36 ISTE-aligned missions covering passwords, phishing, privacy, AI deepfakes, IoT security, encryption, network security, AI bias, cloud safety, and more — for grades 3 through 12. Plus 3 advanced Cyber Labs and a live Competition Arena. Teacher dashboards, real-time progress reports, and classroom codes included. Trusted by pilots across 4 active districts.
Beginner missions build foundational literacy (grades 3–6). Intermediate missions add interactive labs and social engineering scenarios (grades 6–9). Advanced missions tackle AI threats, encryption, network security, cloud safety, and AI ethics (grades 8–12). Teachers assign specific missions to align with their pacing guide.
Password strength, dictionary attacks, and the danger of reuse — the foundation of account security.
Identify fake urgency, spoofed senders, and deceptive links before clicking.
What counts as personal information, how apps collect data, and how to reduce your digital footprint.
Digital permanence, stranger danger, and safe social media settings for kids.
Viruses, ransomware, spyware, and trojans — how they spread and how to avoid them.
Live inbox with 8 real-looking emails. Hover to reveal true domains. Make Trust/Report calls.
5 password challenges with a live entropy meter. Build passphrases, crack dictionary attacks, earn hints.
3-scene lab: why passwords fail, setting up 2FA, and a dramatized SIM-swap attack.
Navigate a robocall IVR and SMS scam texts based on real FTC-reported scripts. Branching decisions, real consequences.
Geotagged photo analysis, social profile privacy audit, and location-sharing risk quiz.
Classify cyberbullying scenarios, practice bystander responses, walk through platform reporting.
Spot AI-generated images by artifact analysis, classify voice clones, detect AI chatbot manipulation.
Audit 6 smart devices, spot rogue Wi-Fi networks at an airport, identify what's risky to say near a smart speaker.
Inspect a public social profile for identity theft vulnerabilities, classify real attacks, and complete 6 account-hardening actions.
Filter predator friend requests, reject in-game scam trades, and handle voice chat situations with strangers.
Classify AI voice clone calls, spot deepfake videos by technical artifact analysis, flag AI companion bot escalation.
Change default IoT passwords on 6 devices, audit smart speaker permissions by least-privilege, triage connected toy risk profiles.
Classify 6 video clips as synthetic/real/unverified, identify 5 AI voice clones vs real voices, verify 6 screenshots for fabrication.
AI-powered manipulation tactics: chatbots building fake emotional relationships, AI-generated urgency scams, deepfake voice calls from "grandparents," AI writing fake reviews, and recognizing when an online "friend" might be automated.
Identify cyberbullying patterns across 5 scenarios, apply platform reporting tools, support a targeted classmate without becoming a bystander, and understand the difference between conflict and harassment.
Classify 5 video clips as real or AI-generated, spot facial artifacts and unnatural blinking, verify a viral image with reverse image search, and identify the three questions to ask before sharing any shocking media.
Upgrade 5 weak passwords to passphrases that crack-resist for centuries, set up a password manager with a master passphrase, audit saved passwords for reuse, and run a breach-check to find exposed credentials.
Spot 5 fake SMS messages: a fake bank alert with a phishing link, a package-delivery smish, a prize-winner scam, a fake school emergency, and a multi-step smish that escalates to a voice call. Flag every red flag before clicking.
Discord Nitro DM scams, fake Roblox moderators asking for passwords, V-bucks generator URL spoofing, online identity verification, and hands-on 2FA setup with an authenticator app.
Watch a credential-stuffing attack fail against 2FA, compare SMS vs TOTP vs passkey security, configure a fake authenticator app by scanning a QR code, survive an MFA fatigue push-bombing attack at 3am, and secure recovery codes for account recovery.
Pretext IT calls, impersonation attacks, tailgating at school entrances, authority manipulation targeting kids, and a Boss Battle multi-vector con artist combining three techniques at once. The human attack surface — where most real breaches start.
Trace a port-scanning probe from inside the building, block suspicious connections on a home router, read a firewall log to find the intrusion-blocking rule, map an office attack surface by counting open ports, and lock down an open Wi-Fi access point.
Manually decode a Caesar cipher, compare symmetric AES keys to public/private key pairs, spot whether a website is using HTTPS, pick the most secure messaging app for a private conversation, and see data intercepted over unencrypted HTTP on a coffee shop Wi-Fi.
Spot bias in a hiring AI's training data, trace why facial recognition misidentifies darker-skinned faces at 34x the error rate, flag a proxy variable smuggling racial bias into a college admissions tool, and redesign a loan-approval training pipeline to reduce disparate impact.
Spot a prompt injection hidden in an email hijacking an AI assistant, identify a jailbreak using roleplay framing, flag PII accidentally shared with a commercial AI, choose the right homework AI-disclosure, and fact-check an AI-generated essay.
Lock down a Google Drive folder accidentally set to "anyone can edit," review an OAuth request for over-permissive scopes, trace a data leak to a forwarded share link, evaluate a free overseas cloud service for school records, and secure a shared cloud account with 2FA.
What happens when you post something online? Join Pixel the Robot to learn about digital permanence, the difference between public and private information, and how to think before you post. Simple, animation-friendly scenarios for the youngest learners.
Help Kali the Cyber Cat build super-strong passwords using the Picture Password Trick. Three challenges covering what makes a password strong, why you never share your password, and how to remember it using silly picture-words.
Zoom the Cyber Puppy needs help navigating pop-ups, downloads, and messages from strangers. Three decision-tree scenarios teach young students when to stop, ask a trusted adult, and why that is always the right move.
Every app asks for permissions — camera, microphone, location, contacts. Put on your detective hat and evaluate four real permission requests: a flashlight app that wants contacts, a map needing location, a game asking for your mic, and a calculator requesting camera access. Which are legit?
Spot clickbait headlines, evaluate source credibility, apply lateral reading (checking multiple sources), and decide whether to share a story before verifying it. Four investigations that build lifelong media literacy skills for elementary students.
After completing missions, students unlock Cyber Labs — 40–50 minute deep-dive exercises where they work with real systems, not toy scenarios. This is the advanced tier.
Analyze real email headers, trace the sending server, and build a filter rule that would have blocked the attack. 5 escalating cases.
Configure a firewall, triage live alert logs, and block an AI-assisted intrusion in real time. The attacker adapts — static rules aren't enough.
Craft prompt injection attacks against a sandboxed AI model, run deepfake detection classifiers, and work through 3 AI ethics scenarios. For grades 10–12.
The Arena adds competitive pressure to cybersecurity training. Schools compete on mission completions, lab scores, and daily challenge streaks — in real-time brackets or async season formats. District admins see all schools compete in a single rollup view.
Every mission maps to one or more ISTE Standards for Students. Curriculum directors can use this table to verify alignment with district technology and digital citizenship requirements. Full alignment documentation with state-specific framework mappings available on request.
| ISTE Standard | Strand | Missions That Address It |
|---|---|---|
| 2a — Digital Citizen Cultivate and manage digital identity and reputation. |
Digital Identity & Rights | Password Fortress Social Savvy Password Fortress Interactive Two-Factor Fortress Gaming Account Guardian |
| 2b — Digital Citizen Engage in safe, legal, and ethical behavior in digital environments. |
Safe & Ethical Behavior | Phishing Pond Privacy Shield Social Savvy Privacy Guardian Cyberbullying Defender Gaming Account Guardian Social Engineering Sentinel |
| 2c — Digital Citizen Manage personal data and digital footprint with security awareness. |
Digital Security | Password Fortress Malware Maze Phishing Inbox Detective Cyberbullying Defender AI & Deepfake Detective Gaming Account Guardian Social Engineering Sentinel |
| 2d — Digital Citizen Manage personal data; evaluate authenticity of digital information. |
Critical Evaluation | Phishing Pond Privacy Shield Phishing Inbox Detective Scam Spotter Privacy Guardian AI & Deepfake Detective Social Engineering Sentinel |
| 1.2.d — Digital Citizen Understand how AI-generated content can deceive and how to evaluate it. |
AI & Synthetic Media Literacy | Deepfake & AI Scam Defender Smart Device & IoT Defender Synthetic Media Detective |
| 2.2a — Digital Citizen Safe, legal, and ethical behaviors with connected devices. |
IoT & Connected Device Safety | Smart Device & Public Wi-Fi Defender Gaming Safety Defender Smart Device & IoT Defender |
| 2.2b & 2.3a — Digital Citizen Manage personal data to maintain digital privacy and prevent identity theft. |
Identity & Privacy Management | Identity Theft & Digital Footprint Defender |
| 2.4a — Digital Citizen Demonstrate empowered learning by recognizing manipulation in digital spaces. |
Empowered Online Behavior | Gaming Safety Defender |
| 3b — Knowledge Constructor Evaluate the accuracy, perspective, and relevance of digital information. |
Evaluating Digital Information | AI & Deepfake Detective |
| 1.3.b — Knowledge Constructor Curate information from digital sources including AI-generated content. |
Curating AI-Generated Content | Deepfake & AI Scam Defender Synthetic Media Detective |
| 2.5a — Computational Thinker Apply systems-thinking to analyze how devices create interconnected attack surfaces. |
Systems Thinking & Security | Smart Device & Public Wi-Fi Defender Smart Device & IoT Defender |
| 3.3a — Knowledge Constructor Curate personal data with an understanding of digital permanence. |
Digital Permanence & Curation | Identity Theft & Digital Footprint Defender |
ISTE Standards for Students 2016/2023 framework. See full standards alignment — ISTE, CSTA, GenCyber, NICE, and 10 state mandates →
The teacher portal is live today — no waitlist. Explore it with sample data at /teachers/demo before your pilot starts.
Generate a unique CYBER-XXXX join code per class. Students join from any browser — no app install, no email required, no IT ticket.
See every student's username, level, XP, badges earned, and current mission status. Add or remove students without disrupting their progress.
Per-mission completion bars for the whole class. Most-missed questions surface where the class is struggling — pinpoint the concept before the next lesson.
Real-time stream of every mission start and completion across your classrooms. See who just earned a badge without refreshing.
One-click CSV export of the full roster with XP, level, mission completions, and badges — paste directly into your gradebook or district reporting tool.
Students earn a shareable completion certificate per mission. Teachers can reference certificates as evidence of learning objectives met.
The Family plan unlocks all 18 missions for home use. Parents get weekly progress digests and shareable certificates — no screen time fights about whether kids are "actually learning."
A weekly summary of your child's XP earned, missions completed, and badges collected — delivered to the parent email. No login required to stay in the loop.
Kids create a hero identity — username, emoji avatar, no real name required. XP and badges accumulate across all 18 missions. Levels 1–10 to chase.
Every completed mission generates a personalized certificate with the student's hero name, mission title, and date. Share to a class presentation, print for a portfolio, or post to a digital badge wallet.
Pilot districts pay nothing. After the pilot, district pricing scales down with volume.
Fill in your district info and we'll be in touch within 1 business day to schedule a walkthrough and set up your first classroom.
We're currently running pilot programs across 4 districts. Pilot participants get early access to new missions, direct input on the roadmap, and discounted post-pilot licensing.
Testimonials from pilot teachers coming as pilots mature — expected Q3 2026. Reach out directly to our pilot contacts at pilots@cyberheroeshq.com.
8+ states added K-12 cybersecurity mandates in 2023–24. We've pre-built alignment documents for 10 mandate states — specific framework codes mapped to each mission.
Request a pilot — free for the 2025–2026 school year. We'll have your first classroom running within 10 minutes of your first teacher account.