(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
Forwards unusual emails to the security team
Reports a suspicious text message
“You’re on mute.”
Knows how to report an incident
Recognizes a fake login page
Identifies a spoofed sender name
Updates software when prompted
Stores sensitive files securely
Knows the organization’s security policies exist
Notices spelling/grammar errors in a suspicious email
Uses multi‑factor authentication
Avoids sharing credentials with anyone
Data not classified correctly
Declines to share information over the phone
Suspicious login alert
Locks computer when stepping away
Using secure file transfer instead of email
USB stick plugged into a corporate laptop
Free!
Verifies sender email address
Avoids downloading unknown applications
Knows not to plug unknown USBs into devices
Creates a strong passphrase (not just a password)
Someone mentions “AI” or “Copilot.”
Reporting a lost or stolen device
“This looks like a phishing attempt”
Employee uses the “Report Phish” button
“Sorry, I was on another call.”
“Can you see my screen?”
“Shadow IT” app found
Firewall rule allows “ANY/ANY” traffic
Deletes unexpected attachments
Shared credentials discovered
Uses only approved tools for work
Missing evidence for an audit test
Avoids taking photos/screenshots of client data
Hovering over links before clicking
No documented incident response plan
Attending a security awareness training session
Recognizes when someone asks for too much information
Computer screen locked when away
Avoids public Wi‑Fi for work tasks
Uses approved systems for work files
Someone says, “That’s a great question.”
Validates payment or change requests through a second channel
Pet appears on camera
Missing BAA for a PHI‑handling vendor
“We’ll accept the risk” (without documentation 😉)
Public link sharing disabled on a file
Recognizes a suspicious QR code
“If it seems too good to be true, it probably is”
Strong passphrase used (not just complex password)
Multi-factor authentication (MFA) enabled
Slide with a lot of tiny text
Uses company‑approved cloud storage
Mentions “Think before you click”
Avoids sending sensitive info unencrypted
Uses secure file transfer instead of email attachment
Quarterly access review completed
Double-checking an external email recipient
Shreds documents with personal or client info
Someone’s connection freezes mid‑sentence
Recognizes an “urgent” or “act now” red flag
Identifies suspicious activity on their account
Sensitive data sent via unencrypted email
Unpatched system identified
Verifying a payment/change request via phone
Someone mentions “Zero trust.”
Reports a suspicious email
Recognizes a scam or fake offer
Default password still in use
Phishing email reported
Vendor without recent SOC 2 report
Deletes data they’re no longer authorized to retain
Completes annual security training
Saying “If it seems too good to be true, it probably is”
