Zero Trust: Corporate Cyber Defense Simulator

Inspiration

Every day, millions of young kids log onto the internet and gaming platforms like Roblox, where they are relentlessly targeted by phishing links, fake Robux generators, social engineering, and account-stealing scams. According to cybersecurity reports, minors and non-technical users are among the most vulnerable demographics online, often losing their families' hard-earned money and personal information because cybersecurity education is trapped in boring, dense compliance lectures that kids tune out.

At SASE Hacks for Good, we asked ourselves: What if, instead of lecturing kids, we met them where they already play?

Rather than creating a game that glorifies being the scammer, Zero Trust flips the script. We turn digital literacy into an intense, arcade-style office defense game (Papers, Please meets Overcooked), where kids step up as protectors of real-world businesses, developing lifelong cybersecurity reflexes through engaging gameplay.

"We built Zero Trust to turn cybersecurity from a boring classroom lecture into an exciting co-op gaming experience, empowering the next generation of digital citizens to recognize fraud, protect their communities, and stay safe online."

Who It's For

Zero Trust is built specifically for:

Young Gamers & Digital Natives: Kids navigating online spaces who need to intuitively spot phishing links, impersonation tactics, and suspicious payment demands before clicking.

What It Does

Zero Trust transforms corporate cybersecurity triage into an exhilarating 9-to-5 office shift across a five-day workweek.

BloxOS Desktop Simulation: Players sit down at interactive 3D workstations and navigate a parody operating system equipped with RoMail, Company Directory, Banking Ledger, and RoNotes.
Real-World Scam Recognition Engines:
- Gift Card Fraud Detection: Players learn the golden cybersecurity rule: legitimate companies and government agencies never demand payment via retail gift cards.
- Directory & Invoice Auditing: Players learn to verify sender email addresses, bank routing numbers, and phone extensions against trusted internal directories rather than blindly trusting incoming requests.
- URL Slicing & Typosquatting: Players break suspicious web addresses into protocol, subdomain, and domain components to spot deceptive look-alike domains, such as robl0x-gift.net versus roblox.com.
Tactile Gamified Feedback: Every decision feels impactful through mechanical APPROVED and REJECTED stamp animations, camera shake, and combo streak multipliers that reward accuracy with increasingly high-pitched audio chimes.
Co-op Office Dynamic: Multi-desk lobbies let friends share a company budget and quota, delegate suspicious tickets, and discuss red flags in real time.
5:00 PM Performance Review: A daily debrief tallies money saved, false alarms, and scams thwarted, reinforcing learning outcomes before players clock out for the day.

If the team lets its company budget hit $0, the company goes under and everyone gets fired, reinforcing that security is a collective responsibility.

How We Built It

Game Engine & Client-Server Architecture: Developed entirely in Roblox Studio using Luau, ensuring accessibility across PC, mobile, and console.
Development Toolchain: Used Rojo to synchronize local code repositories with Roblox Studio, alongside the Roblox Studio MCP server for automated asset pipeline auditing.
Vector UI Architecture: Instead of relying on static image assets that may render inconsistently or scale poorly, we engineered BloxOS using native Roblox UI primitives, including UICorner, UIStroke, and UIGradient, for crisp rendering across screen resolutions.
150-Ticket Threat Database: Authored a database of 150 unique legitimate and fraudulent scenarios spanning five industry tiers: Local Bakery, Indie Game Studio, Logistics, BioPharma, and Defense Bunker.
*Multi-Phased agentic programming: * Developed the code around a plan and workflow where a weaker model would absorb reference and create a plan in an .md file that would be placed locally into the project folder. The more powerful work model then takes this plan and implements it.

Challenges We Ran Into

Balancing Education vs. Entertainment: If a game feels like homework, kids won't play it. We addressed this by replacing walls of educational text with tactile visual stamps, confetti bursts, escalating sound effects, and guided onboarding hints on Day 1.
Desktop UI Window Layering: Building a window manager with draggable, overlapping applications inside Roblox required custom robust, server-authoritative replication.

Accomplishments We're Proud Of

Social Impact at Scale: Created an engaging game that teaches essential digital safety habits to the demographic that needs them most, directly on the platform where they spend their time.
Fully Functional In-Game OS: Built BloxOS from scratch, featuring fluid window dragging, interactive taskbar trays, dynamic clocks, and an authentic desktop experience.
Zero-Image Vector UI: Delivered a clean, modern aesthetic entirely through coded UI elements and mathematical styling.

What We Learned

How to translate complex regulatory and cybersecurity concepts from CISA, the FTC, and the FBI's Internet Crime Complaint Center (IC3) into intuitive, kid-friendly game mechanics.
Advanced multiplayer state management, workstation claiming, and remote event handling in Roblox Luau.
The value of combining AI-assisted planning with structured code architecture to rapidly prototype an ambitious educational project during a single hackathon sprint.

What's Next for Zero Trust?

Branching Voice Phishing (Vishing) Intercepts: Timed, interactive phone call simulations that teach players to recognize urgency tactics and caller ID spoofing.
Quarantine Sandbox VM: A mini-app that lets players safely inspect suspicious email attachments within an isolated virtual environment.
Educational Classroom Edition: An analytics dashboard that allows teachers and parents to identify which scam categories students struggle with most and track their progress over time.