, pricing is on quote.

Unlimited annual subscription: on quote

Unlimited runs on Cyber Cup and Super Challenge, for the whole organization, all year round. The price is set in a meeting based on the number of users, the scope and the commitment length. 12-month firm term, tacit renewal, 2-month notice.

Brain Arcade: an annual license per cabinet

You design the cabinet in 3D, we build it, deliver it and install it. It remains Brain’s property: you pay for its use, not its purchase.

Model	Year 1 (excl. VAT)	Following years (excl. VAT, per year)
Full cabinet (about 181 cm)	7 000 €	3 500 €
Bartop (compact cabinet)	5 000 €	2 500 €

Year 1 covers design, custom graphics, manufacturing, delivery and installation in mainland France, the license and maintenance. The following years cover the license, content updates, hosting, support and maintenance.
Unlimited players and runs, with no credits used.
12-month minimum commitment per cabinet, tacit renewal for 12-month periods, cancellable up to 2 months before the term.
Volume discounts: 10% off from 3 to 9 cabinets, 20% from 10. On quote: custom artwork outside the templates, delivery outside mainland France, on-site facilitation.

Events: on quote

Trade show, seminar, cybersecurity awareness month: cabinets for a few days. The price depends on the number of cabinets, the duration, the venue and the logistics. The service is paid in advance, which secures your dates.

Tutustu valikoimaan Ota yhteyttä tiimiimme

Frequently asked questions

Yes, 12 months after purchase, with a reminder 30 days before. Unused credits are lost, which is the counterpart of volume discounts. If Brain fails its obligations or removes a main feature, they are refunded pro rata.

Yes: within 14 days of an online order, as long as no credit was used, no game was opened to participants and no cabinet manufacturing was started.

Credits are paid at order time. Subscriptions are invoiced in advance and payable within 30 days. An event service is paid before the event.

Yes, for an annual subscription, more than 10,000 credits, an event or a multi-entity rollout. The Brain Platform, which brings the tools together in a single awareness program, has no public price: it is not self-service, we set it up with you after a conversation with our team.

Not without Brain’s written agreement: credits belong to the entity that bought them.

Brain collects the cabinet within 30 days, unless you say before the term that you want to continue: nothing changes then, except the price, which moves to the following-years rate.

Full terms, in French: annex 4 of the terms of service

Learning & gamification

Level up your teams on cyber & AI, without putting them to sleep.

Brain is not an annual training people sit through: it is a collection of small tools (mini-games, competitions, a bot, training paths, an encyclopedia) and highlight moments that punctuate the year. Put end to end, they form a platform for a lasting security culture.

How we work

Reflexes all year long, in small doses.

One tool does not change a culture. A collection of tools, played all year and managed in one place, does. And it shows on both sides: the people who play, and the people who run the program.

For employees

Experiences that stick

One minute or five, at a booth or in the messaging apps. People play, compare scores, play again, and the reflexes sink in.

Timed reflex mini-games, cyber or AI topics
Link-based competitions with public leaderboards
On-site arcade cabinets for your highlight events
Micro-lessons in Slack (Teams and Google Chat coming later)

Zero installEverything runs in the browser, from a simple link

No accountOn the player side, a nickname is all it takes

For the security team

Everything managed in one place

You manage all the content from the console, and you pull the numbers without having to ask anyone.

Design, content, customization, localization: everything is editable
Measurement tools included by default, on every platform
Participation, progression and completion exports
Cyber and AI topics can be enabled separately

DORA · NIS2Supports your regulatory obligations

AI Act · Art. 4AI literacy measures mandatory since 2025

Everything that is open can be tried, right now.

01
You open an account
Every product open for signup is self-service: you create your account on the one that interests you, without going through us. For the others, the product page says how to get access.
02
You test, you launch
You try it on one team, then roll it out. Measurement tools come by default in every platform.
03
You want more, we talk
Unlimited, MSP, the Brain Platform, which brings the tools together in a single program, or a need entirely your own: that is the moment to tell us about your needs.

A company with specific needs? Open up every element, customize content and design to your brand, roll out across multiple entities. Tell us about your needs, we build it with you.

Competition

The fully customizable cyber competition: custom game flow, boss fights and a public leaderboard. Lue lisää→ Cabinet

The security awareness arcade cabinet. Configured online, delivered turnkey. Lue lisää→ Game

The CISO stress-buster: one control, ~2 minutes, and screaming into the mic multiplies your score. Lue lisää→ Competition

The fully configurable reflex competition: timed mini-games, cyber, AI or mixed universes, arcade mode. Lue lisää→ Experience

The deepfake photobooth: allow your webcam, watch an AI transform you live, and never look at an image the same way again. Lue lisää→ Encyclopedia

The AI-generated visual cyber encyclopedia: explore every topic, endlessly. Lue lisää→ Bot

The bot that trains your workforce in the messaging apps: micro-lessons that show up on their own, signed Jack. Lue lisää→ Training

The cyber training path as a progress map: short chapters and a built-in arcade quiz, with no account to create. Lue lisää→ Simulation

The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password. Lue lisää→

Toolkit

Coming soon The CISO’s toolbox, coming soon.

Game

The narrative game that teaches cybersecurity through play: ten chapters, a level map, with nothing to install. Lue lisää→

Let’s find whatwill stick with your teams

Start with the catalog: open products can be tried right away. And as soon as you want to go further, we take it from there with you.

Book a call

Tell us about your needs: we set up a time, or we get back to you.

The most direct

Tell us about your needs

A special request? An awareness program to build, a specific population, context we should factor in? Book a time: we talk it through live, and look together at what fits your need.

Your context: populations, industries, languages, deadlines
The formats that fit: arcade, competitions, training paths
Measurement: participation, progression, reporting
Integrations: Slack, SAML SSO, CSV and Excel exports

30 minutes, no commitment, with a member of the team.

In writing

Rather we get back to you?

Leave us your details and a couple of lines about your need. We get back to you quickly.

By sending this form, you agree that your data will be used to get back to you. Privacy policy · Cookies

Cyber Month 2026 The cybersecurity awareness month

Let’s organize your cyber awareness month

For cybersecurity awareness month, every company runs its own campaign. Run yours arcade-style: your teams play, the leaderboard updates live, everything gets measured. Start for free, no commitment.

Create my Cyber Cup Create my Super Challenge

Free account, no credit card to get started.

Why go arcade

Three reasons to make it count

An event ready to launch, played anywhere, with results you can report.

01

A turnkey event

Zero onboarding: you create the competition, the questions are already there, you share one link. Your teams are playing within the minute.

02

Online or on-site, with cabinets

Everyone plays from their phone, wherever they are. Or you install a real arcade cabinet in the lobby for the whole month. The two combine.

03

Results to report

At the end of the month, you show figures, not an impression: participation, leaderboard, progress by topic and exports to present to your leadership team. A record that supports your DORA and NIS2 obligations.

Optional

The Brain Arcade cabinet, on your premises

The same game in cabinet mode: a nickname-only kiosk, with no personal data, in a real arcade cabinet installed at your site for the whole month.

181 cm full cabinet or bartop
12 designs, customizable to your colors
Nickname-only kiosk: no personal data on players

See the Brain Arcade cabinet

Frequently asked questions

Your Cyber Month, done better: your questions

Give them a reason to play rather than one more module: a competition between teams, with a leaderboard that updates live. Everyone plays from their phone, with no account to create on the player side.

Change the format: short, timed arcade-quiz runs, reflex challenges, an arcade cabinet in the lobby. A live leaderboard creates the friendly rivalry that traditional training lacks.

Keep your content and your e-learning, and add a highlight people can play: a tournament during the month, with a final leaderboard. The game comes on top of your mandatory module; it does not replace it.

With figures, not an impression: participation, leaderboard, progress by topic, and exports to present to your leadership team. A record that supports your DORA and NIS2 obligations.

You create the competition, the questions are already there, you share one link: your teams are playing within the minute. For a full program, a 20-minute call is enough to line up the games, the calendar and the communication kit.

No. Everything is played online, from a phone or a computer. The arcade cabinet is an option to make a splash on-site.

Need a hand

We’ll organize your month with you

Would you rather we put together a turnkey program for you? Leave a work email, we’ll get back to you with a plan.

The fastest way

A 20-minute call

We look at your context together and set the month’s highlights.

Which games fit your teams
A calendar for the month
An internal communication kit

Or in writing

Get a proposal

A single email from us, no newsletter. Privacy policy

AI Spring 2027 The AI awareness season

For AI, L&D and HR leaders

Let’s organize your AI Spring

Every spring, companies take stock of AI: what can be trusted to it, what must be checked, what is no longer taken at face value. Turn it into an arcade season: your teams play, the leaderboard updates live, everything is measured. You start for free, no commitment.

Create my Super Challenge See Chat with Jack

Free account, no credit card to start.

Why arcade mode

Three ways to mark the spring

A season ready to launch, played anywhere, that leaves a record.

01

A turnkey AI competition

Create your Super Challenge in the AI universe: deepfakes, prompts, confidential data, sources. The mini-games are already there, you share a single link, your teams play within the minute.

02

AI reflexes all season long

Chat with Jack sends micro-lessons in Slack (Teams and Google Chat coming later). Cyberpedia offers an AI-generated visual encyclopedia to explore at your own pace. The spring lasts, so does the awareness.

03

The AI Act, Article 4

Since 2025, the AI Act has asked companies to take measures that develop the AI literacy of their staff. A season of play contributes to that and leaves a record: participation, progress by topic, exports.

Optional

The Brain Arcade kiosk, in your premises

Super Challenge in kiosk mode: a nickname kiosk, no personal data, in a real arcade kiosk installed at your site for the whole season.

Large 181 cm kiosk or bartop
12 designs, customizable to your colors
Nickname kiosk: no personal data on players

See the Brain Arcade kiosk

Frequently asked questions

AI Spring, in practice

A season of artificial intelligence awareness in the company, modelled on cybersecurity awareness month: a highlight where every employee learns the right reflexes for deepfakes, prompts, confidential data and generated content. Each company picks its own dates in spring.

Three building blocks are enough: a Super Challenge competition in the AI universe launched with a single link, Chat with Jack micro-lessons in your messaging app for the whole season and, for a physical highlight, a Brain Arcade kiosk in the lobby. A free account lets you test everything before deciding.

A competition is created in a few minutes, with no onboarding or purchase order. Allow a 20-minute call with us if you want a turnkey program for the whole season.

Launch a Super Challenge in the AI universe and share it with a single link: your teams practice understanding AI, verifying answers, prompting well and spotting a deepfake. The skills map tracks their progress theme by theme, and the console exports the results as CSV or XLSX. These are all measures you can document under Article 4 of the AI Act, which asks companies to develop the AI literacy of their staff. You can try it first with a free account.

Need a hand

We organize your spring with you

Would you rather we suggest a turnkey program? Leave a business email and we come back with a plan.

The fastest

A 20-minute call

We look at your context together and set the season’s highlights.

Choice of games for your teams
Spring calendar
Internal communication kit

Or in writing

Get a proposal

A single email from us, no newsletter. Privacy policy

Kyberkulttuuri & Pelillistäminen

Artikkeleita, analyyseja ja käytännön oppeja tietoturvatietoisuuden ja tekoälyosaamisen kehittämisestä pelillistämisen avulla.

← Takaisin artikkeleihin

Tietojenkalastelu & Manipulointi

Quishing: Miten QR-koodikalastelu kiertää yrityksesi sähköpostisuojauksen

Opi miten quishing ohittaa sähköpostisuodattimet siirtämällä hyökkäyksen älypuhelimeen ja kuinka suojaat organisaatiosi tehokkaasti.

Julkaistu 3. lokakuuta 2026 · ⏱ 4 min

✓ Brain Security · T&K Kyberturvallisuus & Inhimillinen Tekijä ⚖ Traficom NCSC-FI · Kybermittari · NIS 2 · DORA · ISO 27001 ★ Super Phisher

Kuvittele seuraava tilanne: organisaatiosi on ottanut käyttöön markkinoiden tiukimmat sähköpostin tietoturvapalvelut, modernin EDR-ratkaisun jokaiselle päätelaitteelle ja kattavan monivaiheisen todennuksen (MFA). Silti maanantaiaamuna taloushallinnon asiantuntijan käyttäjätunnukset päätyvät vääriin käsiin ilman, että yksikään tekninen valvontajärjestelmä hälyttää. Hyökkäysvektorina ei toiminut haitallinen liitetiedosto eikä viestin tekstissä ollut epäilyttävä linkki. Kyseessä oli tavanomaiseen PDF-dokumenttiin upotettu mustavalkoinen kuvio, joka kehotti päivittämään pääsyoikeudet turvallisesti.

Quishing, joka yhdistää termit QR-koodi ja phishing, muodostaa merkittävän operatiivisen haasteen tietoturvajohdolle (CISO) ja tietohallinnolle. Houkuttelemalla uhrin skannaamaan graafisen koodin omalla älypuhelimellaan hyökkääjä murtaa IT-osaston rakentaman suojakehän ja siirtyy valvottujen yritystyökalujen ulottumattomiin. Myös Liikenne- ja viestintävirasto Traficomin Kyberturvallisuuskeskus (NCSC-FI) seuraa tarkasti tämän kalastelutekniikan yleistymistä suomalaisissa organisaatioissa.

Mitä quishing on ja miksi se lamauttaa sähköpostiyhdyskäytävät?#

Tiivistelmä: Quishing hyödyntää QR-koodia haitallisen URL-osoitteen kätkemiseen kuvan sisälle. Perinteiset sähköpostin yhdyskäytävät analysoivat usein vain raakatekstiä, minkä vuoksi koodi läpäisee roskapostisuodattimet ja päätyy suoraan vastaanottajan saapuneet-kansioon.

Perinteisessä kalasteluhyökkäyksessä sähköpostin turvayhdyskäytävä (Secure Email Gateway) tarkastaa viestin hyperlinkit, varmentaa niiden maineen uhkatietokannoista ja ajaa liitetiedostot eristysympäristössä (sandbox). Quishing-hyökkäyksessä ansa jää näille perusmekanismeille näkymättömäksi. URL-osoite ei esiinny sähköpostissa luettavana tekstijonona, vaan se on koodattu visuaalisesti pikselimatriisiksi, usein PNG-kuvaan tai PDF-liitteeseen sijoitettuna.

Tällaisen uhkan pysäyttäminen edellyttää optista merkkien tunnistusta (OCR) tai kuvien reaaliaikaista purkamista kaksiulotteisen koodin lukemiseksi. Tämä käsittely vaatii huomattavasti laskentatehoa ja aiheuttaa sellaista viivettä, johon useimmat sähköpostijärjestelmät eivät suuressa mittakaavassa kykene.

Lisäksi hyökkääjät mukauttavat kätkemismenetelmiään muuttamalla kontrastia, sijoittamalla logoja QR-koodin keskelle tai käyttämällä ehdollisia ohjauksia, jotka laukeavat vain mobiiliselaimesta saapuville pyynnöille. Tämän seurauksena sähköpostisuodatus päästää viestin läpi hyväksyttynä.

4-STAGE ACTION PIPELINE · Quishing: Miten QR-koodikalastelu kiertää… Traficom NCSC-FI · Kybermittari · NIS 2 · DORA · ISO 27001

Toiminnallinen arkkitehtuuri: Quishing: Miten QR-koodikalastelu kiertää yrityksesi sähköpostisuojauksen (Super Phisher · Brain Security).

Kanavien ristiinkäyttö: Työasemalta henkilökohtaiseen puhelimeen#

Tiivistelmä: Pakottamalla älypuhelimen kameran käyttöön hyökkääjä ohittaa työaseman EDR-valvonnan ja hyödyntää laitetta, josta puuttuvat yrityksen DNS-suodatus ja verkkokontrollit.

Quishingin todellinen vaara piilee toimintaympäristön vaihtumisessa eli niin kutsutussa cross-device-hyökkäyksessä. Vaikka työntekijä lukee viestiä tiukkojen tietoturvapolitiikkojen suojaamalla työasemalla, viesti ohjaa häntä käyttämään puhelintaan toiminnon vahvistamiseen: todennussovelluksen synkronointiin, sähköpostin salasanan päivittämiseen tai sisäisen HR-ilmoituksen kuittaamiseen.

Kun työntekijä suuntaa puhelimensa kameran tietokoneen näyttöä kohti:

EDR-suojaus poistuu pelistä: Henkilökohtaisessa puhelimessa (BYOD) ei yleensä ole telemetria-agentteja tai yritystason URL-suodatusta.
Verkkoturva ohitetaan: Yhteys muodostetaan mobiilioperaattorin 4G- tai 5G-verkon kautta, jolloin yrityksen välityspalvelimet ja DNS-estolistat eivät pysty valvomaan liikennettä.
Mobiilikäyttöliittymä peittää hälytysmerkit: Puhelinten selaimet lyhentävät osoiterivin tilan säästämiseksi, mikä tekee väärennetyistä verkkotunnuksista tai typotaklauksista lähes mahdottomia havaita paljaalla silmällä.

Tämä vektori ei rajoitu ainoastaan sähköposteihin. Hyökkääjät hyödyntävät myös fyysistä tilaa. Haitallisia QR-koodeja on havaittu yritysten pysäköintialueiden latauspisteissä, postitse saapuvissa tekaistuissa HR-kirjeissä tai taukohuoneiden ilmoitustauluilla, joissa kehotetaan kirjautumaan uuteen henkilöstöportaaliin.

Executive Synthesis of Guide Pillars: Quishing: Miten QR-koodikalastelu kiertää yrityksesi sähköpostisuojauksen
Strategic Dimension	Detailed CISO Recommendation
EDR-suojaus poistuu pelistä	Henkilökohtaisessa puhelimessa (BYOD) ei yleensä ole telemetria-agentteja tai yritystason URL-suodatusta. (Kanavien ristiinkäyttö: Työasemalta henkilökohtaiseen puhelimeen)
Luo selkeä sisäinen toimintasääntö	Määrittele tietoturvaohjeistuksessa, että mikään organisaation virallinen taho (IT, HR, taloushallinto) ei koskaan pyydä skannaamaan QR-koodia… (Miten suojaat organisaatiosi tehokkaasti QR-koodikalastelulta?)
Verkkoturva ohitetaan	Yhteys muodostetaan mobiilioperaattorin 4G- tai 5G-verkon kautta, jolloin yrityksen välityspalvelimet ja DNS-estolistat eivät pysty valvomaan… (Kanavien ristiinkäyttö: Työasemalta henkilökohtaiseen puhelimeen)
Suojaa hallinnoidut mobiililaitteet	Mikäli organisaatio tarjoaa työpuhelimet, varusta ne mobiililaitteiden hallintajärjestelmällä (MDM), joka sisältää suojauksen kameran kautta… (Miten suojaat organisaatiosi tehokkaasti QR-koodikalastelulta?)

Miten suojaat organisaatiosi tehokkaasti QR-koodikalastelulta?#

Kun uhka kykenee murtamaan perinteiset tekniset esteet, kestävin suojamuuri rakentuu henkilöstön valppauden ja oikeiden toimintamallien varaan. Työntekijöiden älypuhelimen käyttöä ei voida eikä kannata täysin estää, mutta automaattinen koodin skannaaminen voidaan opettaa korvaamaan kriittisellä pysähtymisellä.

Organisaation suojaamiseksi quishing-hyökkäyksiltä suositellaan seuraavia toimenpiteitä:

Luo selkeä sisäinen toimintasääntö: Määrittele tietoturvaohjeistuksessa, että mikään organisaation virallinen taho (IT, HR, taloushallinto) ei koskaan pyydä skannaamaan QR-koodia salasanan nollaamiseksi tai monivaiheisen todennuksen (MFA) konfiguroimiseksi.
Suojaa hallinnoidut mobiililaitteet: Mikäli organisaatio tarjoaa työpuhelimet, varusta ne mobiililaitteiden hallintajärjestelmällä (MDM), joka sisältää suojauksen kameran kautta avattaville linkeille.
Harjoittele käytännönläheisesti: Teoria ei riitä sosiaalista manipulointia vastaan. Oikeiden toimintamallien vakiinnuttaminen vaatii toistuvia ja realistisia simulaatioita. Super Phisher mahdollistaa nykyaikaisten quishing-skenaarioiden tuomisen harjoituksiin, jolloin henkilöstö oppii tunnistamaan epäilyttävät tunnusmerkit ennen kameran avaamista.
Madalla ilmoituskynnystä: Rakenna yksinkertainen ja nopea kanava, jonka kautta jokainen voi ilmoittaa epäilyttävistä kuvista tai poikkeavista QR-koodeista ilman virheiden pelkoa.

Nykyaikainen tietoturva ei perustu teknologioiden sokeaan kieltämiseen vaan henkilöstön kykyyn arvioida tilanteita oikein siten, ettei yksittäisestä työntekijästä muodostu tahatonta väylää koko organisaation lamauttavalle tietomurrolle.

Haluatko testata ja kehittää organisaatiosi puolustusta uusimpia manipulointitaktiikoita vastaan? Varaa esittely asiantuntijamme kanssa ja rakennetaan yhdessä organisaatiosi tarpeisiin sopiva valmennuskokonaisuus.

Super Phisher käytännön tilanteessa aiheeseen ”Quishing: Miten QR-koodikalastelu kiertää yrityksesi sähköpostisuojauksen” liittyen. Tutustu tuotteeseen Super Phisher valikoimassa →

Lue lisää: aiheeseen liittyvät artikkelit ja Brain Securityn ratkaisut#

Aiheeseen liittyvät artikkelit

Toimitusjohtajahuijaus 2.0: Miten äänikloonaus ja deepfake-videot harhauttavat talousjohtoa (Phishing & Social Engineering) : Miten suojata taloushallinto toimitusjohtajahuijauksilta ja deepfake-vishingiltä? Lue prosessit, vastatoimet ja käytännön harjoitteet CISOille.
MFA Fatigue ja Push Bombing: Kaksivaiheisen tunnistautumisen ohittaminen ilman koodimurtoa (Phishing & Social Engineering) : Ymmärrä MFA fatigue ja push bombing -hyökkäysten mekanismi. Kouluta organisaatiosi tunnistamaan push-ilmoitusten manipulointi ja torjumaan tietomurrot.
Vishing : Näin kyberrikolliset manipuloivat työntekijöitä puhelimitse (Phishing & Social Engineering) : Opi tunnistamaan IT-tukeen ja MFA-vahvistuksiin kohdistuvat vishing-hyökkäykset. Suojaa organisaatiosi tehokkailla toimintamalleilla ja harjoituksilla.
PCI DSS v4.0 Vaatimus 12.6: Tietoturvakoulutus ja kalastelun torjunta (Compliance (NIS 2, DORA, ISO)) : Ota haltuun PCI DSS v4.0 vaatimus 12.6. Rakenna tehokas tietoturvakoulutus, torju tietojenkalastelu ja vakuuta QSA-auditoija käytännön neuvoillamme.

Tutustu Brain Securityn ratkaisuihin verkkosivuillamme

Liittyvä ratkaisu : Super Phisher : Realistiset tietojenkalastelusimulaatiot (Super Phisher): opeta henkilöstö tunnistamaan ja ilmoittamaan huijausviestit.
Tutustu käyttötapauksiin tavoitteen ja toimialan mukaan
Vertaa kyberturvallisuus- ja tekoälykoulutusmuotojamme
Tutustu koko Brain Securityn interaktiiviseen tuotevalikoimaan
Keskustele tarpeistasi tiimimme kanssa (demo ja käyttöönotto)

Information

CGV

Your cookie settings and all our legal documents.

Terms of Service · Privacy policy · Cookie policy · Legal notice