CYBERSECURITY AWARENESS | Retail & FMCG | Award-WINNiNG
Making cybersecurity stick… with gameplay
How Solvd Together helped Unilever turn “not my job” into ownership of threats and compliance into real cultural change. We even won an award for it (but more on that later).
What Unilever was really up against
Cyber criminals don’t discriminate. They don’t care who you are; They just need to find your weakest link. The bigger the company, the more opportunities they have.
And for the likes of Unilever (128,000 people, 3.4 billion consumers, iconic brands in over 190 countries), the attack surface is vast, and the weakest link? People.
When it came to cybersecurity, most employees simply didn’t see cybersecurity as part of their job. Our discovery revealed a very common mindset; one line summed up the whole problem…
“We make soup and soap. No one’s out to get us.”
There was a genuine disconnect. Work felt real. Threat felt distant, unlikely, made up even. And that’s exactly the kind of mindset that cyber criminals rely on.
Unilever’s cyber awareness team, managing enterprise-wide security engagement, knew that another round of compliance training wouldn’t change that. Click through training, pass a quiz, forget it by lunchtime. The risk stays exactly where it was: invisible, ignored, nobody’s job.
What they needed was a proper shift in culture. Something that turned shrugs into ownership and made cybersecurity everyone’s business – not just IT’s.
A tick-box compliance programme wasn’t going to cut it.
The Impact
increase in employees helping others stay safe online
increase in confidence to report a breach
improvement in cyber threat identification
A world-class NPS score
British Training Awards – Awareness Campaign of the Year 2025
The decision that changed everything
Charlie Sinclair, Unilever’s Senior Awareness and Engagement Manager for Cyber, knew the problem was a people problem, not a technical one. She also knew that standard security awareness programmes hadn’t cracked it.
The brief: something creative, something genuinely memorable, something that changed how a global workforce thinks, not just what they can recite. And crucially, something the team could run at scale.
We wanted to listen to our audience to experiment with something that was going to have a real impact, not just produce more training.”
Charlie Sinclair
Senior Awareness and Engagement Manager, Cyber, Unilever
Digging deeper to design smarter
Before we built a single thing, we went and talked to people. Interviews and workshops across the supply chain, finance, and the factory floor, trying to understand how cyber threats showed up in people’s day-to-day, and what was stopping them from acting differently.
Three things kept coming up, everywhere we looked.
Threats: People in operational roles didn’t really understand cyber risks, either at work or at home. It all felt distant and technical, and like someone else’s job.
Mindsets: The instincts to pause before clicking, question an unusual request, or report a near-miss were missing, inconsistent or brushed aside.
Consequences: Everyone agreed breaches were bad, in theory. But ‘what’s the worst taht could happen?’ still felt intangible.
These three things became our blueprint.
What we built together
We called it Cards Against Cyber Crime: a physical card game built entirely from real employee experiences, grounded in the threats, mindsets, and consequences Unilever’s own people face every day.
A mindset-first game, not a knowledge test
Every card came straight from what we heard on the ground. Played in teams, the game creates those brilliant “oh no, that’s literally me” moments. The ones that compliance training never reaches: Honest reflection, real conversations, friendly challenge between peers in a low-pressure, high-impact environment.
A whole cyber campaign built around it
Cards Against Cyber sat at the heart of something bigger. We built kits for managers, with scenarios and facilitation tips, so leaders could run the conversation themselves, with no cyber SMEs required. Targeted messages for the highest-risk teams. Posters with intentional card combos to keep the threats front of mind, and a rollout that utilised Cyber Champions communities ensured we were pushing on an open door.
Scalable, sustainable, and designed to keep working
We designed it to keep going recyclable cards, a digital companion version, and a format that could flex and grow. Works as a five-minute chat starter at a team huddle, or as the backbone of a much bigger campaign. No logins. No “click next.” No facilitator reading off slides for an hour. Just a team, a table, a deck of cards – and suddenly people are having the honest cybersecurity conversations that no compliance module ever managed to start.
The results, and the ripple beyond them
The numbers tell you people didn’t just enjoy this. They changed how they think and act.
- Threat identification up 9% (77% to 86%)
- Confidence to report a breach up 8% (79% to 87%)
- The number of people actively helping others stay safe online, up 6% (76% to 83%)
- And a genuine work class NPS of +82
In 2025, Cards Against Cyber Crime won Awareness Campaign of the Year 2025 at the British Training Awards.
The game was engaging and light-hearted whilst tackling serious issues. I thought the cards were realistic and well thought out, and it was particularly important that the topics were relevant and not sugar-coated to downplay the risks.”
Participant
Unilever
