The mission order our staff recommends for each band, foundations-first. Passwords and personal info before phishing, phishing before bullying escalation, networks and public Wi-Fi only after the basics land. Grouped by theme so curriculum directors can build a pacing guide in minutes — and print this page for offline planning.
Youngest learners — foundations in passwords and the ask-a-grown-up rule. Animations, simple decision trees.
Your password is the key to your account — and it is YOUR secret to keep. A strong first password always has three things: a color, an animal, and a number (like BlueTiger42). In this mission, you will learn who to share your password with (only a grown-up you trust, in real life — never in an app or chat), pick the strongest password from a list, build your own Super Secret Password from color/animal/number cards, lock the door on three pretend accounts to see how passwords keep bad guys out, and prove what you learned in the Super Secret Password Quiz. Pass the quiz to earn the Super Secret Password badge.
Mission details →Kali the Cyber Cat needs your help! Her accounts keep getting hacked because her passwords are too easy to guess. Help Kali build super-strong passwords using the Picture Password Trick — where you turn three silly pictures into an uncrackable secret code. Three fun challenges for Kindergarten through Grade 2!
Mission details →Did you know that when you post something online it can stay there forever — even if you delete it? Join Pixel the Robot on three adventures to learn what a digital footprint is, what is safe to share, and how to keep your private information private. Perfect for Kindergarten through Grade 2!
Mission details →Zoom the Cyber Puppy is playing online when suddenly a BIG pop-up appears saying "YOU WON A FREE PRIZE! Click here!" What should Zoom do? Help Zoom navigate three tricky online situations — pop-ups, downloads, and a message from a stranger — by choosing the smart, safe thing to do. Designed for Kindergarten through Grade 2!
Mission details →A young learner is online and mean words hit them or someone they care about. The big lesson: there is a 5-step ladder — stop and breathe, do not reply, tell a trusted grown-up in real life, block the person, and with the grown-up report the message to the platform. In Scenario 1, somebody writes "your drawing is dumb" under a picture post — what is the smartest first move? In Scenario 2, a new group chat does not include the kid and a friend says "just join anyway" — what is the best move? In Scenario 3, a friend shows a chat that says really mean things about another kid in the class — what is the kindest, smartest move? In Scenario 4, the kid reviews the ladder in order — after stopping and not replying, what comes next? The advice in all four scenes is the same: stop, do not reply, tell a grown-up, block, and with the grown-up report. Designed for Kindergarten through Grade 2 — read-aloudable sentences, large illustrated tap-cards, no typing required.
Mission details →Cipher-Jr. sees someone calling another kid a mean name in a chat. In Q1, Cipher-Jr. learns that mean words on a screen are STILL mean — same kind of hurt as words on the playground. In Q2, someone keeps sending unkind messages to Cipher-Jr., and the right first move is to do NOTHING — never reply, never engage, because replying tells the sender the words landed. In Q3, Cipher-Jr. screenshots the mean messages and then walks away from the screen to tell a trusted grown-up in real life — a parent or a teacher. In Q4, Cipher-Jr. uses the block button so the sender cannot send more, AND the report button so the platform can see the pattern. Across all four scenes, the rule is the same — recognize it, do not reply, screenshot and tell a grown-up, then block and report. Pass 3 of 4 to earn the Kind Words Champion badge and 125 XP. Designed for Kindergarten through Grade 2 — read-aloudable sentences, picture tap-cards, no typing required.
Mission details →Cipher-Jr. is filling out a fun online quiz — but it keeps asking for full name, address, school, and birthday. In Q1, Cipher-Jr. learns that "My home address" is personal information while "My favorite ice cream flavor" is safe to share. In Q2, the game says "type your school's name to claim a free prize" — and Cipher-Jr. pauses to ask a grown-up first. In Q3, a new online friend asks for a photo of Cipher-Jr.'s face — and the right answer is to say no and tell a grown-up. In Q4, Cipher-Jr. picks a privacy-safe username: "SoccerFan7" goes on the screen, "FirstnameLastname2016" stays in the password manager. Across all four scenes, the rule is the same — only favorite-color kinds of info are safe to share; everything else belongs to a trusted grown-up. Pass 3 of 4 to earn the Personal Info Guardian badge and 125 XP. Designed for Kindergarten through Grade 2 — read-aloudable sentences, picture tap-cards, no typing required.
Mission details →Foundational literacy — strong passwords, phishing spotter, privacy shield, and media verification.
The castle gates are locked tight — but they are not secure enough! Build an unbreakable Password Fortress by learning what makes a password strong, why length beats complexity, and why every account needs its own key.
Mission details →A 4th grader sits down with their family to set up a password manager for the first time. The family has a shared streaming password, the Wi-Fi router login, a school account, a gaming account, and a couple of socials that the kid considers their own. The mission walks through the five vault-owner decisions that matter: (1) what a password manager even is — a vault that holds all your logins and generates a unique strong password per site, (2) why one strong master password beats trying to remember 20 weaker ones, (3) what belongs in the shared family vault (Wi-Fi, streaming, household accounts) and what stays personal (school, gaming, private socials), (4) autofill safety — letting it fire on your own devices but turning it off on shared or family devices like a little brother's borrowed tablet, and (5) what to do if the master password is forgotten — print the recovery code on paper kept by a parent, never email it, never store it in a notes app on the same phone. Pass 4 of 5 to earn the 🔑 Password Vault Pro badge and 150 XP. Designed for Grades 3 through 5 — plain-language vocabulary, anime-inspired scenario framing, server-graded 5-question quiz with no client-side scene rendering.
Mission details →You are a 4th or 5th grader sitting at the kitchen table with a parent, setting up the family password manager for the first time. The mission walks through the five vault-owner decisions a kid can make alongside a grown-up: (1) why a password vault beats a paper notebook — the vault generates a unique per-site password so a stolen notebook only loses the master, not a copy of every reused site; (2) what a master password is — the one strong passphrase that unlocks the vault (≥4 random words + 1 number + 1 symbol, ≥16 chars total); (3) how autofill protects you from phishing — the manager checks the real site address before typing, so a fake login page gets nothing; (4) what to do if the master password is forgotten — use the recovery code once to set a new master password, never email it, never notes-app it, only paper with a parent; and (5) which credentials belong in the family shared vault vs. the kid's personal vault (shared = Wi-Fi + streaming + household; personal = school + gaming + private socials; never in shared = a gaming handle that can spend money). Pass 4 of 5 to earn the 🔐 Password Vault Pro Jr badge and 150 XP. Designed for Grades 3 through 5 — plain-language vocabulary, anime-inspired scenario framing, server-graded 5-question quiz with no client-side scene rendering.
Mission details →Cybercriminals cast bait — can you spot the hook? Learn to identify fake emails and scam links before it's too late.
Mission details →Social media can be a superpower — or a trap. Learn the rules of the digital social world and keep yourself safe.
Mission details →Your personal data is your superpower. Learn which info to protect and why sharing too much puts you at risk.
Mission details →Interactive tier — phishing inbox, 2FA, smart-device & Wi-Fi safety, bullying defender.
The Cyber Academy vault needs a new password — and you're the only hero who can build it. Watch a live crack-timer as you type, survive 5 villain challenges, and learn the passphrase technique that defeats even quantum supercomputers.
Mission details →A villain is trying to take over your account — right now. Block a suspicious login, set up an authenticator app, and stop a SIM-swap attack. Learn why 2FA is your strongest digital shield.
Mission details →A stranger just slid into your DMs asking innocent questions — but they're building a profile on you. Then a single photo nearly reveals your school, street, and schedule. Finally, lock down a social account before the data leaks. Master privacy before it masters you.
Mission details →Zoom the Cyber Puppy is playing online when suddenly a BIG pop-up appears saying "YOU WON A FREE PRIZE! Click here!" What should Zoom do? Help Zoom navigate three tricky online situations — pop-ups, downloads, and a message from a stranger — by choosing the smart, safe thing to do. Designed for Kindergarten through Grade 2!
Mission details →Smart speakers, gaming consoles, and public Wi-Fi are part of everyday life — and every one is a potential attack surface. Audit the connected devices in a kid's bedroom, spot the rogue network at the airport, and decide what's safe to say near an always-listening device.
Mission details →A classmate is being targeted in a group chat. Can you spot what cyberbullying actually looks like, choose the right response, and walk through a real report-and-block flow? Your actions could be the difference between someone getting help — and suffering alone.
Mission details →Advanced tier — social engineering, encryption, network/cloud security, AI safety & bias.
The Cyber Academy vault needs a new password — and you're the only hero who can build it. Watch a live crack-timer as you type, survive 5 villain challenges, and learn the passphrase technique that defeats even quantum supercomputers.
Mission details →A 5-scene 2FA and account-takeover lab. Watch a credential stuffing attack fail against 2FA, compare SMS vs TOTP vs passkey security, configure a fake authenticator app by scanning a QR code, survive an MFA fatigue push-bombing attack at 3am, and secure your recovery codes so you can reclaim your account if your phone is lost.
Mission details →Most cyberattacks start with a person, not a program. Work through 5 real scenarios: a fake IT help desk caller trying to reset your password, a "substitute teacher" who knows too much, a lost delivery driver looking for an open door, a caller claiming your parent called the school, and a Boss Battle multi-vector con artist combining three manipulation techniques at once. Identify every red flag and earn the Social Engineering Sentinel badge.
Mission details →Your digital footprint is the trail of personal data you leave across the internet — and identity thieves use every piece of it. Audit a fictional teen's public profile to find what a stranger can infer, classify five real-world identity theft attacks, and lock down an account settings panel before the attacker does.
Mission details →Encryption is what keeps your data private — even if someone intercepts it. Work through 5 scenes: manually decode a Caesar cipher to see how simple ciphers work (and fail), compare a symmetric AES key to a public/private key pair and choose the right one for the job, spot whether a website is using HTTPS and understand what the padlock really means, pick the most secure messaging app for a sensitive conversation, and see what happens to data sent over unencrypted HTTP on a coffee shop Wi-Fi. Earn the Encryption Expert badge.
Mission details →Your school network is under attack. Work through 5 real scenarios: trace a port-scanning probe coming from inside the building, block a suspicious connection on a home router, read a firewall log to find the rule that stopped an intrusion, map the attack surface of a small office by counting open ports, and lock down a Wi-Fi access point that a student found open. Earn the Network Security Ninja badge.
Mission details →Nearly everything your school does lives in the cloud — Google Drive, Classroom, OneDrive, iCloud. Work through 5 scenes: find and lock down a Google Drive folder that was accidentally set to "anyone on the internet can edit," review an OAuth permission request from a third-party app and decide whether the permissions are appropriate, trace a data leak back to an over-permissive shared link that a student forwarded, evaluate whether a free cloud storage service based overseas is safe for storing school records, and configure two-factor authentication on a shared cloud account. Earn the Cloud Security Guardian badge.
Mission details →You are setting up authentication for a fictional personal digital life across four real-world tiers. Tier 1 — Password Manager: install a vault app, generate one strong master password (passphrase style, ≥16 chars), and store a mock entry for an email account. Tier 2 — TOTP Authenticator: install an authenticator app, scan a mock QR enroll code, then enter the 6-digit TOTP to confirm the account is enrolled. Tier 3 — WebAuthn Passkey: register a passkey for the same account in the mock ceremony, and learn why a passkey is bound to the originating site and the device's secure element so a phishing proxy cannot reuse it. Tier 4 — Breach Response: run a quarterly haveibeenpwned-style lookup, rotate any exposed credentials, revoke active sessions, audit for credential reuse, then re-test monthly. Across all four tiers, the layered rule is the same — manager + TOTP + passkey + a breach-scan habit beats any single control alone. Includes printable "My Auth Setup" one-pager you take home. Pass 5 of 6 to earn the 🔐 Password Vault Pro badge and 200 XP. Designed for Grades 9 through 12 — server-graded 6-question quiz, advanced reading level, no client-side scene rendering.
Mission details →AI can now create fake images, clone voices, and run convincing chatbots. Can you tell what's real? Spot AI-generated images, decide whether to trust or verify a suspicious caller, and catch a chatbot trying to extract your personal information — before it's too late.
Mission details →AI chatbots are powerful tools — and powerful attack surfaces. Work through 5 scenes: spot a prompt injection hidden in a webpage that tries to hijack your AI assistant ("ignore your previous instructions and..."), identify a jailbreak attempt that tricks an AI into giving harmful advice by pretending it is a character in a story, review a student's chatbot conversation and flag the personal information they accidentally fed into a commercial AI, choose the right disclosure when submitting AI-assisted schoolwork, and test whether an AI-generated essay is factually accurate before trusting it. Earn the Prompt Safety Guardian badge.
Mission details →AI systems make real decisions about real people — hiring, lending, medical diagnosis. Work through 5 scenes: spot the bias in a training dataset that taught a hiring AI to prefer men, trace why a facial-recognition system misidentifies darker-skinned faces at 34x the error rate, review an AI college admissions tool and flag the proxy variable smuggling in racial bias, debate whether a predictive-policing algorithm is fair even if the predictions are accurate on average, and redesign the training pipeline for a loan-approval model to reduce bias. Earn the AI Fairness Champion badge.
Mission details →A grades 9–12 student runs an email that has been reused across a dozen accounts since middle school — and they just got a HIBP-style notification that their email and password pair appeared in a breach of a fictional gaming site (PixelRealm). In this mission, you walk through the OWASP credential-stuffing incident response flow: verify the alert was real (and not a phishing lure dressed as one), enumerate everywhere that leaked password was actually used, prioritize rotation by blast radius (email > banking > social > gaming), enable the strongest available second factor on each high-value account (passkey > TOTP app > push > SMS > email link), monitor for credential-stuffing follow-on attempts over the next 30 days, and decide when to escalate to a credit freeze and a parent or guardian. Pass 5 of 6 scenes to earn the Breach Response Specialist badge and 400 XP — and write your own action plan in Scene 6, scored by the mentor against the OWASP-aligned rubric.
Mission details →NimbusHR — a fictional 500-person SaaS company — just got breached. An attacker phished a marketing intern's credentials, used them to VPN into the corporate network, and then moved laterally to the payroll database because the internal network was fully trusted. You are the security architect called in to investigate. There are four failure points to find across 4 evidence panels: VPN logs (default-trust posture on the corporate VPN), IAM roles (overly broad roles — the intern could reach payroll), network diagram (no micro-segmentation between marketing and payroll subnets), and incident timeline (no device-posture check, no continuous auth, no per-service mTLS). Then you redesign the architecture with six numbered zero-trust controls: (1) MFA on every service, (2) identity-aware proxy instead of a trusted VPN, (3) service-to-service mTLS, (4) least-privilege IAM per service, (5) continuous auth via device posture, and (6) micro-segmentation in front of every service. Includes printable "Zero Trust Principles" one-pager you take home. Pass 5 of 6 to earn the 🛡️ Zero Trust Explorer badge and 200 XP. Designed for Grades 9 through 12 — server-graded 6-question quiz, advanced reading level, no client-side scene rendering.
Mission details →You are the investigator AND the subject. In this mission, advanced learners run a guided self-OSINT (open-source intelligence) exercise on their own digital presence — Google yourself, reverse-image-search your profile pics, run a haveibeenpwned-style lookup to see exactly which accounts have already leaked your email, audit social-media privacy settings, and see the attack: school name + sports team + birthday month + first pet name is three security questions cracked on the average bank account. Then remediation phase: tighten privacy settings, scrub old posts, delete dormant accounts, and treat every security question as an independent strong password (never the real fact). Includes printable Digital Footprint Checklist you take home. Pass 5 of 6 to earn the Digital Footprint Auditor badge and 200 XP. Designed for Grades 9 through 12 — server-graded 6-question quiz, advanced reading level, no client-side scene rendering.
Mission details →Use browser print (Ctrl/⌘+P) to save this page as a PDF pacing guide for offline planning. Or request a free pilot and we'll set up your first classroom within 10 minutes.