Catalog

The fully customizable cyber competition: custom game flow, boss fights and a public leaderboard. Lue lisää→ Cabinet

The security awareness arcade cabinet. Configured online, delivered turnkey. Lue lisää→ Game

The CISO stress-buster: one control, ~2 minutes, and screaming into the mic multiplies your score. Lue lisää→ Competition

The fully configurable reflex competition: timed mini-games, cyber, AI or mixed universes, arcade mode. Lue lisää→ Experience

The deepfake photobooth: allow your webcam, watch an AI transform you live, and never look at an image the same way again. Lue lisää→ Encyclopedia

The AI-generated visual cyber encyclopedia: explore every topic, endlessly. Lue lisää→ Bot

The bot that trains your workforce in the messaging apps: micro-lessons that show up on their own, signed Jack. Lue lisää→ Training

The cyber training path as a progress map: short chapters and a built-in arcade quiz, with no account to create. Lue lisää→ Simulation

The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password. Lue lisää→

Toolkit

Coming soon The CISO’s toolbox, coming soon.

Game

The narrative game that teaches cybersecurity through play: ten chapters, a level map, with nothing to install. Lue lisää→

Use cases

Tell us what you are trying to do, we point you to the right product.

Competition

The fully customizable cyber competition: custom game flow, boss fights and a public leaderboard. Lue lisää→ Competition

The fully configurable reflex competition: timed mini-games, cyber, AI or mixed universes, arcade mode. Lue lisää→ Cabinet

The security awareness arcade cabinet. Configured online, delivered turnkey. Lue lisää→

Cabinet

The security awareness arcade cabinet. Configured online, delivered turnkey. Lue lisää→ Game

The CISO stress-buster: one control, ~2 minutes, and screaming into the mic multiplies your score. Lue lisää→ Experience

The deepfake photobooth: allow your webcam, watch an AI transform you live, and never look at an image the same way again. Lue lisää→

Training

The cyber training path as a progress map: short chapters and a built-in arcade quiz, with no account to create. Lue lisää→ Bot

The bot that trains your workforce in the messaging apps: micro-lessons that show up on their own, signed Jack. Lue lisää→ Game

The narrative game that teaches cybersecurity through play: ten chapters, a level map, with nothing to install. Lue lisää→

Bot

The bot that trains your workforce in the messaging apps: micro-lessons that show up on their own, signed Jack. Lue lisää→

Competition

The fully configurable reflex competition: timed mini-games, cyber, AI or mixed universes, arcade mode. Lue lisää→ Experience

The deepfake photobooth: allow your webcam, watch an AI transform you live, and never look at an image the same way again. Lue lisää→ Bot

The bot that trains your workforce in the messaging apps: micro-lessons that show up on their own, signed Jack. Lue lisää→ Encyclopedia

The AI-generated visual cyber encyclopedia: explore every topic, endlessly. Lue lisää→

Simulation

The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password. Lue lisää→ Training

The cyber training path as a progress map: short chapters and a built-in arcade quiz, with no account to create. Lue lisää→

Toolkit

Coming soon The CISO’s toolbox, coming soon.

These products open very soon. Tell us about your needs: we let you know the moment they open, or give you an early preview.

Features

What each Brain product does, product by product.

Cyber Cup

The fully customizable cyber competition: custom game flow, boss fights and a public leaderboard.

Fully customizable competitions

Custom game flow, lives, duration, boss fights, scoring mode: configure every detail.

Content Studio

Review and localize your own question bank with your team, on credits.

14 formats + boss fights

Passwords, phishing, WiFi, social media, deepfakes… 4 boss fights and 2 bonus modes, over 7,000 questions.

Skills map

Track your teams’ progress theme by theme, with export, and connect your directory over SAML SSO.

Arcade mode

Turn the cup into an event kiosk: no identity to enter, anonymous leaderboard.

Brain Arcade

The security awareness arcade cabinet. Configured online, delivered turnkey.

Built-in cyber game

Timed quiz with score and anonymous leaderboard. Idle mode with an attract video.

3D configurator

Text and logo customizable on every face, in real-time 3D, config shareable with a link.

Live hacking demos

Rogue WiFi access point and QR phishing: two teachable modules to run right on the cabinet.

Admin console

Network, system status and video content, all manageable, shipped with the cabinet.

Super CISO Destroyer

The CISO stress-buster: one control, ~2 minutes, and screaming into the mic multiplies your score.

One control

Click or any key. Everyone knows how to play in a second.

Scream = multiplier

Mic detection turns volume into a score multiplier, from ×1 to ×3.

10 satirical scenes

Slap the board, chase the vendor, smash the on-call phone… 3 more intense scenes on demand.

~2-minute runs

6 random scenes per run, perfect at a booth or between two meetings. Playable on mobile.

Super Challenge

The fully configurable reflex competition: timed mini-games, cyber, AI or mixed universes, arcade mode.

Configurable reflex mini-games

50 per run by default, drawn from a bank of over 2,000 items: decisions in seconds.

Three universes

Cyber, AI or mixed: the same mechanics serving both topics, for around twenty themes.

Adjustable lives, time and bosses

1, 3 or 5 lives; speed, countdown or free mode; optional boss fights.

Skills map

Track your teams’ progress theme by theme, with export, across all 9 languages.

Arcade mode

The competition as an event kiosk: instant start, anonymous leaderboard, no identity.

Deepfake Studio

The deepfake photobooth: allow your webcam, watch an AI transform you live, and never look at an image the same way again.

Live

The transformation happens in real time on the webcam feed, not on a delayed photo.

Ready-made characters or your face

Faces and styles to try, or upload your own face for the demonstration.

Nothing is kept

No image is stored: real-time processing, an “AI-generated” watermark on captures.

Zero friction

No account, no install: a browser and a webcam are enough.

Cyberpedia

The AI-generated visual cyber encyclopedia: explore every topic, endlessly.

A copilot before you generate

The AI shapes the topic’s angle with you before producing the plate: fewer wasted generations.

Endless exploration

Every click on an image element generates the child page, visually anchored to the previous one. No depth limit.

10 visual styles

Isometric, infographic, poster, bauhaus, watercolor, storybook… per book or per page.

Share with a link

Every book can be published and shared through a public link, no account needed on the reader side.

Chat with Jack

The bot that trains your workforce in the messaging apps: micro-lessons that show up on their own, signed Jack.

Native to the messaging app

Slack, where your teams already work. Microsoft Teams and Google Chat coming later.

30 scripted lessons

5 minutes each, bilingual FR/EN, personalized (first name, company, executives).

Narrative campaign

“The Rise of the Hacker”: 12 episodes in 4 acts, plus 2 branching gamebooks.

Reporting reflex

Forwarding a suspicious message to Jack = a real behavioral signal, without simulation.

Cyber Journey

The cyber training path as a progress map: short chapters and a built-in arcade quiz, with no account to create.

Progress map

A visual progression by chapters, at your own pace, that makes you want to finish.

Built-in arcade quiz

An arcade quiz built into the path, drawn from over 3,000 questions.

No account creation

The learner gets in through a link and a code: nothing to install, nothing to create.

Organizer management

Path assignment, leaderboard and progress tracking.

Super Phisher

The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password.

A ready-to-use catalog

Over 1,300 scenarios sorted into around twenty pretext families, filtered by your company profile.

Today’s attacks

The fake email, but also the booby-trapped QR code, the fraudulent attachment and the fake verification page.

A controlled setting

Signed mandate, verified domain, test send to yourself, and never any password captured.

The debrief that matters

Who clicked, who reported, reporting rate: the measure that moves your teams forward.

Cybersecurity is not a game

The narrative game that teaches cybersecurity through play: ten chapters, a level map, with nothing to install.

A level map

You progress chapter by chapter, at your own pace, like in a game.

Ten chapters

From the brain facing risk to malware: phishing, passwords, social engineering…

In the browser

Nothing to install: you play directly, in French or English.

Organizer tracking

An admin console tracks progress and exports results.

Frequently asked questions

The questions we hear most, product by product.

Cyber Cup

The fully customizable cyber competition: custom game flow, boss fights and a public leaderboard.

Through a simple link (or QR code). They pick a nickname and play, no account creation, and in arcade mode, even the nickname becomes optional.

The game flow (which formats, how many questions, where the bosses go), the number of lives, the run duration, the scoring mode, and even your own question bank through Content Studio.

Yes: the skills map shows where each team is progressing, theme by theme, with export. SAML SSO connects your company directory.

Brain Arcade

The security awareness arcade cabinet. Configured online, delivered turnkey.

No. The cabinet runs on its own: attract mode, free-play game, and a leaderboard that keeps the competition going.

In the online 3D configurator: pick a preset or compose your faces (text, logo, images), share your configuration with a link (with a designer if needed), then order.

The 4G router + SIM option (1 year included) makes the cabinet fully independent from the site’s network.

Volume discounts apply: 10% off from 3 to 9 cabinets, 20% off from 10 cabinets. Get in touch and we’ll put together a tailored quote.

Super CISO Destroyer

The CISO stress-buster: one control, ~2 minutes, and screaming into the mic multiplies your score.

It’s first a stress-buster, and a conversation magnet about the daily life of security teams. At events, it’s the booth everyone stops at.

No. Without a mic, the game runs at ×1. With it, screaming amplifies the score, up to ×3.

About 2 minutes: 6 scenes drawn at random from a pool of 10.

Super Challenge

The fully configurable reflex competition: timed mini-games, cyber, AI or mixed universes, arcade mode.

Cyber Cup is a knowledge arcade quiz; Super Challenge tests reflexes against the clock, with lives. Both share the same engine and launch from a link.

Spotting generated content, catching a deepfake, judging a prompt, checking a source: the everyday AI reflexes. The mixed universe combines cyber and AI.

Yes: depending on the setting (1, 3 or 5 lives), every mistake costs one. That’s what keeps the competition tense.

Deepfake Studio

The deepfake photobooth: allow your webcam, watch an AI transform you live, and never look at an image the same way again.

No. The feed is processed in real time and nothing is recorded or kept. Captures carry an “AI-generated” watermark.

No: open the link, allow your webcam, see yourself transformed. The session is deliberately short.

To make people live the deepfake instead of explaining it: once you have watched your own face lie on screen, you never look at a video call the same way.

Cyberpedia

The AI-generated visual cyber encyclopedia: explore every topic, endlessly.

The AI first thinks the topic through with you, then generates the main illustration and the text, grounded on Wikipedia to stay factual.

Yes: an editor creates a book on their topic, structures it by exploring, picks a visual style, then shares it with a link.

Each generation uses credits shared by your team: one common pool per workspace, no per-user subscription.

Chat with Jack

The bot that trains your workforce in the messaging apps: micro-lessons that show up on their own, signed Jack.

Because the reflex that matters is reporting, not punitive distrust. Jack measures a real signal: the suspicious messages people forward to him.

5 minutes per lesson, about one a month by default. The cadence is set per campaign.

No: every lesson is scripted and reviewed. Jack’s voice is written, not improvised.

Cyber Journey

The cyber training path as a progress map: short chapters and a built-in arcade quiz, with no account to create.

No: the learner gets in through a link and a code, with a simple email and an alias. Nothing to install, nothing to create.

You move along a progress map, chapter by chapter: short lesson screens, a built-in arcade quiz and reflex cards to keep within reach.

Through path assignment, a leaderboard and progress tracking on the console side.

Super Phisher

The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password.

No: Super Phisher is an awareness tool. No password is captured, every campaign requires a signed mandate and a verified domain, and you can send the lure to yourself before any launch.

The fake email, but also the booby-trapped QR code, the fraudulent attachment and the fake verification page. Each recipient gets a scenario matched to their language.

The debrief shows who clicked and above all who reported the attack, with your teams’ reporting rate, campaign by campaign.

Cybersecurity is not a game

The narrative game that teaches cybersecurity through play: ten chapters, a level map, with nothing to install.

No: the game plays directly in the browser, with nothing to install and no account to create. An email is enough to get started.

Ten chapters, from how the brain handles risk to malware, by way of passwords, the man-in-the-middle, social engineering and phishing.

Yes, in French and English, chosen right when you enter the game.

Compare

Annual e-learning, phishing simulation, one-off workshops, games: four ways to raise awareness in your teams, what each one brings and what Brain adds.

Criterion	Annual e-learning	Phishing simulation	One-off workshop	Brain
Format	An online module to complete, often once a year, hosted on the LMS.	Simulated phishing emails sent to inboxes, with a training page for those who click.	A workshop, a talk or an escape game, in person or remote.	A collection of small tools: competitions, mini-games, messaging bot, learning path, encyclopedia, arcade kiosks.
What the employee experiences	They go through the module to the end and pass a quiz.	They receive a simulated phishing email and practice spotting and reporting it; if they click, they see a short reminder right away.	They take part in a group session led by a speaker.	They play for one minute or five, compare themselves with colleagues on a leaderboard and come back.
Getting started	LMS integration, enrollments, completion reminders.	Mail system setup, distribution lists, scenarios.	A quote, a date, a room or a video call, a speaker.	A free self-service account, a link or a QR code to share. Zero install.
Rhythm	One campaign a year, sometimes quarterly.	Waves of emails through the year.	One or two highlights a year.	Highlights (cybersecurity awareness month, AI Spring, trade show) and a year-round thread, in small doses.
What you measure	Completion rate and quiz scores.	Click rate and reporting rate.	Attendance and on-the-spot satisfaction.	Participation, progress and completion, with exports provided by default.
Topics	The chosen catalog program, mostly cyber.	Phishing and its variants.	The topic of the session.	Cyber and AI, enabled separately.
Employee data	A named account per learner.	Email addresses and each campaign’s results (clicks, reports), by name or aggregated depending on settings.	An attendance sheet.	In competitions and on kiosks, no player account: a nickname and a score.
Pricing model	Most often a license per user per year.	Most often a license per user per year as well.	A quote per session.	Public prices: free to test, credit packs paid per participation, unlimited annual plan on quote.
On site	Rarely: the module is taken online, on a computer or phone.	Not usually: it happens in the inbox, sometimes via text message or QR code.	Yes, that is its home ground.	Yes: a real arcade kiosk in the lobby, on top of online play.

A complement, not a replacement

Brain replaces neither the mandatory module nor your phishing simulations: it adds what they are not designed to do (highlights, competition, on-site presence) and gives you the record of a living program.

Tutustu valikoimaan See pricing

The Brain Platform

Each Brain tool can be used on its own. The Brain Platform brings them together in a single cybersecurity and AI awareness program: the program owner sets a goal, each employee takes part in the format that suits them, and a training record keeps track of participation. It is not self-service: there is no account to create online; we set it up with you after a conversation with our team.

Ota yhteyttä tiimiimme

Frequently asked questions

No. The mandatory module remains useful for compliance. Brain comes on top: highlights, competition and on-site presence to create engagement, with participation, progress and completion exports to keep the record.

Yes. Products open for signup can be tried in self-service, with a free account and no credit card, and prices are public. Some products are already deployed with customers and are available by appointment: we set them up with you after a conversation with our team. A call is also needed for the Brain Platform, a kiosk, an unlimited subscription or a specific need.

Pricing

Public prices, excluding VAT, with no quote needed for most of it: you choose a volume, you pay, you launch. Products open for signup are tried free first, with no credit card.

Getting started: free

A free account, no credit card, with the admin console, which uses no credits. Cyber Cup and Super Challenge include five free test accesses, the Brain Arcade configurator can be tried with the same account, and Super CISO Destroyer and Deepfake Studio are free to play, with no account. For the other products, each catalog page says how to get access.

Cyber Cup and Super Challenge: credit packs

One credit is one run for one participant. It is used at the participant’s first actual login: if they log in again or finish later, it is still one credit. A new run or a new edition uses a new credit.

Pack	Price excl. VAT	Discount
250 credits	450 €	baseline
500 credits	750 €	−17 %
1 000 credits	1 200 €	−33 %
2 000 credits	1 900 €	−47 %
5 000 credits	3 000 €	−67 %
10 000 credits	4 200 €	−77 %

Valid 12 months from purchase, usable on Cyber Cup and Super Challenge alike, with the balance shown in real time in the console.
No subscription, no renewal: when the credits run out, you decide whether to buy more.
Above 10,000 credits, pricing is on quote.

Unlimited annual subscription: on quote

Unlimited runs on Cyber Cup and Super Challenge, for the whole organization, all year round. The price is set in a meeting based on the number of users, the scope and the commitment length. 12-month firm term, tacit renewal, 2-month notice.

Brain Arcade: an annual license per cabinet

You design the cabinet in 3D, we build it, deliver it and install it. It remains Brain’s property: you pay for its use, not its purchase.

Model	Year 1 (excl. VAT)	Following years (excl. VAT, per year)
Full cabinet (about 181 cm)	7 000 €	3 500 €
Bartop (compact cabinet)	5 000 €	2 500 €

Year 1 covers design, custom graphics, manufacturing, delivery and installation in mainland France, the license and maintenance. The following years cover the license, content updates, hosting, support and maintenance.
Unlimited players and runs, with no credits used.
12-month minimum commitment per cabinet, tacit renewal for 12-month periods, cancellable up to 2 months before the term.
Volume discounts: 10% off from 3 to 9 cabinets, 20% from 10. On quote: custom artwork outside the templates, delivery outside mainland France, on-site facilitation.

Events: on quote

Trade show, seminar, cybersecurity awareness month: cabinets for a few days. The price depends on the number of cabinets, the duration, the venue and the logistics. The service is paid in advance, which secures your dates.

Tutustu valikoimaan Ota yhteyttä tiimiimme

Frequently asked questions

Yes, 12 months after purchase, with a reminder 30 days before. Unused credits are lost, which is the counterpart of volume discounts. If Brain fails its obligations or removes a main feature, they are refunded pro rata.

Yes: within 14 days of an online order, as long as no credit was used, no game was opened to participants and no cabinet manufacturing was started.

Credits are paid at order time. Subscriptions are invoiced in advance and payable within 30 days. An event service is paid before the event.

Yes, for an annual subscription, more than 10,000 credits, an event or a multi-entity rollout. The Brain Platform, which brings the tools together in a single awareness program, has no public price: it is not self-service, we set it up with you after a conversation with our team.

Not without Brain’s written agreement: credits belong to the entity that bought them.

Brain collects the cabinet within 30 days, unless you say before the term that you want to continue: nothing changes then, except the price, which moves to the following-years rate.

Full terms, in French: annex 4 of the terms of service

Learning & gamification

Level up your teams on cyber & AI, without putting them to sleep.

Brain is not an annual training people sit through: it is a collection of small tools (mini-games, competitions, a bot, training paths, an encyclopedia) and highlight moments that punctuate the year. Put end to end, they form a platform for a lasting security culture.

How we work

Reflexes all year long, in small doses.

One tool does not change a culture. A collection of tools, played all year and managed in one place, does. And it shows on both sides: the people who play, and the people who run the program.

For employees

Experiences that stick

One minute or five, at a booth or in the messaging apps. People play, compare scores, play again, and the reflexes sink in.

Timed reflex mini-games, cyber or AI topics
Link-based competitions with public leaderboards
On-site arcade cabinets for your highlight events
Micro-lessons in Slack (Teams and Google Chat coming later)

Zero installEverything runs in the browser, from a simple link

No accountOn the player side, a nickname is all it takes

For the security team

Everything managed in one place

You manage all the content from the console, and you pull the numbers without having to ask anyone.

Design, content, customization, localization: everything is editable
Measurement tools included by default, on every platform
Participation, progression and completion exports
Cyber and AI topics can be enabled separately

DORA · NIS2Supports your regulatory obligations

AI Act · Art. 4AI literacy measures mandatory since 2025

Everything that is open can be tried, right now.

01
You open an account
Every product open for signup is self-service: you create your account on the one that interests you, without going through us. For the others, the product page says how to get access.
02
You test, you launch
You try it on one team, then roll it out. Measurement tools come by default in every platform.
03
You want more, we talk
Unlimited, MSP, the Brain Platform, which brings the tools together in a single program, or a need entirely your own: that is the moment to tell us about your needs.

A company with specific needs? Open up every element, customize content and design to your brand, roll out across multiple entities. Tell us about your needs, we build it with you.

Competition

The fully customizable cyber competition: custom game flow, boss fights and a public leaderboard. Lue lisää→ Cabinet

The security awareness arcade cabinet. Configured online, delivered turnkey. Lue lisää→ Game

The CISO stress-buster: one control, ~2 minutes, and screaming into the mic multiplies your score. Lue lisää→ Competition

The fully configurable reflex competition: timed mini-games, cyber, AI or mixed universes, arcade mode. Lue lisää→ Experience

The deepfake photobooth: allow your webcam, watch an AI transform you live, and never look at an image the same way again. Lue lisää→ Encyclopedia

The AI-generated visual cyber encyclopedia: explore every topic, endlessly. Lue lisää→ Bot

The bot that trains your workforce in the messaging apps: micro-lessons that show up on their own, signed Jack. Lue lisää→ Training

The cyber training path as a progress map: short chapters and a built-in arcade quiz, with no account to create. Lue lisää→ Simulation

The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password. Lue lisää→

Toolkit

Coming soon The CISO’s toolbox, coming soon.

Game

The narrative game that teaches cybersecurity through play: ten chapters, a level map, with nothing to install. Lue lisää→

Let’s find whatwill stick with your teams

Start with the catalog: open products can be tried right away. And as soon as you want to go further, we take it from there with you.

Book a call

Tell us about your needs: we set up a time, or we get back to you.

The most direct

Tell us about your needs

A special request? An awareness program to build, a specific population, context we should factor in? Book a time: we talk it through live, and look together at what fits your need.

Your context: populations, industries, languages, deadlines
The formats that fit: arcade, competitions, training paths
Measurement: participation, progression, reporting
Integrations: Slack, SAML SSO, CSV and Excel exports

30 minutes, no commitment, with a member of the team.

In writing

Rather we get back to you?

Leave us your details and a couple of lines about your need. We get back to you quickly.

By sending this form, you agree that your data will be used to get back to you. Privacy policy · Cookies

Cyber Month 2026 The cybersecurity awareness month

Let’s organize your cyber awareness month

For cybersecurity awareness month, every company runs its own campaign. Run yours arcade-style: your teams play, the leaderboard updates live, everything gets measured. Start for free, no commitment.

Create my Cyber Cup Create my Super Challenge

Free account, no credit card to get started.

Why go arcade

Three reasons to make it count

An event ready to launch, played anywhere, with results you can report.

01

A turnkey event

Zero onboarding: you create the competition, the questions are already there, you share one link. Your teams are playing within the minute.

02

Online or on-site, with cabinets

Everyone plays from their phone, wherever they are. Or you install a real arcade cabinet in the lobby for the whole month. The two combine.

03

Results to report

At the end of the month, you show figures, not an impression: participation, leaderboard, progress by topic and exports to present to your leadership team. A record that supports your DORA and NIS2 obligations.

Optional

The Brain Arcade cabinet, on your premises

The same game in cabinet mode: a nickname-only kiosk, with no personal data, in a real arcade cabinet installed at your site for the whole month.

181 cm full cabinet or bartop
12 designs, customizable to your colors
Nickname-only kiosk: no personal data on players

See the Brain Arcade cabinet

Frequently asked questions

Your Cyber Month, done better: your questions

Give them a reason to play rather than one more module: a competition between teams, with a leaderboard that updates live. Everyone plays from their phone, with no account to create on the player side.

Change the format: short, timed arcade-quiz runs, reflex challenges, an arcade cabinet in the lobby. A live leaderboard creates the friendly rivalry that traditional training lacks.

Keep your content and your e-learning, and add a highlight people can play: a tournament during the month, with a final leaderboard. The game comes on top of your mandatory module; it does not replace it.

With figures, not an impression: participation, leaderboard, progress by topic, and exports to present to your leadership team. A record that supports your DORA and NIS2 obligations.

You create the competition, the questions are already there, you share one link: your teams are playing within the minute. For a full program, a 20-minute call is enough to line up the games, the calendar and the communication kit.

No. Everything is played online, from a phone or a computer. The arcade cabinet is an option to make a splash on-site.

Need a hand

We’ll organize your month with you

Would you rather we put together a turnkey program for you? Leave a work email, we’ll get back to you with a plan.

The fastest way

A 20-minute call

We look at your context together and set the month’s highlights.

Which games fit your teams
A calendar for the month
An internal communication kit

Or in writing

Get a proposal

A single email from us, no newsletter. Privacy policy

AI Spring 2027 The AI awareness season

For AI, L&D and HR leaders

Let’s organize your AI Spring

Every spring, companies take stock of AI: what can be trusted to it, what must be checked, what is no longer taken at face value. Turn it into an arcade season: your teams play, the leaderboard updates live, everything is measured. You start for free, no commitment.

Create my Super Challenge See Chat with Jack

Free account, no credit card to start.

Why arcade mode

Three ways to mark the spring

A season ready to launch, played anywhere, that leaves a record.

01

A turnkey AI competition

Create your Super Challenge in the AI universe: deepfakes, prompts, confidential data, sources. The mini-games are already there, you share a single link, your teams play within the minute.

02

AI reflexes all season long

Chat with Jack sends micro-lessons in Slack (Teams and Google Chat coming later). Cyberpedia offers an AI-generated visual encyclopedia to explore at your own pace. The spring lasts, so does the awareness.

03

The AI Act, Article 4

Since 2025, the AI Act has asked companies to take measures that develop the AI literacy of their staff. A season of play contributes to that and leaves a record: participation, progress by topic, exports.

Optional

The Brain Arcade kiosk, in your premises

Super Challenge in kiosk mode: a nickname kiosk, no personal data, in a real arcade kiosk installed at your site for the whole season.

Large 181 cm kiosk or bartop
12 designs, customizable to your colors
Nickname kiosk: no personal data on players

See the Brain Arcade kiosk

Frequently asked questions

AI Spring, in practice

A season of artificial intelligence awareness in the company, modelled on cybersecurity awareness month: a highlight where every employee learns the right reflexes for deepfakes, prompts, confidential data and generated content. Each company picks its own dates in spring.

Three building blocks are enough: a Super Challenge competition in the AI universe launched with a single link, Chat with Jack micro-lessons in your messaging app for the whole season and, for a physical highlight, a Brain Arcade kiosk in the lobby. A free account lets you test everything before deciding.

A competition is created in a few minutes, with no onboarding or purchase order. Allow a 20-minute call with us if you want a turnkey program for the whole season.

Launch a Super Challenge in the AI universe and share it with a single link: your teams practice understanding AI, verifying answers, prompting well and spotting a deepfake. The skills map tracks their progress theme by theme, and the console exports the results as CSV or XLSX. These are all measures you can document under Article 4 of the AI Act, which asks companies to develop the AI literacy of their staff. You can try it first with a free account.

Need a hand

We organize your spring with you

Would you rather we suggest a turnkey program? Leave a business email and we come back with a plan.

The fastest

A 20-minute call

We look at your context together and set the season’s highlights.

Choice of games for your teams
Spring calendar
Internal communication kit

Or in writing

Get a proposal

A single email from us, no newsletter. Privacy policy

Kyberkulttuuri & Pelillistäminen

Artikkeleita, analyyseja ja käytännön oppeja tietoturvatietoisuuden ja tekoälyosaamisen kehittämisestä pelillistämisen avulla.

← Takaisin artikkeleihin

Tietojenkalastelu & Manipulointi

Sisainen kalastelu: Miten toimia kun haitallinen viesti tulee kollegan tililta?

Epailyttava viesti kollegan oikeasta sahkopostista? Lue CISO-tason toimintaohjeet tilimurron tunnistamiseen ja sivuttaisliikkeen torjuntaan.

Julkaistu 24. syyskuuta 2026 · ⏱ 4 min

✓ Brain Security · T&K Kyberturvallisuus & Inhimillinen Tekijä ⚖ Traficom NCSC-FI · Kybermittari · NIS 2 · DORA · ISO 27001 ★ Super Phisher

Tama tilanne aiheuttaa kylmia vareita jokaiselle tietoturvajohdolle (CISO). Aamulla kymmenet tyontekijat saavat sahkopostin, joka sisaltaa kirjautumislinkin tai kiireellisen liitetiedoston. Lahettajan osoitteessa ei ole ainoatakaan kirjoitusvirhetta, verkkotunnus vastaa taydellisesti yrityksen omaa domainia, ja tekniset suojaukset kuten SPF, DKIM ja DMARC nayttavat puhdasta vihreata. Syy on ilmeinen: hyokkays ei tule suoraan organisaation ulkopuolelta, vaan se lahetetaan tyontekijan aidosta tyotilista, jonka kirjautumistiedot on varastettu.

Kun hyokkaaja paasee kasiksi Microsoft 365 tai Google Workspace -ymparistoon, tavoitteena ei valttamatta ole datan valiton eksfiltrointi. Ensimmainen siirto on usein sivuttaisliike (lateral movement), jossa hyodynnetaan sisaisten viestien nauttimaa korkeaa luottamusta. Tallaista hyokkaysta vastaan perinteiset perimetripuolustukset ovat voimattomia. Havaitseminen ja vahinkojen rajaaminen nojaavat taysin inhimilliseen valppauteen seka systemaattisiin toimintamalleihin.

Miten reagoida kun epailyttava sahkoposti tulee tyontekijan aidosta osoitteesta?#

Tiivistelma: Ala koskaan vastaa suoraan sahkopostiin tarkistaaksesi sen aitoutta. Ota valittomasti yhteys oletettuun lahettajaan toista, riippumatonta kanavaa pitkin (puhelinsoitto tai suora pikaviesti) ja valita haittaviesti tietoturvatiimille tai IT-tuelle tilin eristamiseksi.

Kohteeksi joutuneen tyontekijan ensimmainen refleksi on usein klikata "Vastaa" ja kysya: "Lahetitko todella taman dokumentin minulle?". Tama on kriittinen virhe. Jos kollegan tili on hyokkaajan hallinnassa, hyokkaajalla on suora paasy postilaatikkoon. Han vastaa itse myontavasti usein vain sekunneissa hälventääkseen epailykset. Usein hyokkaaja on lisaksi luonut sahkopostiin piilotettuja uudelleenohjaussaantoja varmistaakseen, ettei aito kayttaja nae vastauksia.

Hyokkaysketjun katkaiseminen vaatii kaksi valitonta toimenpidetta:

Tarkistus toissijaisen kanavan kautta (Out-of-Band): Ota yhteytta lahettajaan toista reittia. Soita suoraan tyontekijan tyopuhelinnumeroon tai kay hanen tyopisteellaan, jos jaatte saman toimistotilan.
Valiton ilmoitus tietoturvalle: Kayta sahkopostiohjelman virallista phishing-ilmoituspainiketta tai valita viesti liitetiedostona (.eml- tai .msg-muodossa) organisaation tietoturvan osoitteeseen, jotta tekniset otsikkotiedot sailyvat koskemattomina.

4-LAYER DEFENSE STACK · Sisainen kalastelu: Miten toimia kun… Traficom NCSC-FI · Kybermittari · NIS 2 · DORA · ISO 27001

Toiminnallinen arkkitehtuuri: Sisainen kalastelu: Miten toimia kun haitallinen viesti tulee kollegan tililta? (Super Phisher · Brain Security).

Mitka merkit paljastavat sisaisen tilimurron aidosta osoitteesta huolimatta?#

Tiivistelma: Tunnistaminen perustuu viestin kontekstin ja kayttaytymisen poikkeamiin: tyylin ja sanaston akkimaillinen muutos, poikkeuksellinen kiireen tuntu, pyynto avata ulkoinen jaettu tiedosto tai irrallinen yleisluontoinen viesti aiemman viestiketjun keskella.

Sisainen tilikaappaus nojaa luottamuksen hyvaksikayttoon, mutta hyokkaajat jattavat lahes poikkeuksetta kontekstuaalisia jalkia. Istunnon tai tunnukset varastanut rikollinen ei tunne yrityksen sisaita kulttuuria, ihmisten valisia suhteita tai kyseisen kollegan tyypillista kirjoitustapaa.

Tarkkaile seuraavia heikkoja signaaleja:

Akkijyrkka muutos viestintatyylissa: Kollega, jonka kanssa viestit normaalisti rennosti, kayttaa yhtakkia virallisia teitittelymuotoja, outoja kaannoslauseita tai poikkeavaa ammattisanastoa.
Aiheeton kiire ja psykologinen paine: Viestissa vedotaan kriittiseen erääntyneeseen laskuun, IT-paasyoikeuksien valittomaan sulkeutumiseen tai luottamukselliseen sopimukseen, joka on allekirjoitettava heti.
Poikkeava pyynto syottaa kirjautumistietoja: Linkki ohjaa kirjautumissivun nakoiselle valenaytolle, jossa pyydetaan Microsoft 365 -tunnuksia muka SharePoint-, OneDrive- tai Google Drive -tiedoston avaamiseksi.
Olemassa olevan viestiketjun kaappaus (Thread Hijacking): Hyokkaaja vastaa viikkoja vanhaan aitoon sahkopostiketjuun ja sijoittaa ansalinkin vastaukseen, jolla ei ole suoraa yhteytta ketjun aiempaan asiasisaltoon.

Operational Review Checklist: Sisainen kalastelu: Miten toimia kun haitallinen viesti tulee kollegan tililta?
Ref.	Operational Control Point	Expected Outcome & Verification
CTRL-01	Tarkistus toissijaisen kanavan kautta (Out-of-Band)	Ota yhteytta lahettajaan toista reittia. Soita suoraan tyontekijan tyopuhelinnumeroon tai kay hanen tyopisteellaan, jos jaatte saman toimistotilan.
CTRL-02	Akkijyrkka muutos viestintatyylissa	Kollega, jonka kanssa viestit normaalisti rennosti, kayttaa yhtakkia virallisia teitittelymuotoja, outoja kaannoslauseita tai poikkeavaa…
CTRL-03	Istuntojen valiton mitatointi	IT-yllapidon on valittomasti nollattava vaarantuneen tilin salasana ja pakotettava kaikkien aktiivisten istuntojen seka OAuth-tunnisteiden…
CTRL-04	Valiton ilmoitus tietoturvalle	Kayta sahkopostiohjelman virallista phishing-ilmoituspainiketta tai valita viesti liitetiedostona (.eml- tai .msg-muodossa) organisaation tietoturvan…
CTRL-05	Aiheeton kiire ja psykologinen paine	Viestissa vedotaan kriittiseen erääntyneeseen laskuun, IT-paasyoikeuksien valittomaan sulkeutumiseen tai luottamukselliseen sopimukseen, joka on…

Miksi sisainen kalastelu kiihdyttaa sivuttaisliiketta organisaatiossa?#

Tililta toiselle eteneva kalastelu on yksi tuhoisimmista eskalointikeinoista yrityksen verkossa. Kun ensimmainen tili murtuu (usein istuntoevasteen varkauden kautta Adversary-in-the-Middle -hyokkayksella), hyokkaaja saa vapaan paasyn organisaation osoitekirjaan ja sisaisiin dokumentteihin.

Taman jalkeen hyokkaaja kartoittaa strategiset kohteet: taloushallinnon, henkilostojohdon ja IT-yllapidon. Muutamassa minuutissa ansa viritetaan kohdennetusti korkeiden kayttooikeuksien henkilostoa vastaan. Koska viesti lahetetaan sisaisesta osoitteesta, vastaanottajien varovaisuus on huomattavasti matalampi kuin tavanomaisten ulkoisten viestien kohdalla.

Taman riskin minimoimiseksi pelkka passiivinen ohjeistus ei riita. Henkiloston kaytannon harjoittelu realistisilla skenaarioilla on valttamatonta. Organisaatiolle raataloity Super Phisher -simulaattorimme mahdollistaa henkiloston harjoittamisen aitoja hyokkaysmalleja ja sisaista identiteettivarkautta simuloivilla tilanteilla, jotta oikeat toimintamallit juurtuvat arkeen ennen todellista hyokkaysta.

Super Phisher käytännön tilanteessa aiheeseen ”Sisainen kalastelu: Miten toimia kun haitallinen viesti tulee kollegan tililta?” liittyen. Tutustu tuotteeseen Super Phisher valikoimassa →

Miten IT- ja tietoturvatiimin tulee toimia valittomasti halytyksen jalkeen?#

Kun ilmoitus sisaisesta kalastelusta saapuu, jokainen minuutti ratkaisee tapahtumaketjun rajaamisessa ja jatkotartuntojen estamisessa:

Istuntojen valiton mitatointi: IT-yllapidon on valittomasti nollattava vaarantuneen tilin salasana ja pakotettava kaikkien aktiivisten istuntojen seka OAuth-tunnisteiden paattaminen kaikilla laitteilla.
Postilaatikon saantojen auditointi: Verkkorikolliset luovat lahes poikkeuksetta sahkopostisaantoja toimintansa salaamiseksi (automaattinen edelleenlahetys, sisaantulevien viestien poisto avainsanoilla kuten "tietoturva", "kalastelu" tai "salasana"). Nama saannot on tarkistettava ja poistettava.
Haitallisen viestin globaali poisto: Jarjestelman yllapitotyokaluilla (kuten Microsoft 365 tai Google Workspace -hallintapaneelin haku- ja poistotoiminnoilla) haitallinen viesti on etsittava ja poistettava kaikkien sisaisen verkon vastaanottajien laatikoista ennen kuin linkkeja avataan.
Kirjautumislokien ja telemetrian analysointi: IP-osoitteiden, maantieteellisen sijainnin ja selainten sormenjalkien tutkiminen auttaa selvittamaan murron tarkan ajankohdan ja sen, mihin tietoihin hyokkaaja on ehtinyt paasta kasiksi.

Organisaation suojaaminen sisaista ketjutettua kalastelua vastaan vaatii saumatonta yhteistyota teknisen suojauksen ja inhimillisen valppauden valilla. Jos haluat rakentaa henkilostollesi ja johtoryhmallesi realistisen, organisaatiosi riskeihin soveltuvan kyberharjoitteluohjelman, ota yhteytta asiantuntijoihimme ja varaa demo.

Lue lisää: aiheeseen liittyvät artikkelit ja Brain Securityn ratkaisut#

Aiheeseen liittyvät artikkelit

Etätyö, juna, hotelli: 6 liikkuvan työn tietoturvavirhettä jotka vaarantavat yrityksen (Phishing & Social Engineering) : Opi liikkuvan työn kriittiset tietoturvakäytännöt: julkiset Wi-Fi-verkot, olkapäävakoilu ja VPN organisaation etätyöntekijöiden suojaamiseksi.
Infostealer-haittaohjelmat: Salasanojen tallentaminen selaimeen vaarantaa yrityksen (Phishing & Social Engineering) : Miten infostealerit varastavat salasanat ja istuntoevasteet hallitsemattomista selaimista? Suojaa yrityksen paasytiedot ja vahvista tietoturvakulttuuria.
Pelotteluohjelmat ja selaimen valehalytykset: Kouluta tyontekijat tunnistamaan verkon ansoja (Phishing & Social Engineering) : Suojaa organisaatiosi scareware-ansoilta ja ClickFix-hyokkayksilta. Opi kouluttamaan tyontekijat torjumaan selaimen haitalliset valehalytykset arjessa.
HR ja rekrytointi kyberkohteena: Tunnista haitalliset CV:t ja deepfake-työnhakijat (Industries & Roles) : Suojaa HR-tiimisi saastuneilta ansioluetteloilta, vaarallisilta portfolioilta ja tekoälypohjaisilta deepfake-videotyönhakijoilta. Lue ohjeet.

Tutustu Brain Securityn ratkaisuihin verkkosivuillamme

Liittyvä ratkaisu : Super Phisher : Realistiset tietojenkalastelusimulaatiot (Super Phisher): opeta henkilöstö tunnistamaan ja ilmoittamaan huijausviestit.
Tutustu käyttötapauksiin tavoitteen ja toimialan mukaan
Vertaa kyberturvallisuus- ja tekoälykoulutusmuotojamme
Tutustu koko Brain Securityn interaktiiviseen tuotevalikoimaan
Keskustele tarpeistasi tiimimme kanssa (demo ja käyttöönotto)

Information

CGV

Your cookie settings and all our legal documents.

Terms of Service · Privacy policy · Cookie policy · Legal notice