⬡ OLUMA CYBER ARENA 15 missions ⭐ Live XP · Rank & badges ↘ Learn through play Level up your cyber instincts. Fifteen quick, interactive challenges — spot the phish, break the cipher, run the firewall, crack the escape room. Create your player, earn XP with every correct call, and climb from Explorer to Cyber Guardian. Start playing → See badges XP, hits and rank update live in the corner ↘ The arcade Choose your cyber mission. Filter by type, then tap a game to play it right here — no download, no sign-up. Ace a full game to trigger a Perfect Round. All games 🔍 Detect 📚 Learn 🛡️ Defend 🚀 Career 🕵️DetectPhishing DetectiveThree messages just hit the inbox. Can you spot the phish before you click?Beginner3 min+50 XP▶ Play now🎲DetectReal or Scam?Texts, offers and job posts — which are safe, and which are traps?Beginner4 min+60 XP▶ Play now🔗DetectURL DetectiveThree lookalike web addresses per round — only one is the real site.Beginner4 min+60 XP▶ Play now🔎DetectSpot the VulnerabilityScan the workspace and tap every security risk you can find.Intermediate5 min+75 XP▶ Play now🔑LearnPassword PowerType a passphrase and watch it get stronger — then pick the toughest of the bunch.Beginner3 min+50 XP▶ Play now🧠LearnCyber Word HuntMatch the plain-English clue to the right cyber term.BeginnerDaily+40 XP▶ Play now🔐LearnCipher BreakCrack real codes — Caesar shifts, ROT13 and the logic of encryption.Intermediate5 min+75 XP▶ Play now🎯LearnCyber Quiz BattleDefeat the cyber villains — one correct answer at a time.Intermediate6 min+90 XP▶ Play now🚨DefendIncident Response SimYou’re the analyst on shift. Make the right call under pressure.Intermediate7 min+100 XP▶ Play now🔥DefendFirewall FrenzyTraffic is hitting the network. Wave the safe packets through — and catch the attacks.Intermediate5 min+80 XP▶ Play now🛡️DefendBuild Your Security StackChoose the tools that protect a small team — and avoid the traps.Advanced8 min+120 XP▶ Play now🧩DefendCyber Escape RoomCrack three locks by solving cyber clues before you can escape.Advanced10 min+150 XP▶ Play now🌎CareerCyber Hero MissionA local community group needs protecting. Be their cyber hero.Intermediate8 min+110 XP▶ Play now📱Career · Life skillsPrivacy Power-UpTune up a social media profile like a privacy pro would.Beginner4 min+60 XP▶ Play now🚀CareerCyber Career AdventureAnswer one question and discover the cyber role that fits you.Beginner5 min+80 XP▶ Play now📜CareerCertification Path FinderPick your level and get a ready-made certification roadmap.Beginner4 min+70 XP▶ Play now 🔐The arcade is lockedType your player name in the panel at the top of the page and the missions unlock instantly.Create my player ↑ Rewards Badges, challenges & leaderboard. Badges light up the moment you earn them — no refresh, no sign-in. Achievement badges · unlock live as you play ✓ EARNED🥉 Cyber ExplorerGet your first answer right in any game. ✓ EARNED🥈 Security DefenderAce Phishing Detective, Real or Scam?, Word Hunt and the Password bonus. ✓ EARNED🥇 Threat HunterCatch every risk in Spot the Vulnerability, Security Stack and Firewall Frenzy. ✓ EARNED💎 Cyber GuardianEscape the room and ace Quiz Battle, Incident Response and Hero Mission. 🏆 Monthly challenge Complete 5 games this month to earn the special Oluma Community Defender badge. Community leaderboard 🥇 Amina5,400 XP 🥈 Daniel4,950 XP 🥉 Sofia4,640 XP 4. Ahmed4,200 XP 5. Maya3,980 XP Your live XP and hit count travel with you in the corner HUD ↘ — screenshot it and share your score! Ready to become a cyber defender? The Fun Zone turns cybersecurity into something you can actually feel confident about. When you’re ready for more, our free lessons and practice exams are one click away. Start learning → Try a practice exam ×🕵️Detect · BeginnerPhishing DetectiveRead each message and decide. You earn XP for every correct call.Round 1‘Your account is LOCKED! Restore access in the next 10 minutes: bit.ly/secure-login’Click the link — the urgency means it’s important✖ Urgency plus a shortened, mystery link is the oldest trick in the book. Slow down.Phishing — urgency and a shortened link are red flags✔ Exactly. Real providers never rush you through a mystery link.Legit — banks send links like this all the time✖ Reputable banks avoid shortened links and never threaten instant lockout.Round 2An email from ‘IT Support’ asks you to reply with your username and password to ‘verify your account.’Reply fast so you don’t lose access✖ No real IT team will ever ask for your password — by email or otherwise.Phishing — nobody legitimate asks for your password✔ Right. Your password is never requested over email. Ever.Legit, as long as the logo looks official✖ Logos are trivially copied. They prove nothing about who really sent it.Round 3A newsletter you subscribed to arrives from its usual address, with normal content and an unsubscribe link.Phishing — every link is dangerous✖ Not every link is an attack. Blanket fear isn’t the goal — informed judgment is.Probably safe — expected sender, expected content✔ Good judgment. A known sender with content you expected is likely genuine.Scam — all newsletters are fake✖ Legitimate newsletters exist. The skill is telling them apart, not distrusting all.🌟 Perfect round, Detective! Every phish spotted — +30 XP banked in your HUD.✔ Each correct answer adds +10 XP to your score · Back to the arcade →×🎲Detect · BeginnerReal or Scam?Swipe through three messages and label each one.Round 1‘Congratulations! You won a $1,000 gift card. Just pay a small $5 processing fee to claim it.’Real — $5 is worth it for $1,000✖ You never pay to receive a prize. This is a classic advance-fee scam.Scam — you never pay to receive a prize✔ Correct. Any ‘pay first to win’ message is a scam, every time.Real if it has an official-looking logo✖ Logos and branding are easy to fake and mean nothing here.Round 2A ‘recruiter’ offers a high salary with no interview and asks for your bank details to ‘set up payroll’ before day one.Real — great, send the details✖ Real employers don’t need your bank login before you’ve even interviewed.Scam — no interview + bank details up front is a trap✔ Spot on. This is a common job scam that harvests financial data.Real if the salary is high enough✖ A high salary with zero process is bait, not a lucky break.Round 3Your friend texts from their normal number asking if you’re free this weekend.Scam — texts can’t be trusted✖ Expected sender, normal request — treating everything as a scam isn’t realistic.Safe — known number, ordinary message✔ Right. Context matters: a familiar contact with a normal ask is fine.Scam — friends never text plans✖ Everyday messages from known contacts are normal and usually safe.🌟 Perfect round! You can smell a scam from a mile away — +30 XP.✔ Each correct answer adds +10 XP to your score · Back to the arcade →×🔗Detect · BeginnerURL DetectiveAttackers register lookalike addresses. In each round, tap the one address you’d actually trust.Round 1You need to log in to PayPal. Which address is the real one?paypa1.com✖ Look closely — that’s the number 1, not the letter L. A classic character swap.paypal.com.secure-check.info✖ The real domain is whatever comes right before the last dot — here that’s secure-check.info, not PayPal.paypal.com✔ Correct. Short, clean, and the domain ends exactly where it should.Round 2You want official Google help. Which one is genuine?g00gle-support.net✖ Zeros instead of o’s plus a hyphen and a strange ending — three red flags in one address.support.google.com✔ Yes. A subdomain of google.com is still owned by Google — the real domain is what sits before .com.google.verify-account.co✖ ‘google’ at the front means nothing — the actual site is verify-account.co.Round 3A ‘massive deal’ email links you to a shop. Which one would you trust?amaz0n-deals.shop✖ A zero for an o, a bolted-on word, and a bargain-bin ending. Walk away.amazon.com✔ Right. When in doubt, skip the link entirely and type the real address yourself.amazon.account-billing.net✖ The real domain here is account-billing.net — Amazon is just window dressing.🌟 Perfect round! You read URLs like a pro — the last domain before the ending is the truth. +30 XP.✔ Each correct answer adds +10 XP to your score · Back to the arcade →×🧠Learn · BeginnerCyber Word HuntThree clues, three terms. How’s your cyber vocabulary?Round 1Malicious software built to harm, steal or disrupt — what’s the word?Firewall✖ A firewall defends the network — it isn’t the harmful software itself.Malware✔ Yes! ‘Malware’ = malicious software: viruses, ransomware, spyware and more.Encryption✖ Encryption protects data; it isn’t the threat.Round 2Scrambling information so only someone with the key can read it?Encryption✔ Correct. Encryption turns readable data into protected gibberish.Phishing✖ Phishing is a scam, not a way to protect data.Backup✖ A backup is a spare copy — it doesn’t scramble anything.Round 3A fake message pretending to be someone you trust, to steal your info?Patch✖ A patch is a software fix, not a scam message.VPN✖ A VPN encrypts your connection — it isn’t a scam.Phishing✔ Exactly. Phishing baits you into handing over information.🌟 Perfect round! Your cyber vocabulary is on point — +30 XP. Want more words? Visit the CyTerms glossary.✔ Each correct answer adds +10 XP to your score · Back to the arcade →×🔐Learn · IntermediateCipher BreakCodebreaking time. Shift the letters, find the message, learn how encryption thinks.Round 1Caesar cipher, shift 1 (every letter moved one step forward). Decode: DZCFSCODES✖ Close in spirit, but shift each letter back one: D→C, Z→Y, C→B…CYBER✔ Cracked it! D→C, Z→Y, C→B, F→E, S→R spells CYBER.DANGER✖ That’s six letters — the ciphertext only has five. Count first, then shift.Round 2What does someone need to turn encrypted data back into readable data?A faster computer✖ Speed doesn’t unlock strong encryption — modern ciphers would take longer than the universe’s lifetime to brute-force.The correct key✔ Exactly. Encryption stands or falls on the key — which is why protecting keys matters as much as the cipher itself.Administrator rights✖ Admin rights control a system, not the math. Without the key, the data stays scrambled.Round 3ROT13 shifts every letter 13 places. Decode: URYYBHELLO✔ Nailed it! U→H, R→E, Y→L, Y→L, B→O. Fun fact: applying ROT13 twice gets you right back where you started.WORLD✖ Good guess, but shift each letter 13 back: U→H is your first clue.LOGIN✖ Not this time. Try mapping U thirteen letters back through the alphabet.🌟 Perfect round, codebreaker! Alan Turing would be proud — +30 XP.✔ Each correct answer adds +10 XP to your score · Back to the arcade →×🎯Learn · IntermediateCyber Quiz BattleFour villains, four questions. Answer right to send them packing.Round 1👾 PhishFace attacks! What does MFA protect you against?Slow internet✖ MFA is about identity, not speed.A stolen password being enough to log in✔ Boom. Even with your password, an attacker still needs the second factor.Weak Wi-Fi signal✖ That’s a network issue, not what MFA solves.Round 2🤖 MalBot drops ransomware! Your best way to recover?Pay the ransom immediately✖ Paying funds crime and often doesn’t get your files back.Restore from a recent offline backup✔ Yes! Good backups make ransomware a nuisance, not a disaster.Turn the monitor off and on✖ That won’t unscramble encrypted files.Round 3🦹 Lord Leakalot cracks weak logins. Strongest choice?A short password you change weekly✖ Short is crackable no matter how often you change it.A long, unique passphrase plus MFA✔ Perfect. Length + uniqueness + MFA is a tough combo to beat.Your pet’s name✖ Easily guessed or found on social media.Round 4🧟 Dr. Update refuses to patch. Why is that dangerous?It uses extra electricity✖ Not the security issue here.Known vulnerabilities stay wide open to attackers✔ Right. Unpatched = a known door left unlocked.It makes the screen dimmer✖ Cosmetic, not a security risk.🌟 Flawless victory! All four villains defeated — +40 XP and a step closer to Guardian.✔ Each correct answer adds +10 XP to your score · Back to the arcade →×🚨Defend · IntermediateIncident Response SimThree alerts, three decisions. Think like a responder.Round 1A user reports they clicked a suspicious attachment. What’s your first move?Wait and see if anything breaks✖ Waiting lets malware spread. Act to contain it now.Isolate that device from the network✔ Correct. Containment first — cut off spread before it grows.Email everyone to warn them✖ Useful later, but containment comes first.Round 2You confirm malware is spreading between machines. Next?Reboot every computer at once✖ Reboots won’t stop active spread and may destroy evidence.Follow the incident response plan to contain and eradicate✔ Yes. A calm, planned response beats panic every time.Unplug the office coffee machine✖ Not part of the incident, tempting as it is.Round 3Systems are restored. What matters most now?Forget it and move on✖ Skipping review means the same thing can happen again.Run a lessons-learned review to prevent a repeat✔ Exactly. Every incident is a chance to close the gap for good.Delete all the logs✖ Logs are evidence and learning material — keep them.🌟 Textbook response! Contain, eradicate, learn — the SOC would hire you on the spot. +30 XP.✔ Each correct answer adds +10 XP to your score · Back to the arcade →×🔥Defend · IntermediateFirewall FrenzyYou ARE the firewall. Six connection requests are queued — approve only the traffic you’d let through. Attacks flag themselves red when you tap them.Safe traffic approved: / 3🏦Encrypted HTTPS session to your bank✔ Approved — encrypted traffic to a known, expected destination.🔄Update download from the official OS vendor✔ Approved — patches from the real vendor keep the fleet healthy.🎥Scheduled video call with a known partner✔ Approved — expected traffic on an expected port. Business as usual.📡Port scan sweeping every door from an unknown IP✗ Blocked! Someone is rattling every doorknob — classic reconnaissance.🌍One account, login attempts from 40 countries in an hour✗ Blocked! That’s credential stuffing, not a very frequent flyer.🌙Huge outbound upload to an unknown server at 3 a.m.✗ Blocked! Late-night data leaving the building screams exfiltration.3 of these belong on the network. The other 3 are attacks — tap them to see why the firewall says no.🌟 Perfect shift! You approved all 3 safe flows and let zero attacks slip past. The network sleeps soundly — +30 XP.✔ Each safe approval adds +10 XP · Back to the arcade →×🌎Career · IntermediateCyber Hero MissionThree real-world problems. Give the advice a pro would.Round 1A volunteer reuses one password across every account. Best advice?Add a ‘1’ to the end for each site✖ Predictable tweaks are easy to guess once one leaks.Use a password manager with unique passphrases✔ Perfect. Unique logins mean one leak doesn’t unlock everything.Write them all on one shared sticky note✖ Now everyone — including visitors — can read them.Round 2The office Wi-Fi has no password at all. Your fix?Hide the network name and call it secure✖ A hidden name is still open — anyone nearby can join.Turn on WPA2/WPA3 encryption with a strong key✔ Right. Proper Wi-Fi encryption keeps strangers off the network.Leave it open so guests are happy✖ Open Wi-Fi exposes everyone’s traffic and the whole network.Round 3A staffer gets an urgent text from the ‘director’ demanding gift cards. Do they…Buy the cards quickly to be helpful✖ That’s exactly what the scammer wants. Gift-card demands are a huge red flag.Verify through a known number — it’s likely a scam✔ Yes. Urgency + gift cards = classic impersonation scam. Always verify.Reply asking which shop to use✖ Engaging confirms you’re a live target and keeps the scam moving.🌟 Community protected! Three pro-grade calls in a row — +30 XP. That’s real hero work.✔ Each correct answer adds +10 XP to your score · Back to the arcade →×📱Career · BeginnerPrivacy Power-UpA friend hands you their phone: “Can you make my socials safer?” Make three pro moves.Round 1Their location is attached to every single post, in real time. Best move?Keep it on — friends like knowing where they are✖ Real-time location broadcasts where they are and when their home is empty.Turn off location tagging; share places after leaving, if at all✔ Exactly. Post the beach photo tomorrow — never a live map of your day.Only tag locations at night✖ Night tagging is arguably worse — it reveals where they sleep.Round 2A “Which pizza are you?” quiz app wants their full profile, photos and friend list. What do you tell them?Accept — it’s just a fun quiz✖ Fun quiz, serious harvest. Those permissions outlive the joke and feed data brokers.Deny it — the permissions are wildly beyond what a quiz needs✔ Right. Match permissions to purpose: a quiz needs none of that. Deny and delete.Accept, but delete the app next month✖ The data is copied the moment access is granted — deleting later doesn’t claw it back.Round 3Their public bio lists their birthday, hometown and pet’s name. Why does a security pro wince?It’s fine — that’s normal profile info✖ Normal, yes — and also the raw material for guessing passwords and security answers.It makes the profile look unprofessional✖ Style isn’t the issue — those three facts are.Those are exactly the answers to common security questions✔ Bingo. Birthday, hometown, pet’s name — attackers try these first. Keep them off public bios.🌟 Privacy pro! Your friend’s profile just went from open book to locked vault — +30 XP.✔ Each correct answer adds +10 XP to your score · Back to the arcade → ×🔎Detect · IntermediateSpot the VulnerabilityFour of the six items below are real risks. Tap each one you’d flag.Risks caught: / 4🗒️Password on a sticky noteRisk! Anyone walking by can read it. Never write passwords in plain sight.🔓Unlocked screen, nobody thereRisk! An open, unattended screen is an open door. Lock it when you step away.🔌Unknown USB stick plugged inRisk! Mystery USBs can carry malware. Never plug in devices you don’t trust.📎Suspicious attachment openedRisk! Opening unknown attachments is how a lot of malware gets in.🔒Auto-locking screensaver onSafe — a screen that locks itself is exactly what you want.🛡️Antivirus fully up to dateSafe — updated protection is good security hygiene, not a risk.Tip: 4 of these 6 are genuine security risks. Tap the ones you would flag.🌟 Eagle eyes! All 4 risks flagged and zero false alarms — that’s a real auditor’s instinct. +40 XP.Back to the arcade →×🔑Learn · BeginnerPassword PowerLength is your superpower. Test a passphrase, then pick the strongest.Try it live — type a passphrase:Start typing to test your strength.⚠ Too short — aim for 12+ characters. Keep going!✔ Strong! Long passphrases are very hard to crack. 🎉Length beats complexity: a long phrase of simple words wins. (Just don’t use a real password here!)BonusWhich of these is the strongest?P@ss1✖ Short and predictable — cracked in seconds.purple-tractor-cloud-village✔ Long and random-but-memorable. This is the way.qwerty123✖ One of the most common passwords on Earth. Avoid.Back to the arcade →×🛡️Defend · AdvancedBuild Your Security StackTap the tools that protect a small team. The traps will call themselves out.Defense score: / 6 solid tools🔑Multi-Factor Authentication✔ Smart — MFA blocks stolen passwords.🔥Firewall✔ Good — filters out hostile traffic.💾Offline backups✔ Essential — your ransomware safety net.🖥️Endpoint protection (EDR)✔ Strong — guards every device.🔄Regular updates & patching✔ Vital — closes known holes.🌐VPN on public Wi-Fi✔ Wise — encrypts traffic on risky networks.📝One shared admin password✗ Weakness! Shared logins destroy accountability.♻️Reused passwords everywhere✗ Weakness! One leak unlocks everything.🚫No screen lock✗ Weakness! Leaves every device wide open.Pick the 6 real protections — and notice the 3 traps turn red.🌟 Fortress built! Six solid layers, zero traps taken — defense in depth done right. +60 XP.Back to the arcade →×🧩Defend · AdvancedCyber Escape RoomSolve each clue to unlock the next. Three correct answers and you’re free.🔒 Lock 1Decode the motto: “Never ____, always verify.”Trust✔ “Never trust, always verify” — that’s Zero Trust. Lock 1 opens!Reboot✖ Not the motto. Try again — the lock stays shut.Encrypt✖ Close, but not the phrase. Keep thinking.🔒 Lock 2 Which is a strong passphrase to key in?123456✖ The most common password there is. Lock holds.river-lantern-otter-eleven✔ Long and unpredictable. Lock 2 clicks open!password!✖ Predictable and short. Still locked.🔒 Lock 3 A text from your “boss” demands urgent gift cards. The key move?Buy them fast to help✖ That’s the scam working. The door stays sealed.Verify on a known number first✔ Gift-card urgency = scam. You verify… and the door swings open!Reply to ask which shop✖ Engaging keeps the scam alive. Still trapped.🎉⭐🎊🛡️🎉⭐🎊🎉🎉You escaped!Three locks, three smart calls. You’ve got the defender’s instinct — and if you also aced Quiz Battle, check your new rank in the corner.Back to the arcade →×🚀Career · BeginnerCyber Career AdventureOne quick question reveals a cyber role that fits how you think.What sounds most like you?🔎Investigating clues & chasing alerts🛠️Building and securing systems📋Rules, risk and keeping order🧨Breaking things (ethically!)Your matchSOC Analyst / Incident ResponderYou’d thrive watching for threats and responding when something’s wrong.Try the CRISC range for incident-response practice → Certification ZoneYour matchSecurity EngineerYou like making things work — and making them safe by design.Try the Network+ range for hands-on defensive skills → Certification ZoneYour matchGRC AnalystGovernance, risk and compliance is where your organised mind shines.Try the CGRC / CRISC range for risk & governance tracks → Certification ZoneYour matchPenetration TesterYou love finding the cracks — legally, to help fix them.Try the PenTest+ range for offensive-security practice → Certification ZoneBack to the arcade →×📜Career · BeginnerCertification Path FinderPick your level and get a certification roadmap — all free to practise on Oluma.Where are you right now?🌱I’m brand new to cyber🌿I know the basics🚀I’m ready to specialiseBeginner roadmapCompTIA ITF+ — the absolute basics of IT & securityISC2 CC — your first true security certificationCompTIA Security+ — the industry’s classic entry certPractise these free →Intermediate roadmapCompTIA Network+ — how networks really workCompTIA CySA+ — defence & threat detectionCompTIA PenTest+ — hands-on ethical hackingPractise these free →Advanced roadmapISC2 CGRC — authorisation & risk management (RMF)ISACA CRISC — enterprise IT riskIAPP CIPT / CIPM — privacy by design & program managementPractise these free →Back to the arcade → XPHitsRank
🕵️DetectPhishing DetectiveThree messages just hit the inbox. Can you spot the phish before you click?Beginner3 min+50 XP▶ Play now
🎲DetectReal or Scam?Texts, offers and job posts — which are safe, and which are traps?Beginner4 min+60 XP▶ Play now
🔗DetectURL DetectiveThree lookalike web addresses per round — only one is the real site.Beginner4 min+60 XP▶ Play now
🔎DetectSpot the VulnerabilityScan the workspace and tap every security risk you can find.Intermediate5 min+75 XP▶ Play now
🔑LearnPassword PowerType a passphrase and watch it get stronger — then pick the toughest of the bunch.Beginner3 min+50 XP▶ Play now
🧠LearnCyber Word HuntMatch the plain-English clue to the right cyber term.BeginnerDaily+40 XP▶ Play now
🔐LearnCipher BreakCrack real codes — Caesar shifts, ROT13 and the logic of encryption.Intermediate5 min+75 XP▶ Play now
🎯LearnCyber Quiz BattleDefeat the cyber villains — one correct answer at a time.Intermediate6 min+90 XP▶ Play now
🚨DefendIncident Response SimYou’re the analyst on shift. Make the right call under pressure.Intermediate7 min+100 XP▶ Play now
🔥DefendFirewall FrenzyTraffic is hitting the network. Wave the safe packets through — and catch the attacks.Intermediate5 min+80 XP▶ Play now
🛡️DefendBuild Your Security StackChoose the tools that protect a small team — and avoid the traps.Advanced8 min+120 XP▶ Play now
🧩DefendCyber Escape RoomCrack three locks by solving cyber clues before you can escape.Advanced10 min+150 XP▶ Play now
🌎CareerCyber Hero MissionA local community group needs protecting. Be their cyber hero.Intermediate8 min+110 XP▶ Play now
📱Career · Life skillsPrivacy Power-UpTune up a social media profile like a privacy pro would.Beginner4 min+60 XP▶ Play now
🚀CareerCyber Career AdventureAnswer one question and discover the cyber role that fits you.Beginner5 min+80 XP▶ Play now
📜CareerCertification Path FinderPick your level and get a ready-made certification roadmap.Beginner4 min+70 XP▶ Play now