(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
Phishing email reported
Unpatched system identified
Uses multi‑factor authentication
Missing BAA for a PHI‑handling vendor
No documented incident response plan
Pet appears on camera
Updating software when prompted
Mentions “Think before you click”
High-risk vendor flagged
Recognizes a fake login page
Uses company‑approved cloud storage
Avoids downloading unknown applications
Updates software when prompted
Identifies a spoofed sender name
Recognizes a suspicious QR code
Slide with a lot of tiny text
“You’re on mute.”
Uses only approved tools for work
Forwards unusual emails to the security team
Recognizes a scam or fake offer
Data not classified correctly
Reporting a lost or stolen device
Verifies sender email address
Someone mentions “Zero trust.”
Validates payment or change requests through a second channel
Double-checking an external email recipient
Someone mentions “AI” or “Copilot.”
USB stick plugged into a corporate laptop
Knows how to report an incident
Using secure file transfer instead of email
Shreds documents with personal or client info
Recognizes when someone asks for too much information
Attending a security awareness training session
“This looks like a phishing attempt”
Saying “If it seems too good to be true, it probably is”
Someone says “Let’s take that offline.”
Avoids taking photos/screenshots of client data
Shared credentials discovered
Hovering over links before clicking
Uses secure file transfer instead of email attachment
Uses approved systems for work files
Free!
Default password still in use
Strong passphrase used (not just complex password)
Someone says, “That’s a great question.”
Double-checks external recipients before sending
Missing evidence for an audit test
Stores sensitive files securely
Notices spelling/grammar errors in a suspicious email
Declines to share information over the phone
Locks computer when stepping away
“Shadow IT” app found
Deletes unexpected attachments
Someone’s connection freezes mid‑sentence
Knows the organization’s security policies exist
Reports a suspicious text message
Multi-factor authentication (MFA) enabled
Vendor without recent SOC 2 report
Recognizes an “urgent” or “act now” red flag
“We’ll accept the risk” (without documentation 😉)
Sensitive data sent via unencrypted email
Deletes data they’re no longer authorized to retain
