The Hook

Hook lets participants experience a social-engineering attack while staying firmly within fiction. In teams, participants create short trapped messages, then analyse them with clue and reflex cards. The game shows that the best traps exploit credible situations and ordinary human levers. It is designed for business teams, managers, newcomers and security champions.

Walkthrough

1. 1

   Welcome and frame

   8 min

   Present the aim: understand the mechanisms, not trap colleagues. Read the ethical frame. Form tables of 4 to 8, then two sides per table. Hand out the decks and materials without explaining all the cards yet. “Today, we are playing with fictional traps so we can better recognise them in real life. No one is being tested, and no message leaves the room.”

   Tip — Emphasise the fiction: it frees creativity without creating discomfort.

2. 2

   Discover the cards

   7 min

   Have participants quickly read each card type. Show a simple combination: target, channel, levers, clues, reflex. Answer rule questions. The attacking sides take the Message Sheet; defenders keep the clues and reflexes visible. “Attackers look for plausibility. Defenders look for reasoning: why do I believe it, why do I doubt it, what should I do next?”

   Tip — Do not over-explain: the first round is also a learning round.

3. 3

   Round 1

   10 min

   Attackers draw 1 target and 1 channel, choose 2 levers, or play 1 genuine card. They write in 6 minutes. Defenders have 3 minutes to decide and argue. Take 1 minute to validate points. “Defenders, give a clear verdict, then explain which levers, which clues and which reflex you keep.”

   Tip — Cut long debates short: note disagreements for the debrief.

4. 4

   Round 2

   10 min

   Run a full new round with new target and channel cards. Attackers can change style or try a genuine bluff. Defenders must limit their clues to 3 and choose one priority reflex. “This time, look for the most useful signal, not the greatest number of suspicions.”

   Tip — Remind players that too many clues kills the analysis: relevance is rewarded.

5. 5

   Swap roles

   2 min

   Ask the sides to swap roles and materials. Update the scores on the grid. Shuffle used cards back into their decks or set them aside if you prefer to avoid repetition. “You will now see the other side: creating a trap helps you understand why it can work.”

   Tip — Keep a brisk pace to preserve energy.

6. 6

   Round 3

   10 min

   The new attackers play a full round. Encourage a short, credible message, not a caricature. Defenders give verdict, levers, clues and reflex within the time limit. “The most dangerous trap is not necessarily spectacular: it often looks like normal work.”

   Tip — Value understated messages: they trigger better discussions.

7. 7

   Round 4

   10 min

   Play the final round. Be strict on timing. At the end, ask attackers to reveal the levers and any genuine card. Validate the points immediately with the Score Grid. “Final round: your goal is to justify your decision, not guess at random.”

   Tip — If a table gets stuck, ask: “What would you do on Monday morning with this message?”

8. 8

   Scores and key messages

   5 min

   Calculate the defence and attack scores. Congratulate both roles. Bring out 3 key messages on the board: no one is immune; reporting quickly matters more than getting everything right; verifying through another channel is central. “A good result is not never having doubts. It is knowing what to do when you do doubt.”

   Tip — Do not let victory overshadow learning: both sides have created value.

9. 9

   Debrief

   10 min

   Facilitate a discussion using the Feel, Understand and Transfer questions. Ask for generic examples, without naming real people. End with a simple commitment: the reflex each person wants to apply. “We will now turn the game into useful everyday actions.”

   Tip — Reframe answers as observable behaviours: verify, report, ask, slow down.

Variants

• Remote version : Use a shared board with the cards in columns and virtual rooms per table. Attackers write in a hidden area, then copy the message to defenders. The timer remains visible.
• Large group : For 18 to 24 people, play at 3 or 4 tables. After the rounds, ask each table to share a credible trap and the reflex that would have neutralised it.
• Cooperative mode : Remove the attack score. Each table tries to reach 20 defence points in 4 rounds. Useful for groups sensitive to competition.
• Procedure focus : After each round, add one minute: participants name the internal procedure involved or the person to contact, without using real names.