Welcome to

An escape room challenge

presented by

Phish or Flee. An Escape Room Challenge. Can you stop the breach and escape Vandelay?

Title screen. The Vandelay Industries security office at night: a desk lamp, a Vandelay Industries mug, a Security Operations Playbook, a desk phone reading Vandelay Security Ops, a note reading Trust but verify, the Vandelay Industries emblem on the brick wall, and threat dashboards glowing above the city skyline.

Incident Briefing. Active data breach. The suspect is Newman. A data breach at Vandelay Industries has been traced to careless data handling. Newman is exploiting weak security practices throughout the building. Your mission is to secure each compromised area and contain the breach. Known associate: Kramerica Industries.

Incident briefing screen. A surveillance still labelled CAM 07, recording, shows Newman in his postal uniform in a dimly lit room with two other figures behind him. The header carries the Vandelay Industries emblem and an active data breach warning, and a footer strip reads confidential, clearance level red.

Floor Directory

Four Workspaces. One Breach.

Mission Status

Escape the Breach

A realistic employee workstation: a monitor showing an inbox of suspicious emails, a desk lamp, a keyboard and mouse, a Vandelay mug and a sticky note reading Trust but verify.

Room 1

The Inbox

Unlocked

A secure records bay: colour-coded folders labelled Confidential, Internal and Public above a filing cabinet, binders on the shelf and a Secure placard listing classify, store and protect.

Room 2

Data Handling

Ready

A front-desk bay: a Vandelay visitor badge reading Visitor, Welcome hanging from a blue lanyard beside a framed Vandelay Industries import and export seal, above a desk holding a phone, a notepad and pen, a tablet on a stand, a Vandelay mug and a potted plant.

Room 3

Physical & Social Engineering Security

Ready

A security operations bay: an Incident Command whiteboard listing detect, analyze, contain, eradicate, recover and report, beside threat dashboards, a laptop, a radio and a desk phone.

Room 4

Incident Reporting

Ready

Preview of the email inbox - click to begin

Check before you trust. Each mission earns you a digit — write it down.

Let's get started — click the email to open it.

The Inbox · Decision 1 of 3: inspect before you click

Vandelay Industries workstation: a desktop monitor on a wood desk with a keyboard, mouse, desk lamp, plant, pen holder, a note reading Think Check Protect, and a Vandelay Industries mug.

M

Microsoft Account Security <security@micr0soft-support.com>

to jordan.miller@vandelayindustries.com

Action Required: Verify Your Microsoft 365 Account

Security Alert

Hello Jordan,

We detected unusual sign-in activity associated with your Microsoft 365 account on July 30, 2026. As a precaution, access to Outlook, Teams, and OneDrive may be temporarily limited until your identity is verified.

Please verify your account within the next 24 hours to prevent any interruption to your Microsoft 365 services.

If you do not recognize this activity, verifying your account will help secure your account and prevent unauthorized access.

If you have already completed this verification, no further action is required.

Thank you,

Microsoft Account Security Team

Is this email legitimate or suspicious?

7

Digit 1 of 3 unlocked
Write it down!

Follow-up · identify the indicators

Which indicators tipped you off? Select all that apply.

Sender address doesn't match the real company domain Message creates urgency or a tight deadline Hovering the button reveals a link that isn't really Microsoft's Email includes the company logo

The Inbox · Decision 2 of 3: inspect before you click

I

IT Help Desk <itsupport@vandelayindustries.com>

to jordan.miller@vandelayindustries.com

Monthly Password Policy Reminder

Hi Jordan,

As part of our monthly reminder, please review Microsoft's official password guidance to keep your account secure.

Read more: learn.microsoft.com/security/passwords https://learn.microsoft.com/security/passwords

No action is required. This is a routine reminder sent to all employees.

Thanks,

IT Help Desk

Information Technology · Vandelay Industries

ext. 4200 · itsupport@vandelayindustries.com

Is this email legitimate or suspicious?

3

Digit 2 of 3 unlocked
Write it down!

Follow-up · identify the indicators

What confirms this one is actually safe? Select all that apply.

Sender address matches the real company domain The link goes to a real Microsoft resource page The message doesn't ask for a login, password, or personal info The message creates urgency or a tight deadline

The Inbox · Decision 3 of 3: three links, only one is safe

B

Benefits Enrollment <benefits@vandelayindustries-hr.net>

to jordan.miller@vandelayindustries.com

Action Needed: Confirm Your Benefits Selections

Hello Jordan,

Open enrollment closes soon. Choose one option below to review or confirm your selections:

Option A: Review Benefits https://vandelayindustries-hr-benefits.net/login

Option B: Confirm Selections https://benefits.vandelayindustries.com/confirm

Option C: Update Dependents https://vandelay-benefits-update.info/dependents

Thank you,

Benefits Enrollment Team

Human Resources · Vandelay Industries

ext. 3100 · benefits@vandelayindustries.com

9

Digit 3 of 3 unlocked
Write it down!

Follow-up · identify the indicators

Which other option(s) had a mismatched domain? Select all that apply.

Option A Option B (the one you chose) Option C

The Inbox. You followed the link in the email. This is the training result page.

You’ve Been Phished!

This is a training simulation — nothing was actually submitted.
In a real attack, a page like this would try to steal your login credentials.

You clicked a link to:

The Tell

The Inbox. You followed the link in the email. This is the destination it actually opened.

Your Current Selections

MedicalVandelay Blue Choice PPOEmployee + Family

DentalVandelay Dental PPOEmployee + Family

VisionVandelay Vision PlanEmployee + Family

Room 4 of 4. Incident Reporting. Review the suspicious message and complete the reporting protocol.

Room 4 of 4 · Incident Reporting

Review the suspicious message and follow the reporting protocol

Goal: avoid interacting with the message, choose the correct reporting path, and complete the report.

Protocol Progress: 0/3

Vandelay Secure Mail Training Simulation · Room 4

Immediate Password & Payroll Verification Required

From: Payroll Security Center <security@micr0soft-payrollverify.com>
To: You
Sent: Today, 8:14 AM
Subject: Immediate Password & Payroll Verification Required

Dear Employee,

We detected unusual activity in your payroll profile and your account may be suspended today unless you verify within 30 minutes. Use the secure payroll portal below to confirm your password and employee ID now.

https://microsoft-payrollverify-secure-login.com/update

After you complete verification, purchase two $200 gift cards for the remote onboarding team and reply with the codes so payroll can release your next direct deposit.

If you cannot access the link, open the attached file and submit the requested information there. Do not delay, as failure to comply may interrupt payroll processing.

HTM

Payroll_Update_Form.html

HTML file · 182 KB

Reminder: If a message seems suspicious, do not click links, do not open attachments, do not reply, and do not forward it casually. Report it to IT/Security or your dedicated reporting mailbox as quickly as possible.

Click the suspicious parts of the email for coaching, then complete the reporting protocol.

Interactive Workflow Step 1 of 3 Safest first action

Room 4 secured.

You reported it the right way — without ever touching the link.

This operations console is built for a larger screen — turn your device sideways or open it on a laptop for the full view.

Room 4 of 4 complete. You reported the incident successfully and the threat was contained. You did not interact with the malicious content, you sent the report to Security through the right channel, and you provided the incident details that matter. Room 4 is secured. George Costanza, Head of IT Security, says you handled that incident like a security pro, and that is how we keep Vandelay Industries safe.

Room 4 of 4, Incident Reporting, complete. George Costanza stands in the Vandelay Industries Security Operations Center giving two thumbs up, in a brown tweed jacket and patterned tie. Behind him the threat dashboards show two active alerts, five incidents today and all systems operational, with an email security gauge at ninety-two percent safe and an incident queue. Wall signs read Security Operations Center, Incident Response, and Our Mission with detect, analyze, respond and protect. The right panel reads Room 4 Complete, Excellent Work, with George's message, Threat Contained, three confirmed outcomes, Access Granted and a Continue to Floor Directory action.

This operations console is built for a larger screen — turn your device sideways or open it on a laptop for the full view.

Room 2 of 4. Data Handling. Challenge 1 of 3: classify the documents.

Room 2 of 4, Data Handling, Challenge 1. The Vandelay Industries secure records office at night. The Vandelay Industries import and export seal hangs on the brick wall above a green Records Secured panel, with archive shelves of labelled boxes behind. A desk lamp lights a box marked Authorized Personnel Only, a tray marked Pending Review holding Vandelay files stamped To Be Reviewed, and a clipboard holding a Classification Guide that lists Public, Internal and Confidential.

Classify the documents

Sort each record as Public, Internal, or Confidential.

Classified: 0/3

Record 01

Vandelay Summer Picnic

“Join us for food, games and fun! All employees and families welcome.”

Record 02

Internal Department Meeting Notes

Project updates, next steps, and team assignments for the department.

Record 03

Employee Payroll Report

Sensitive payroll information for all Vandelay Industries employees.

Read each record carefully and choose the most appropriate classification. Click one option for each record.

This records workstation is built for a larger screen — turn your device sideways or open it on a laptop for the full view.

Room 2 of 4. Data Handling. Challenge 2 of 3: secure sharing.

Room 2 of 4, Data Handling, Challenge 2. The Vandelay Industries secure communications and file transfer station at night. The Vandelay Industries import and export seal and the words Vandelay Industries, Secure Records Division sit above a Secure Communications Protocol placard listing verify, authenticate, encrypt, transfer and log and monitor. A steel console holds a secure desk phone, a monitor showing a Secure File Transfer System with an encrypted connection shield, and a second monitor showing an incoming request from Newman. An access-controlled door marked Authorized Personnel Only and a lit server rack stand behind.

Secure sharing

Decide how to handle Newman’s request.

Incoming request

Newman Personal email

Newman needs the employee payroll report. He asks you to send it to his personal email because he “can’t get into the company system.”

Record requested

Employee Payroll Report

Confidential Classified in Challenge 1.

Decision

What should you do?

This records workstation is built for a larger screen — turn your device sideways or open it on a laptop for the full view.

Room 2 of 4. Data Handling. Challenge 3 of 3: confidential printout.

Room 2 of 4, Data Handling, Challenge 3. The Vandelay Industries secure printing station at night. The Vandelay Industries import and export seal and the words Vandelay Industries, Secure Records Division sit above a Secure Printing Protocol placard listing verify, authenticate, review, print securely and dispose or store responsibly. A large multifunction printer holds a printed Employee Compensation Report stamped CONFIDENTIAL in its output tray, beside a locked bin marked Confidential Disposal Only, Shred slash Recover Securely. An access-controlled door marked Authorized Personnel Only leads to a corridor.

Confidential printout

Decide what to do about a document left at the shared printer.

Unattended document · Shared printer

Employee Compensation Report

Left in the output tray

You walk past the shared printer and notice a confidential Employee Compensation Report, stamped CONFIDENTIAL, that Newman printed earlier and left behind.

Decision

What should you do?

This secure printing station is built for a larger screen — turn your device sideways or open it on a laptop for the full view.

Data Security Terminal. Enter the three digits you earned to secure Room 2.

Room 2 of 4, Data Handling. The Vandelay Industries Secure Access Terminal at night. A vault door with a spoked handle and a lit access keypad stands behind a steel workstation holding a security monitor, a Vandelay mug, a pen cup and binders labelled Personnel Records, Financial Records and Security Logs. On the wall are the Vandelay Industries import and export seal, a Secure Access Terminal sign for Room 2 of 4, a Security Protocol placard listing verify your identity, confirm access code, unlock secure door and log access for auditing, and a Protect Sensitive Data poster. A desk plate reads Data Integrity Is Our Priority, Security Is Our Promise. A dark Secure Records Division panel fills the right side.

Security Terminal

Each challenge revealed one digit. Enter the three digits, in order, to secure the room.

This records terminal is built for a larger screen — turn your device sideways or open it on a laptop for the full view.

Room 2 complete. The records room has been secured.

Room 2 of 4, Data Handling, complete. The Vandelay Industries secure records office at night. On the desk, the Confidential and Employee Files binders are now closed, stacked and wrapped in a band stamped SECURED, with a padlock resting on top. Behind them the workstation sits idle, its monitor dim, beside a keyboard, mouse, desk lamp and plant. A wall panel shows a steady green lamp labelled Records Secured, below the Vandelay Industries import and export seal, with the night city visible through the window blinds. Headline text on the wall reads: Data Handling Complete. Room 2 Secured. Newman's trail ends here.

Public data identified

Internal data protected

Confidential data secured

Unapproved sharing blocked

Printed record recovered

Room 2 Code

–

This records terminal is built for a larger screen — turn your device sideways or open it on a laptop for the full view.

Room 2 complete. The records room is secured and George Costanza, Head of IT Security, approves.

Room 2 of 4, Data Handling, secured. George Costanza stands at the desk in the Vandelay Industries secure records office at night, in a red plaid shirt, raising a fist in approval. Beside him on the wood desk sit the closed Confidential and Employee Files binders, wrapped in a green band stamped SECURED with a padlock, alongside a Vandelay mug and a desk lamp. Behind him a wall panel reads Records Secured in green, below the Vandelay Industries import and export seal, with the workstation showing System Idle, Security Standby, and the night city visible through the blinds.

Data Handling Complete

Room 2 Secured!

“Payroll records sent to a personal email? That’s not security. That’s chaos!”

— George Costanza
Head of IT Security, Vandelay Industries

Public data identified

Internal data protected

Confidential data secured

Unapproved sharing blocked

Printed record recovered

Room 2 Code

–

This records terminal is built for a larger screen — turn your device sideways or open it on a laptop for the full view.

Room 3 of 4. Physical and social engineering security at the Vandelay front desk.

Vandelay Industries reception desk at night. A multi-line desk phone shows LINE 1, INCOMING CALL. An open visitor sign-in book, a badge printer, a visitor lanyard and a Vandelay mug sit on the wood desk. Behind, the Vandelay Industries import and export seal on the lobby wall, window blinds with the night city, and the secure door small and out of focus in the background.

The Vandelay Industries secure door, closed and secured, with a badge reader and keypad beside it and a plate above reading SECURE AREA, ACCESS CONTROLLED. The reception desk and phone are visible out of focus at the left, with the Vandelay Industries seal on the brick wall and the night city through the window.

Room 3 of 4 · Physical & Social Engineering Security

Completed: 0/4

Room 3 secured.

Two calls, one workstation, one tailgating attempt — zero information handed over.

This security terminal is built for a larger screen — turn your device sideways or open it on a laptop for the full view.

Room 3 complete. George Costanza, Head of IT Security, approves.

Room 3 of 4, Physical and Social Engineering Security, secured. The Vandelay Industries secure door stands open at night and George Costanza is framed in the doorway in a plaid shirt with both fists raised in celebration, lit by the warm reception lobby behind him. Beside the door the badge reader reads UNLOCKED in green above its keypad, and the reception desk with its telephone and Vandelay mug is visible at the left.

Room 3 Secured!

You handled every situation the right way. People, devices, and information are safer because of your smart choices.

✓

Credentials protected

You didn't share usernames or passwords over the phone.

✓

Remote access blocked

You recognized the scam and blocked unauthorized access.

✓

Workstation locked

You secured your session and protected company data.

✓

Tailgating prevented

You stopped an unauthorized person from entering.

Room 3 Access Code

?

This completion screen is built for a larger screen — turn your device sideways or open it on a laptop for the full view.

The Inbox · Knowledge check: clone phishing

Room 1 · The Inbox

Answer one quick question about the phishing technique you just encountered.

What type of attack did you just learn: clone phishing. Scammers create a convincing copy of a legitimate email, replacing authentic links or attachments with malicious ones. They also use an email address that closely resembles the original sender's to trick recipients into sharing sensitive information.

In a clone phishing attack, what exactly does the scammer copy — and what do they change?

Final escape: enter the 3-digit code

Each solved mission revealed one digit. Enter the three digits you wrote down, in order.

Vandelay Industries IT Security Division

Room 1 of 4 – The Phishing Inbox

Security Terminal

Enter the three digits you collected in this room.

Access granted. Room 1 complete: the door is unlocked.

Access Granted

You caught the phishing. You secured the code.

3Emails analyzed

1Knowledge check passed

3Digits collected

The door is unlocked.

Access Code Entered

Access Code

You collected all 3 digits.

All steps complete · Room 1 unlocked

-

Room 1 secured.
The door is open.

This terminal is built for a larger screen — turn your device sideways or open it on a laptop for the full view.

Room 1 complete. The Phishing Inbox has been secured.

Room 1 – The Phishing Inbox

Great Work!

You secured The Phishing Inbox and helped protect Vandelay Industries.

George Costanza, Vandelay Industries Head of IT Security, standing at his desk with a confident raised fist.

You Did It!

You secured The Phishing Inbox.

You’ve shown you can identify phishing attempts, verify safe messages, and help protect Vandelay Industries.

Key Takeaways

Check the sender and links before you click.
Verify unexpected requests through a trusted channel.
When in doubt, report it. You help keep our team secure.

Room 1 of 4, The Phishing Inbox, complete. Vandelay Industries IT Security Division. Room 1 complete: the Phishing Inbox has been secured. George Costanza, Head of IT Security, gives a thumbs up and says: Excellent work. You caught the phishing emails before I did, and that's saying something. You've shown you can spot suspicious emails, verify legitimate messages, and protect Vandelay Industries from cyber threats. Mission accomplished: you've identified phishing attempts, verified a safe communication, and proven you can spot a clone attack. Room 1 progress: mission 1 email analyzed, mission 2 email analyzed, mission 3 email analyzed, knowledge check passed, access code entered. Room 1 is complete.

Spoofed senders
identified

Links inspected
before clicking

Clone phishing
recognized

-

This terminal is built for a larger screen — turn your device sideways or open it on a laptop for the full view.

Breach contained. Newman's breach stopped, Kramerica access blocked. Newman contained, Kramerica denied, Vandelay Industries still standing. Vandelay Industries systems secure.

George Costanza, Head of IT Security, Vandelay Industries. You did it! Newman started the breach, Kramerica tried to finish it, and somehow Vandelay Industries is still standing. You spotted phishing, you protected sensitive data, you blocked social engineering, you reported the incident. The breach is contained, the systems are secure. Great work team.

Vandelay Industries · Mission Debrief

Before you go: a quick reflection

Take a moment to reflect before claiming your certificate. This isn't graded — it's for you.

What's one security risk you'll watch for more closely at work?

Which challenge made you think the most, and why?

What's one thing you'll do differently after completing this training?

Security Awareness Program

Certificate of Completion

Phish or Flee: Cybersecurity Escape Room Training

This is to certify that

has successfully completed Phish or Flee Cybersecurity Escape Room Training.

You demonstrated the knowledge, awareness, and skills to protect Vandelay Industries from cyber threats and keep our systems secure.
Great job. The system is safe because of you.

✋Phishing Identified

📁Sensitive Data Protected

🕵Social Engineering Blocked

📋Incident Reported

🛡Systems Secure

You made a difference. Thank you for helping Vandelay Industries stay secure.