(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
Knows how to report an incident
Mentions “Think before you click”
Updating software when prompted
No documented incident response plan
Someone’s connection freezes mid‑sentence
Firewall rule allows “ANY/ANY” traffic
Avoids taking photos/screenshots of client data
Declines to share information over the phone
Using secure file transfer instead of email
Avoids public Wi‑Fi for work tasks
Multi-factor authentication (MFA) enabled
Stores sensitive files securely
Pet appears on camera
“Sorry, I was on another call.”
Strong passphrase used (not just complex password)
Employee uses the “Report Phish” button
Validates payment or change requests through a second channel
Uses multi‑factor authentication
Someone mentions “Zero trust.”
“This looks like a phishing attempt”
Sensitive data sent via unencrypted email
Reports a suspicious text message
Uses only approved tools for work
“We’ll accept the risk” (without documentation 😉)
Hovering over links before clicking
Slide with a lot of tiny text
Recognizes a suspicious QR code
Deletes data they’re no longer authorized to retain
Recognizes a fake login page
Missing evidence for an audit test
Saying “If it seems too good to be true, it probably is”
Knows not to plug unknown USBs into devices
“Shadow IT” app found
Uses secure file transfer instead of email attachment
High-risk vendor flagged
Double-checks external recipients before sending
Avoids sending sensitive info unencrypted
Attending a security awareness training session
Notices spelling/grammar errors in a suspicious email
Reporting a lost or stolen device
Creates a strong passphrase (not just a password)
Unpatched system identified
Identifies suspicious activity on their account
Computer screen locked when away
Double-checking an external email recipient
“You’re on mute.”
Excessive permissions (over‑privileged access)
Default password still in use
Knows the organization’s security policies exist
Completes annual security training
Shared credentials discovered
Verifying a payment/change request via phone
Updates software when prompted
Someone says “Let’s take that offline.”
Locks computer when stepping away
Deletes unexpected attachments
Recognizes an “urgent” or “act now” red flag
Someone mentions “AI” or “Copilot.”
Public link sharing disabled on a file
Verifies sender email address
Avoids sharing credentials with anyone
Uses approved systems for work files
Recognizes a scam or fake offer
Uses company‑approved cloud storage
USB stick plugged into a corporate laptop
Reports a suspicious email
Recognizes when someone asks for too much information
