Free Cyber Security Games

Human Firewall: Castle Defense, Human Firewall: Tower Defense and Security Architect Simulator are free online cybersecurity games from CanIPhish, a phishing simulation and security awareness training company. In Castle Defense you grow a castle out of everyday security habits and hold off waves of scammers. In Tower Defense you place and upgrade security towers to stop phishing emails, password thieves and ransomware. In Security Architect Simulator you run a law firm's security for 24 months, choosing which real security projects to roll out before the attacks land. The two Human Firewall games have 12 waves and four boss fights each, and every game has its own top-50 leaderboard.

Yes. Every game here is completely free, with nothing to download and no account to create. They run in any modern browser. You only choose a gamer alias if your score makes the top 50 and you want it on the leaderboard.

Short, replayable games work best at work, because people can finish a run over a coffee break. Tower Defense takes about 10 minutes, and Castle Defense and Security Architect Simulator about 15. In the Human Firewall games every upgrade stands for a habit your security policy already asks for: unique passwords, multi-factor authentication, updates, backups and reporting phishing. Security Architect Simulator shows the other side: why the security team asks for them, and how it weighs protection against getting work done. Run a friendly leaderboard challenge during security awareness month, or assign the games through CanIPhish to track who has played.

Yes. The cartoon villains, plain-language tips and no-account play make them a safe pick for classrooms, coding clubs and families. Castle Defense and Tower Defense suit younger players best, while Security Architect Simulator, a workplace management sim, suits teens and older students curious about a career in cyber security. Students learn the same habits adults need, such as pausing before they click and thinking before they share. Younger kids may want a grown-up nearby to help with the reading, and nobody needs to share personal details to play.

The Human Firewall games cover six areas of personal security (identity, internet, physical, device, network and privacy) through 18 real-life habits. You'll practise using strong, unique passwords and passkeys, turning on multi-factor authentication, pausing before you click, installing updates, securing your home Wi-Fi and thinking before you share. Security Architect Simulator shows how an organisation defends itself: layers of real controls such as email authentication, multi-factor authentication, patching and phishing simulations, planning ahead for the next attack, and the trade-off between security and getting work done. Bonus questions and office decisions along the way check what you've picked up.

In a tower defense game you stop waves of enemies by placing defences along their path. In Human Firewall: Tower Defense each tower is a security area and each upgrade is a stronger habit, so winning means building layers that work together, which is exactly how good security works in real life. No single habit stops every threat.

You play the security team. Every project you can roll out is a real control, from SPF, DKIM and DMARC to passkeys, patch management and phishing simulations, and an attack is only blocked when the right layers are in place in time. Colleagues bring you everyday dilemmas, such as a supplier's new bank details or a USB stick found in the car park, and every choice comes with a lesson. It shows why good security is layered, planned ahead and balanced against productivity, which is how real security teams think.

Each game has its own leaderboard of the top 50 players of all time. When a run finishes in the top 50 you can claim your spot with a gamer alias of 2 to 15 characters. You hold one spot per game and your best run counts. Scores are checked for plausibility before they're saved, and aliases are screened to keep the board friendly.

Yes. The games run in any modern browser with 3D graphics (WebGL) turned on, and they're at their best on a laptop or desktop. On a phone, tap Play to open the game full screen. Castle Defense asks you to turn your phone sideways; Tower Defense and Security Architect Simulator play either way up.

Yes. All of these games are part of the CanIPhish training library, so you can assign them to employees, track completions, run private leaderboards and pair them with phishing simulations. You can start with a free account.

The original turn-based Security Architect and Social Engineer are still available on the Legacy Cyber Security Games page, and your saved game codes and their leaderboards keep working there. Security Architect Simulator is a new game that reimagines the original Security Architect as a real-time office sim, with its own leaderboard here.

Yes. More games are in the workshop, with new worlds and new villains built around the same everyday habits. Bookmark this page and check back soon.

No account or email is needed. When you claim a leaderboard spot, we keep your alias, your score and the run's details (how far you got, how long it took and the date), a random ID for this browser, and a scrambled code derived from your network address. That code is used only to stop one network filling the board, and it is never shown. The leaderboards are all-time, so an entry stays until it drops out of the top 50. To have an entry removed, contact support@caniphish.com. Your alias is public, so please don't use your real name.