How can you use peer pressure to enforce secure behavior? Have you ever tried/observed successful examples of this or similar tactics?
Sort by:
Security awareness programs often struggle because they rely on individual compliance rather than team accountability. By turning security into a friendly competition, organizations can use positive peer pressure to reinforce good behavior. One effective approach is a Security Team Challenge, where employees work in teams to complete security-related tasks and earn points. Activities like passing phishing simulations, reporting suspicious emails, enabling MFA, and attending security training all contribute to a team’s score. A live leaderboard keeps the competition visible, and teams naturally encourage each other to improve one wants to be the weak link. This approach taps into social accountability, making security a shared responsibility rather than just an IT mandate.
To keep engagement high, teams can compete for meaningful incentives, such as extra PTO, team outings, or security gadgets like YubiKeys. Spot prizes for active participation add an element of randomness, preventing early dropouts. This method isn’t just theory—tech companies like Google and Microsoft have used similar gamified security programs to drive adoption of best practices. The key is reinforcing security as part of daily operations in a way that’s fun, engaging, and self-sustaining. By combining gamification with peer accountability, organizations create a culture where security isn’t just required—it’s something employees actively want to improve.
We have multiple programs in place that focus on this:
1. We have a quarterly "Angler" (fishing people get that term) recognition effort where we pick the top five employees who spot a phishing email, acknowledge them to their manager, their top exec, and also send them a polo shirt from our company store.
2. We just starting recognizing our top "agile" developer team based on best defect density score and we sponsor a team lunch for the winning agile team for the quarter
3. We share department stats at one of our management committee meetings showing how many exceptions each group has and their drawdown rates. This is grouped by CEO direct reports and the stats associated to each group which allows them to see where they compare to other executive teams.