A Sprinklr Case Study: Using the Art of Storytelling for Security Awareness Training
The main goal of any security awareness program is to increase employee cyber awareness and impact behavior. As security awareness professionals know all too well, the challenge is making it FUN, making it stick. At Sprinklr, we set out to do just that in a way that would be entertaining and engaging for all our 3,000+ employees around the world. We have found great success with what we created and wanted to share with the National Cyber Security Alliance community in hopes that others can do the same.
When employees think of security training they think of long, boring videos that they are forced to watch and can’t fast forward through. We wanted to create something that didn’t feel like the usual security training. Something that wouldn’t be thought of as a chore to get done. Turn the expectation of boring into interesting. Even, dare I say it, intriguing.
We are lucky to have an amazingly talented Brand team here at Sprinklr who were thrilled at the opportunity to get their creative minds moving and help us dream up a new innovative awareness campaign. The result: an episodic graphic mystery novel titled “Dash Mallet and The Case of the Secret EEPO”, complete with cybersecurity lessons woven in throughout. Working with this team and an illustrator, we were able to bring to life a 60 frame graphic novel, complete with 2 posters for promotion.
“Dash Mallet and the Case of the Secret EEPO”
After highly sensitive company information is stolen, Th!nklr Chief Technical Officer, Bhavani Dayal must enlist the help of the waffle-loving Dash Mallet: a Private Detective who seems to be from another time and place. Once Dash is on the case, he sniffs out an enigmatic villain with ties to his past and uncovers an array of security leaks that threaten Th!nklr from within. Dash and Bhavani must stop the leaks and expose the plot to destroy Th!nklr before it’s too late.
We took what was once delivered in the form of dull training courses and made it into a humorous graphic novel, using the art of storytelling to convey the security lessons we wanted employees to learn. Having recently completed an IPO, this first episode focused on data privacy and the importance of not sharing sensitive company information. After employees read through the story, we asked them to answer a few knowledge test questions to confirm they understood the security mishap and lesson to be learned.
To drum up excitement among our employees, we teased the release of the graphic novel for several weeks. There’s a part in the story where our main character, Dash Mallet, goes undercover as a new employee “Chad MacIntosh” to uncover the suspicious activity going on at the company, Thinklr. We created an email and Slack account for “Chad MacIntosh” and sent weekly cryptic emails with security tips, leaving clues that pointed to various aspects of the story. This got employees talking, “Who is Chad MacIntosh?!?” Finally, a week before launch, we released the first few frames of the story via email. A small taste of what was to come!
Once the complete graphic novel was released, Chad MacIntosh quickly and organically became our company’s security mascot, in a way. We incorporated this character in other internal communication vehicles, like our daily morning show and All Hands meeting, reminding employees to take this new, FUN security training. For our offices that are currently open, we have posters with Chad MacIntosh reminding employees to beware what they share. And when there’s a laptop left open and unoccupied, post-it notes with a message from Chad are left behind to remind the employee to be more secure.
To measure the success of our new awareness campaign, we looked at employee participation/completion (did they read the story and answer the questions), knowledge test results, and employee feedback via a short survey to gauge interest in another episode. We’re thrilled to share that the reaction from employees and leadership have been overwhelmingly positive. One month since launch, we have a 95% employee completion rate, all of which have scored a 100% on the knowledge test, and mountains of positive feedback. Employees have told us “this was a stroke of genius,” “the most fun I’ve had doing security training in a long time,” “the best security training I have ever experienced.”
Our employees have appreciated the fun, engaging spin on a typically mundane topic. And they’re talking about security, keeping it top of mind, and in time, hopefully changing their behavior. Episode 2 of our “Dash Mallet” series is in the works and will be released soon. We plan to do these quarterly, covering multiple security topics in each. While it’s too soon to tell the impact this new format of training has had on our company’s security, we’re confident that by keeping the conversation going, we will impact employee behavior and help make our company stronger.