BadgerQuest makes security-awareness training a quick daily game: one scam to judge, a short set of questions each week, and a streak you don't want to break. It's built so the habit of catching a scam actually forms, instead of a video watched once and forgotten.
Free for individuals · Teams from $4 CAD per person a month · month to month
Most breaches involve a person, not just a system: Verizon's 2026 Data Breach Investigations Report puts it at 62% of more than 22,000 confirmed breaches. A once-a-year course can satisfy the audit, but a lasting reflex comes from repetition and reward, not a 45-minute video watched at double speed. See the evidence for your sector.
A short daily habit anyone can keep, not an annual slog nobody remembers.
A new phishing email, scam text or phone call every day keeps the reflex warm, instead of one module a year.
Little and often is how memory is built. The spacing effect, made into a game.
Every question is a real scam in plain clothes: a lure, a choice, and the reason it matters. Tap the answer you'd give.
Your “boss” texts from an unknown number: “In a meeting, I need you to grab $500 in gift cards now, I'll explain later.”
A text says: “Unusual sign-in on your account. Confirm it's you,” with a link to log in.
A couple of minutes a day, wrapped in a light medieval story that gives people a reason to come back tomorrow.
A fresh suspicious email lands each day. Spot the tell and report it, or learn from the miss.
A short “what's the safe move?” set each week, drawn from the threats that target their role.
Ranks, XP, badges for showing up, and a weekly company board give the day a reason to matter.
A serialized story unfolds a chapter at a time, at each person's own pace.
Badges reward showing up. A streak is a chain nobody wants to be the one to break.
A weekly company board ranks everyone by the XP they earned. Play solo and you climb divisions instead, promoted or relegated each week. Friendly rivalry does the nudging.
Miss more of one scam type and you see more of it. Practice meets each person where they slip.
A self-paced story gives tomorrow a hook, so someone back from vacation picks up their own chapter.
The game is the hook. Underneath it is one dashboard for the person who has to answer for human risk.
A live risk grade per person and per team, built from what they actually do, not just attendance. See which departments are exposed, feed real practice events to your security team, and hand auditors the evidence, without the box-checking course.
And a stance: we never ambush your staff. No fake phishing sent to real inboxes or phones, no gotcha metrics, no one shamed for a wrong call. Every challenge, email, text message or phone call, happens inside the game and is clearly labelled. Nothing is deducted for a wrong call, and what the score rewards is judgement: spotting the forgery and letting the genuine message through.
Nobody wants another island. People get in from the directory you already have, and what comes back out goes where your team already looks.
Single sign-on through your own identity provider, or a passkey, or a code from an authenticator app. Owners can require the stronger ones for everybody.
Let your directory create and remove accounts, prove your domain with a DNS record, import a spreadsheet, or just send invitations. Combine them.
A pollable stream of what people did in practice, labelled as practice on every single record so nothing can be mistaken for a live incident.
Roster, completion, and risk scores over a read-only API, one company per key, into whatever reports on it. Or take a CSV.
Register a URL and get a signed message the moment somebody finishes training, joins, or falls for a forgery. Signed so you can prove it came from us.
A fake tax notice only teaches something if it is the tax office your staff would actually hear from. Set the country per person, so a team in Munich is not sent Canadian ones.
Watched once, forgotten by lunch.
A couple of minutes a day, remembered because it's played.
A characterization of the typical legacy model; specific vendors vary. The point isn't being cheaper, it's that training only helps if people keep doing it.
The scams that hit a company are the same ones that hit a family: a panicked text, a fake invoice, a caller who needs something right now. BadgerQuest is free, forever, for individuals, so you can build the reflex for yourself and the people you look out for.
A short daily round anyone can keep. Free to play, nothing to install, nothing to pay.
The moves scammers reuse everywhere: fake invoices, gift-card asks, “your account is locked” texts, the caller who rushes you.
If a message or call pressures you to act, stop. Hang up and call back on a number you already trust. That one habit stops most of it.
A free plan to try everything, honest per-person pricing to roll it out to a team, and a custom tier when you need enterprise controls.
Free forever for individuals. The instinct that catches a phishing email is the one that catches a scam phone call at home, worth having for the people you care about too.
The full program for a team: unlimited practice plus the manager dashboard.
For larger organizations and the MSPs who run them: the controls, integrations and support an enterprise program needs.
Yes. It is free forever for individuals, with no credit card. Teams are $4 CAD per person a month, no minimum, billed monthly, cancel anytime.
A couple of minutes. One scam to judge, a phishing email, a text message or a phone call, and you are done. Once a week there is a short set of questions on top. It is built to fit a coffee break, not eat your afternoon.
Deliberately not, and it is a stance, not a gap. BadgerQuest is a practice ground: every challenge happens inside the game, clearly labelled, and nobody is shamed for a wrong call. Ambush tests teach people to fear the security team; daily practice teaches them to spot the scam. Your risk scores and completion records come from what people actually do in training, honestly labelled as practice.
No. BadgerQuest runs in any browser, on your phone or your computer. Nothing to download, no plugin, no admin rights.
Annual training is watched once and forgotten. BadgerQuest is a couple of minutes a day that adapts to each person's weak spots, and gives managers a live human-risk score per person and per team, not just a completion percentage.
We keep only what is needed to run your training, and you can export or delete your data at any time from your settings. Our Privacy policy has the details.
Start a team and invite people by email, one at a time or by importing a list. Each invite is tied to that person's address, so a link cannot be forwarded to someone you did not invite. If you verify your domain, colleagues who sign up on it join automatically. You get a manager dashboard with a live risk score per person and per team, month to month, cancel anytime.
Yes. The instinct that catches a phishing email is the same one that catches a scam phone call at home. Individuals play free, so you can build the reflex for yourself and the people you look out for.
Start free and see the first streak form before you spend a dollar.