IT Security Quiz: 10 Formats, Templates and Tools

Teams often run an IT security quiz once a year, collect scores nobody reads, and file the results under compliance. Then they wonder why the same people click the same style of phishing email eleven months later.

The annual model is backwards. A forty-question exam at the end of a long module tests recall of a slide deck, not judgment under pressure. It also arrives long after the risk, in a format that punishes the honest answer and rewards the fast one.

What works is shorter and more frequent: a two-minute pulse check on Monday, a phishing decision drill at the start of the quarter, a graded assessment after a role-specific lesson path. Score all three against a stated standard, follow every failure with remediation, and treat the trend line as the true output.

The ten entries below are quiz formats and resources, not interchangeable tools. Some are free public quizzes you can drop into a Slack channel this afternoon. Some are full platforms that carry assignments, grading, and audit evidence. Each entry says what it's for, where it falls short, and how to run it with a Slack-first team. If you build your own items, the walkthrough on running timed exams in Google Forms covers the timing and delivery mechanics.

1. Vigil Security Homepage

Vigil Security is the format this list is built around: a graded quiz delivered as a Slack message, answered in the thread, scored immediately. Lessons run about four minutes and the questions are scenario-based, so a learner decides what to do when an executive asks for a payment over DM rather than reciting a definition of social engineering.

The case for putting assessment inside Slack is behavioral. The Verizon 2025 Data Breach Investigations Report found the human element was involved in approximately 60% of analyzed breaches, which puts the emphasis on decisions people make mid-task. A quiz that lives in a portal is a task people schedule. A quiz that arrives in the channel they already have open is a task they finish.

How grading and evidence work

Every assessment is scored against an 80% passing standard, drawn from a bank of 196 authored questions across phishing, access control, and safe use of AI coding tools. A failed attempt triggers follow-up training rather than a silent fail, and lesson versions, mappings, attempts, and completions are kept as immutable snapshots, so an auditor can see what was asked and what was answered. Teams on Vanta or Drata can sync completion evidence directly instead of exporting a CSV by hand.

Pricing is a single plan at $2 per seat per month, billed annually, with self-service checkout from 25 to 249 learners and a sales conversation above that. Administrators assign by workspace, channel, team, or individual, and reminders, grading, and certificates happen without anyone leaving Slack. Setup is designed to take under three minutes.

Where it doesn't fit. If your organization runs on Teams or Google Chat, the core delivery model doesn't apply. The annual commitment also needs a headcount you can defend, and there's no antivirus, helpdesk, or endpoint tooling here. This is training and evidence, nothing wider.

Website: vigilsecurity.app

2. Google Jigsaw Phishing Quiz

Start a new-hire cohort here. The Google Jigsaw Phishing Quiz puts a handful of sample emails in front of the learner and asks one question: legitimate or phishing? Feedback arrives immediately, with the specific tells highlighted, and it takes about ten minutes to work through.

The caveat is that the tell is changing. Verizon's 2025 DBIR infographic reports that synthetically generated text in malicious emails doubled over two years, which means grammar, spelling, and awkward tone are weaker signals than they were when most phishing quizzes were written. An employee trained to spot typos will pass this quiz and still approve a polished fraudulent payment request.

What works. Free, no signup friction for participants, memorable examples, and a useful discussion starter for a team meeting.

What doesn't. No tracking, no assignment, no reporting, and narrow scope. It tests pattern recognition on email, so it doesn't touch credential handling, vendor fraud, or secrets exposure. For the verification habits to run alongside it, see how to verify suspicious messages safely.

Pair every item with a workplace question: what would you do next in Slack, and who would you tell?

Website: Google Jigsaw Phishing Quiz

3. NIST Are You Safe Online Quiz

A short quiz can show what people recognize. It cannot, on its own, change what they do. Proofpoint's 2024 State of the Phish report found that 71% of surveyed working adults admitted taking a risky security action, and 96% of those respondents knew it was risky.

The NIST online-safety quiz is a quick, free pulse check on everyday habits such as passwords, software updates, Wi-Fi, and sharing. Use it as an onboarding discussion prompt, then assess whether employees can apply your organization's policies in realistic situations.

Its questions are not role-specific, so engineers and account managers receive the same assessment. The quiz also does not cover newer patterns such as AI-written lures, impersonation in chat tools, or tokens exposed in repositories. Treat it as a general baseline, not a measure of readiness for those scenarios.

What works. It is free, quick to complete, and comes from a standards agency rather than a training vendor.

What doesn't. It does not assign quizzes, record completions, export audit evidence, or map questions to your controls. For a custom question bank, this collection of internet safety quiz questions offers a practical starting point.

Website: NIST cybersecurity and privacy quiz

4. Australian Cyber Security Centre Quiz Library

The ACSC library is the strongest free source of short, topical quizzes for a recurring refresher program. Each quiz takes about three minutes and covers one thing: passphrases, backups, multifactor authentication, updates, scams, or what to do when a breach is suspected. Pull one per week into a channel and you have a quarter of content without writing a question.

It's also grounded in the environment it was written for. The Office of the Australian Information Commissioner reports that human error accounted for 30% of reportable data breaches in Australia during January to June 2024, while phishing caused 12%, which is close to the split this library targets.

The trade-offs are practical. Content aims at general audiences and small businesses, so some examples won't match your tooling, and organizations outside Australia will want to swap local terminology and reporting channels. There's no central tracking, no completion export, and no assignment logic, so you'll be distributing links by hand.

What works. Genuine scenario questions rather than definitions, plus a breach-response quiz that makes a good drill before an incident exercise.

What doesn't. Audit evidence. You can't prove who took which quiz without building your own record.

Website: ACSC quiz library

5. CDSE Security Awareness Games

Some quizzes are for the record. These are for the room. The U.S. Center for Development of Security Excellence publishes free trivia, crossword, and word-search activities, with cybersecurity sets alongside counterintelligence and insider-threat material.

Use them as a ten-minute opener for a team meeting or a lunch-and-learn, especially with groups that groan at compliance modules. A trivia round on insider threat gets people arguing about the right answer, and that argument is the discussion you wanted.

They're not a graded assessment. There's no scoring standard, no per-person record, no export, and no way to tell a security manager which business unit is weak on incident reporting. Much of the content skews toward government and defense environments, so private-sector teams should check the framing before forwarding a link.

Treat games as the warm-up and the quiz as the measurement. Mixing the two produces the worst outcome, where people remember the crossword and management records a passing score for it.

What works. Free, varied, and useful for making a security topic social rather than punitive.

What doesn't. No data, no remediation path, and no coverage guarantee against your own policies.

Website: CDSE Security Awareness Games

6. British Columbia Government Awareness Quizzes

Topic-specific quizzes from a public-sector source, archived across several years: phishing, social engineering, passwords, SIM swapping, and more. The archive is the useful part. When you need a five-question activity on SIM swapping for a finance team this week, this saves an hour of drafting and review.

Check currency before reuse. Older items were written against older threat patterns and older terminology, and a quiz that trains people to scan for bad grammar will misfire against machine-polished lures. Read every question against what your own service desk and SOC do today, then rewrite anything that points to a route your employees don't use.

The public-sector framing is another adjustment. Screenshots, policy references, and escalation paths reflect British Columbia's environment, so replace them with your own.

What works. Topic variety in one place, free, official, and simple to adapt into a Slack post with a threaded poll.

What doesn't. No assignment, no completion tracking, no audit output, and no guarantee that archived content matches current guidance.

Website: British Columbia information security awareness quizzes

7. KnowBe4 Security Awareness Training

KnowBe4 is the platform most security teams already know, and it's what buyers compare everything else against. Phishing simulations, proficiency assessments, surveys, reporting, and a large content library sit in one console, which is why it shows up in so many program reviews.

The numbers behind simulation-first programs are worth knowing before you buy. A 2022 NIST review of federal cybersecurity awareness programs reported that just over 85% of participating organizations conducted phishing simulations, 84% measured training completion, and 72% measured phishing-simulation click rates. NIST also warns against reading click rates in isolation, which is why its Phish Scale rates the difficulty of a message so results can be compared across exercises.

That's the trap with any simulation platform. A rising click rate can mean worse behavior or a better-crafted campaign, and a falling one can mean employees now report everything to be safe.

Practical rule: score the decision, not just the click. Record what the employee did after the click (reported, deleted, entered credentials, ignored) and grade post-click behavior separately from the click itself.

What works. Depth, reporting, and a library large enough to build role-specific tracks for finance, engineering, and support.

What doesn't. Published U.S. list pricing for Foundation starts at $2.40 per seat per month for 25 to 50 seats on a three-year term, and costs move with seat band and tier. Delivery happens in a separate portal, so a Slack-first team adds a second destination and a second password. For drill mechanics across vendors, see phishing simulation tools.

Website: KnowBe4 Security Awareness Training

8. Hoxhunt

Hoxhunt makes phishing practice a recurring decision drill, with gamification designed to encourage participation. Learners receive simulated attacks in their usual channels, choose whether to report or ignore them, and get immediate feedback. The platform adjusts difficulty as learners improve. Courses and quizzes can be assigned through the Hoxhunt dashboard, an LMS, or a direct URL, with reminders and completion tracking.

Repetition is the format's strength. Regular exposure to simulated lures gives employees practice spotting and reporting suspicious messages. Streaks and leaderboards can help sustain participation, but they are a motivator, not a measure of whether people will report a real threat.

Hoxhunt uses quote-based pricing, so teams need a quote to assess the cost. Training is delivered outside Slack, which adds a separate destination for employees to access.

Check whether reporting continues when the leaderboard resets. The behavior should hold even when the game does not.

What works. Adaptive difficulty, immediate feedback, and repeated practice that can build reporting habits over time.

What doesn't. Quote-based pricing makes costs harder to compare upfront, and training does not happen inside Slack.

Website: Hoxhunt

9. Proofpoint Security Awareness Training

Proofpoint's program is broad: topic-based assessments, phishing simulations, interactive lessons, videos, and campaign material covering security, privacy, and compliance. It suits an organization that wants one vendor for awareness content and adjacent email-security telemetry rather than a narrow quiz tool.

The measurement question is where most programs stall. A 2025 Fortinet survey of security awareness programs found that only 6% of organizations reported 100% completion of security-awareness training, while 56% reported completion above 70%, and 42% used completion rate as an effectiveness metric. Employee feedback (52%), reduced security incidents (53%), and security audits (50%) were more common measures. Completion is the easiest number to collect and the least informative.

What that means in practice: map the topic assessments to the roles that carry the risk, then read results by topic instead of by average score. A team averaging 88% can still be failing every question on payment verification, and the average will hide it.

What works. Breadth of formats, targeting by topic, role, and threat, and real-time results that identify knowledge gaps.

What doesn't. Quote-based pricing, more platform than a small team needs for a lightweight refresher program, and a training experience outside Slack.

Website: Proofpoint Security Awareness Training

10. Arctic Wolf Managed Security Awareness

Arctic Wolf sells awareness as a managed service: short lessons, quiz sessions, phishing simulations, and remediation, scheduled and delivered by the vendor. For a two-person security team with no bandwidth to build a calendar and chase stragglers, that's the practical option, and it's why managed delivery keeps winning deals.

NIST's guidance on measuring awareness programs is the right yardstick for judging a managed provider. It recommends testing employees on covered material, observing whether they follow recommended procedures, collecting learner evaluations, and comparing incidents before and after training. It also treats metrics as a way to quantify implementation, effectiveness, efficiency, adequacy, and improvement needs.

So ask the account team one specific question: which of those five does the quarterly report show? A participation count answers implementation. It says nothing about effectiveness.

What works. Managed content, scheduling, quizzes, and remediation remove the administrative load, and assessment sits inside a recurring program rather than standing alone.

What doesn't. Public pricing isn't listed, so you'll need a quote, and the vendor-managed model is a poor fit for teams that want to author every question themselves.

Website: Arctic Wolf Security Awareness and Training

IT security quiz resources at a glance

The useful comparison is the quiz format, how it reaches employees, and what evidence it leaves behind. A free browser quiz can prompt discussion; a recurring Slack assessment can also support assigned training and completion records.

Use the rows as distinct formats, not interchangeable products. A standalone quiz suits a quick knowledge check. A phishing decision drill tests how employees respond to a suspicious message. A role-based assessment can focus on the risks relevant to a team. For Slack-first organizations, deployment and evidence matter alongside the questions: check whether employees can complete the assessment in their usual workflow and whether administrators can access completion and score records.

Turn Quizzes Into a Habit, Not an Annual Event

Two or three formats, run on a schedule, beat a library of forty you never touch. The cadence that holds up is straightforward: a monthly pulse quiz of five questions on general awareness, a phishing decision drill each quarter with post-click scoring, and a graded assessment after each role-based lesson path.

Score everything against a stated standard. An 80% pass mark is a defensible line, high enough to mean something and low enough that a competent person clears it without guessing. What matters more is what happens at 79%. A failed attempt should trigger a short remediation lesson and a retake, not a note in a spreadsheet that nobody opens. Silent failures train people to click through.

Three habits separate a quiz program from a compliance artifact.

Write questions about actions, not definitions. "Which of these is phishing?" is a warm-up. "Your CFO messages you at 4:45pm asking for a wire transfer and says she's in a meeting" is a measurement. Every item in your bank should end with a decision someone could make badly on a Tuesday afternoon.

Report by role and topic, not by average. A company-wide average of 91% hides the finance team failing payment verification and the engineering team pasting tokens into public repositories. Slice the results the way an attacker would.

Keep a timestamped record. Auditors ask who was assessed, on what, when, and with what result. A screenshot of a dashboard isn't evidence, and neither is a spreadsheet with no version history.

Then there's the delivery question. If your team lives in Slack, Vigil Security runs that loop natively, with authored question banks, grading, reminders, and certificates, so the record exists without a second portal or another password.

Start smaller than feels comfortable. Run one free quiz this week, the ACSC library or the Jigsaw exercise, in a channel with twenty people, and read what they say in the thread. The argument in the thread tells you which question to write next. The mechanics of spacing and retention are well documented in the research on the benefits of testing yourself regularly, and they apply to security training more than many teams admit.

---

Vigil Security turns that cadence into something you can sustain: four-minute graded lessons delivered inside Slack, scenario questions instead of definitions, a defined pass mark, and follow-up training when someone falls short. Assignments, reminders, certificates, and CSV export run automatically, and completion evidence syncs to Vanta or Drata so the record is ready before the auditor asks. Visit Vigil Security to see the lesson library and run your first pulse quiz this week.