Cybersecurity Carnival: Engage and Protect with Awareness Events 2025

Awareness events work when people get to practice. A poster in the break room reminds staff that phishing exists; an escape room built around a fake invoice makes them spot one under time pressure, and that is the lesson that tends to stick.

The University of Nebraska Medical Center (UNMC) built its Cybersecurity Awareness Month schedule around that idea. Below is what was on the program and what other institutions can borrow from it.

Escape rooms and competitions on the UNMC schedule

UNMC’s agenda mixes formats so that people who learn by doing, by watching and by competing all have something to join. The escape rooms put participants inside a simulated attack and ask them to work their way out. Competitions add a scoreboard, which turns security knowledge into something people actually want to show off.

The point is to make abstract ideas concrete. Once a nurse or an administrator has traced a fake login page back to its source, “security is everyone’s job” stops being a slogan and starts being something they have done.

Speakers on the program

The schedule also brings in speakers from the security field to talk about current threats and the habits that blunt them. Their stories of incidents and recoveries give attendees a reason to care beyond the policy manual.

Hearing from practitioners also helps staff see that security advice changes. What counted as a strong password or a safe link five years ago is not the same today, and short talks are an easy way to keep people current.

Changing how staff think about security

The larger goal at UNMC is cultural. Hands-on sessions and open conversations with experts are meant to move security from an IT department task to something every employee practices, in line with the standards the institution already follows.

Participants who have worked through a realistic scenario leave with a better sense of what an attack looks like on an ordinary workday. That is useful for the risks the training covered and for the ones it didn’t.

What other institutions can copy

UNMC’s approach rests on a simple premise: knowing about threats is not enough, and people need repeated chances to practice. Cybersecurity Awareness Month gives a natural deadline for that practice, but the habits it builds have to last all year.

Other universities, hospitals and employers can lift the format directly. Pair a few interactive events with credible speakers, keep the stakes low and the scenarios realistic, and give people something to talk about afterward.

The carnival theme ends with October. UNMC’s hope is that the curiosity it sparks keeps people asking questions about suspicious emails and logins well into the rest of the year.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.