The Challenge

What does it take to make security content feel like it belongs to your brand??

Camelot ran the UK's National Lottery, generating tens of millions of pounds a week for good causes across the country under a mandate from the Gambling Commission. That scale came with a heavily regulated environment and a high bar for compliance- and a workforce that needed to stay genuinely sharp on cybersecurity, not just get through it.

The standard approach wasn't working. Employees could complete an online training course, tick the box, and move on without the material ever crossing their mind again. For a data protection team trying to build habits that actually change how people respond to a suspicious email, that's not a passing grade — it's the whole problem. Camelot didn't want a better version of the same training. They wanted something loud enough to cut through the noise in everyone's inbox.

The Approach

What does a bespoke security culture campaign look like?

Generic training content wasn't going to shift a culture this distinct, and Camelot didn't want a production partner who treated cybersecurity as a subject to illustrate rather than a habit to build. We built a five-film series from scratch, combining live-action footage of Camelot's own employees with original puppet characters — sketch comedy with a clear behavioral job to do underneath the jokes.

Each film targeted a specific theme: information access and sharing, incident reporting, spotting a social engineer, and acting with security and integrity in mind. We filmed on location at Camelot's offices outside London, so the humour was rooted in a workplace employees recognised as their own, not a studio dressed to look corporate. That's the difference between hiring a production team and working with a partner who understands culture, psychology, and cybersecurity together- content built to be remembered, not just watched once and filed away.

The Results

What changes when security becomes part of your culture, not apart from it?

Employees laughed out loud watching the films — and kept talking about them for months afterward, according to feedback that reached Camelot's leadership team directly. That's a different outcome than a completed-training report. The films found a life well past their first watch: replayed on office screens, dropped into meetings, and used at company gatherings, which meant the investment kept paying out long after the initial launch.

The bigger shift was in how security content was received. Instead of arriving as one more mandatory module to get through, it became something employees looked forward to and referenced afterward- proof that engagement, not just completion, is what makes a security message stick.

What Changed — and Why It Matters

Most security training sounds like security training, regardless of how distinctive the brand around it is. Camelot needed the opposite: content that sounded like Camelot first and covered security second. That's exactly where CHANGE operates — bespoke films, characters, and campaigns built around an organisation's actual culture and behaviours, not a stock template with the logo swapped in.

It matters because completion and engagement are not the same thing, and only one of them changes behaviour. A workforce that laughs at a security film, remembers it months later, and asks to see it again in a meeting is a workforce that's actually absorbed the message. Boring content doesn't achieve that — no matter how compliant it looks on a training report.

Cyber Learning Experience

Managed Phishing

Content as a Service

Custom Cyber Content

Human Risk Baseline

HRM Advisory & Program Management

AI Enablement & Change

Agentic Readiness & Change

Why Cybermaniacs

About Us

Partners

Contact Us

CASE STUDY

Key Stats