Award-Winning Cyber Security Awareness Campaign

Most cyber security awareness campaigns are forgettable by design, a PDF, a mandatory e-learning module, a poster in the officekitchen. This one was built to be anything but.

In 2017, as Senior Digital Communications Lead at Xoserve — the UK's central gas data organisation and a National Grid division holding records for the entire UK gas industry — I was tasked with running a month-long cyber security awareness campaign for the whole company. The stakes were real so the approach had to match.

Rather than defaulting to warnings and checklists, we built a whole new world around the threats themselves. A three-part mini-series brought cyber villains to life as comic book characters in a Marvel-inspired universe, with scenarios that played out in the real office environment week by week, blurring the line between story and reality in a way that genuinely got people paying attention. The campaign ran across digital signage, internal comms, interactive training sessions and free giveaways, before culminating in a live fake phishing email sent across the entire company to put everything to the test.

The results were measurable and significant. Six months later, when National Grid deployed a phishing test across all its divisions, Xoserve recorded a lowest wrongful click rate of just 3%, against a benchmark of 15% or below being considered a success. We didn't just meet the standard, we set it across the entire group.

The campaign was shortlisted for three industry awards and won the Real IT Award for Innovation in Cyber Security Awareness, voted for by leading IT professionals across the UK, beating entries from Pepsi, Virgin and beyond.