I'm planning a full Cybersecurity Awareness Month 2026 program that I'll be presenting to our CISO for approval.

The challenge is:

• We currently have no dedicated security awareness/training platform
• Little to no budget for this initiative
• It's an older organization, while our cybersecurity department is relatively new
• Many employees are fairly old-school and unlikely to voluntarily participate in games, scavenger hunts, quizzes, etc.

I've found some great ideas around gamification, CTFs, scavenger hunts, phishing activities, and cybersecurity games, but I'm struggling to create a realistic mix that will actually work in this environment.

I don't want to spend the entire month just sending awareness emails.

If you were designing this campaign, what activities would you include?

Especially interested in ideas that are:

• Free or very low cost
• Practical without an awareness platform
• Suitable for non-technical employees
• Effective even with low voluntary participation
• A mix of passive awareness and interactive activities

Would love to hear what has actually worked in your organizations.