GRTgaz: High-Level Cybersecurity Awareness

“In the gas sector, raising employee awareness about cybersecurity is crucial. Our core business is extremely sensitive and critical; we manage over 32,000 km of pipelines in France to supply our B2B clients: industrial sites, managers, electricity production plants…,” explains Sarah Ribeiro Morais, in charge of cybersecurity awareness at GRTgaz. “A single cyberattack on our facilities could paralyze delivery sites, and three-quarters of mainland France would be left without gas!”

This succinctly sums up the cybersecurity challenges highlighted by Sarah Ribeiro Morais. Gas infrastructures are potential targets for cybercriminal attacks due to their critical importance. Beyond the high operational risk, GRTgaz must also protect sensitive data (such as operational information and security plans) and defend against phishing attacks designed to compromise systems.

Cybersecurity: Everyone Has a Role to Play at GRTgaz

Managing confidentiality and passwords, ensuring regular updates… Employee awareness is crucial, and everyone must become a “strong link in the chain” to maintain a high level of security. “Unfortunately, we found that employees were not very receptive to webinars and e-learning sessions,” admits Sarah Ribeiro Morais. “We needed to find a different format, something more innovative and engaging.”

The gas giant then turned to Onepoint to shape its approach. “The escape game quickly became an obvious solution for us—it’s both fun and immersive, allowing employees to take an active role in cybersecurity,” explains Amandine Larrieu, Onepoint design consultant. “It complements more traditional training and helps strengthen team cohesion.” This is a key factor in building a shared “security mindset” across the company, enabling a fast and coordinated response in case of suspicious activity.

An Escape Game Against Cyber Malice

“A desk with a computer”: that’s what GRTgaz employees find when they enter the research room. At first glance, everything seems normal, until a warning message suddenly appears on the screen: hackers announce they’ve locked the computer system. “In 30 minutes, salaries will be diverted!” the message says. “You have the only computer that can block the virus!” Sarah Ribeiro Morais then informs them. To thwart the cyberattack, employees must collaborate and work as a team. The goal? Identify all the cybersecurity mistakes to stop the attack. Amandine Larrieu adds, “They have everything they need to succeed. Flyers, documents… but most importantly, a team! This is often where things go wrong. Some identify the vulnerabilities quickly, but simply forget to communicate them.”

Launched as a “pilot” version, the escape game has been well-received by many employees, who were impressed by the concept. And the results speak for themselves: “I can’t obviously check whether employees remember to change their professional or personal passwords,” continues the program manager at GRTgaz. “However, our monitoring tools show the effectiveness of the program, particularly regarding the fake phishing tests sent monthly and through the tracking of updates or critical application downloads.”

Onepoint, a Creative Partner

The choice of Onepoint to create this escape game was no coincidence. Sarah Ribeiro Morais is clear about it: “Among the listed partners, Onepoint’s experts stood out due to their innovative solutions and impactful content.”

To develop the concept, a creative process was established in several steps:

• Creative development and pedagogical integration through co-creation workshops with the client
• Development of the game mechanics with gamification experts
• Creation of prototypes and validation tests to verify playability, balance, and player satisfaction.

“This project was entrusted to a multidisciplinary team of experts (e-learning specialists, game designers, graphic designers, developers, etc.), who worked closely with GRTgaz through to the pilot session phase,” says Amandine Larrieu. “It became clear that the escape game was truly the most relevant tool for raising awareness about cybersecurity issues. The game is an excellent learning vector because it stimulates emotions while anchoring lessons through the experience created.”

And After:

Already implemented with renowned clients like Edenred, gamification has taken on a new dimension at GRTgaz, which plans to complement the initial training with a new “cybersecurity” escape game focused on higher levels of maturity.