Be honest about how the last one went.

A deck of slides. Stock photos of padlocks. A list of don'ts. A quiz at the end that everyone half-remembers until lunch. Your people nodded along, ticked the compliance box, and by Thursday the only thing that survived was a vague sense that they should probably stop reusing that password.

Nobody's fault. That's just what happens when you ask a room of adults to memorise threats they have never once had to think through.

Here's the test. Ask anyone on your team what a man-in-the-middle attack is. Watch them reach for the definition they were shown, fumble it, and give up.

Now imagine they'd spent an hour being the man in the middle — quietly intercepting a rival's shipment, watching the whole table realise too late where their data had gone, and winning because of it.

They'd never need the definition again. They'd have the memory instead.

That gap — between being told and having done it — is the entire reason security awareness training doesn't stick.

It's also the reason we built a board game about potatoes.

Enter the Spudnet is a cybersecurity and computer networking board game. No computers required. The board is the internet, barely disguised: warehouses are servers, ships are data packets, ports are network nodes, and every potato is a client request trying to make it across in one piece.

Then the attacks start. Ransomware locks down a warehouse. A denial-of-service strike jams the port everyone was routing through. Trojans get slipped into shipments. Worms spread.

Then the routes start closing. Players raise their own firewalls anywhere on the network and decide, rule by rule, exactly who gets through — so the fast lane you'd been relying on quietly becomes someone else's toll gate. You survive by patching vulnerabilities, rerouting traffic, and racing to reformat before an attack lands.

Flip to co-operative mode and the table turns on the A-bot-calypse — a botnet uprising nobody beats alone. That's where honeypots earn their keep: lay the bait, lure the bots in, watch them self-destruct on it.

Here's the part that makes it work: the security concepts aren't bolted on as "learning moments." They are the game. Nobody pauses to learn what a botnet is — understanding one is how you survive the next ten rounds.

So by the end, players can explain firewalls, ransomware, DDoS, command-and-control, and how a packet actually finds its way across a network. Not because they were told. Because they spent an hour using it against each other.

2 to 6 players. Ages 9 and up. 30 minutes to two hours — from fast onboarding icebreaker to full afternoon workshop.

It was built by two people who were sick of watching their own lessons fail.

A software engineer and an architect, running a training company since 2015, kept getting called into schools and offices to teach technical concepts — and kept watching those concepts bounce clean off the room.

Their conclusion was blunt. This material isn't as hard as the way it's usually taught makes it feel. What trips people up isn't the idea of a firewall or a worm. It's being handed a definition and given no reason on earth to care about it.

So they stopped explaining and started building. Games where you don't study the concept — you use it to win.

That became Potato Pirates, a Computer Science edutainment brand now in the hands of families, schools and organisations around the world, covered by The New York Times, the Wall Street Journal, Forbes and Smithsonian Magazine. Enter the Spudnet is certified by STEM.org for teaching authentic cybersecurity concepts — the chapter of that same idea aimed squarely at how networks get attacked and defended.

Teams at IBM, Oracle, AIA, Seagate and ExpressVPN have all bought Enter the Spudnet to run themselves — companies with their own security functions, their own training budgets, and access to every polished e-learning platform on the market. They bought a box of cardboard potatoes anyway.

We've also facilitated sessions for organisations including the Cyber Security Agency of Singapore and Raffles Institution, and it was featured at GovWare 2022, one of Asia's major cybersecurity conferences. Boardrooms, classrooms, conference floors. Same box of potatoes.

Then there's the one who found us first. Dr Peter Membrey, a principal architect at ExpressVPN, built its Lightway protocol from scratch — the encryption millions of people route their lives through. No pitch, no meeting, no introduction: he backed all three of our games on Kickstarter before we'd exchanged a word, and later came on board as an investor.

When the man who built that encryption decides a potato game teaches cybersecurity properly, that's not an endorsement you can buy.