Chocoblast: Security Awareness Through Play

You just left your desk to grab a coffee. Your computer stayed unlocked. When you come back, a message has been sent from your mailbox to the whole team: you are bringing chocolate pastries tomorrow morning. Welcome to the world of Chocoblast.

Its History

Chocoblast appeared in 1998 in Switzerland after the national soccer team failed to qualify for the World Cup. The famous Swiss brand Milka saw its chocolate sales drop. The chocolate maker then came up with a strategy to make chocolate pastries not just a treat to buy, but also a "punishment." And what better way to do it than to infiltrate companies?

Since then, the concept has gone well beyond Swiss borders. Adopted by companies of all sizes in France, Belgium, and beyond, Chocoblast has become a true ritual in many technical teams. What started as a marketing stunt has become a recognized and appreciated information security awareness tool, precisely because it does not look like a classic training course.

Its Goal: Protect Access to Computers!

The concept is quite simple and fun! If an employee leaves their computer unlocked while leaving the room, one of their colleagues can chocoblast them. All it takes is opening the target's mailbox, Teams, or Slack and sending a message to all the other employees announcing that they are bringing chocolate pastries (and since we are in the north of France, for us it means the little buns).

The chocoblasted person must then bring pastries within 10 days of the offense, at their own expense. It also makes for a friendly moment for the team!

How It Works in Practice

In practice, Chocoblast takes a few seconds. The colleague spots an unlocked, unattended workstation. They sit down, open the email client or the internal communication tool, and write a short, cheerful message such as: "Hi everyone, tomorrow morning it's my treat, I'm bringing pastries!" The message goes to the whole team, sometimes with a personal touch of humor. The whole thing takes less than thirty seconds, exactly the time a malicious person would need to access sensitive data.

Some teams go further by adding a photo taken with the workstation's webcam, changing the wallpaper to a funny image, or temporarily editing the email signature. These variants always stay good-natured and must never cause real harm. The goal is to leave a mark without ever humiliating anyone, so that the lesson sticks in a good mood.

Security and Awareness

We invite you to adopt this playful game, which raises awareness across the whole team about the risks of data leaks. In fact, as soon as you leave your workstation unlocked, it is a danger to the company, because your computers have a USB port, sensitive files, emails, and contact details within reach that can serve malicious purposes. We are mainly talking about industrial espionage, identity theft, and social hacking, and it opens the door to every other kind of hack that can harm you and the company.

The goal of this game is to get employees to make a habit of locking their computers as soon as they are no longer in front of them or can no longer watch them. To better understand the technical vocabulary of web developers (in French), including security-related terms, we also wrote a complete guide. That is why very precise rules have been put in place.

The Threats Behind an Unlocked Workstation

An unlocked computer in an open space, even for two minutes, opens the door to very real scenarios. A visitor, a contractor, or even a malicious colleague can, within moments, copy files to a USB stick, view confidential documents, access passwords saved in the browser, or send a fraudulent email in the absent employee's name.

In the context of social engineering, an attacker can exploit an open workstation to install spyware, change security settings, or access internal systems the victim has rights to. The consequences can range from a customer data leak to a complete compromise of the company network. To better understand how these vulnerabilities are cataloged and exploited, it is worth looking at CVE flaws and how they work (in French). Chocoblast makes these risks tangible by showing, harmlessly, how easy it is to act on an unprotected workstation.

A Few Rules

• All employees must receive the written message
• If the chocoblaster is caught in the act, they become the chocoblasted
• You cannot prank someone who is still in the room, or whose computer is running a long and complex task and who could not lock it for that reason

Adapting the Rules to Your Team

Each company can extend these basic rules to fit its culture and organization, just as it adapts its coding conventions (in French) to its specific needs. Some teams set a grace period of a few seconds after leaving the desk, to avoid abusive chocoblasts when someone just gets up to grab a document from the printer. Others define protected zones, such as meeting rooms where a shared screen is being presented.

It is also common to keep a scoreboard, displayed in the common area or on a dedicated channel, that tracks the number of chocoblasts received and given by each team member. This purely humorous ranking keeps the game going all year long and creates positive emulation around vigilance.

A Complement to Formal Training

Chocoblast does not replace a real application security (in French) policy. Classic training, IT charters, and security audits remain essential to cover the full range of risks: phishing, password management, software updates, backups, and GDPR compliance.

But where these formal measures can sometimes feel restrictive or tedious, Chocoblast pulls a different lever: emotional memory. People remember a lesson learned in a burst of laughter far better than an instruction read in a thirty-page document. An employee who has been chocoblasted once never forgets to lock their workstation again. The reflex becomes automatic, rooted in a lived experience rather than a theoretical obligation.

Combining Chocoblast with regular awareness sessions gives a complete approach: training provides the technical knowledge, and the game turns that knowledge into daily habits. To structure these sessions, there are concrete methods to train your teams in IT security (in French) without it becoming a burden. This complementarity is what makes a lasting security culture strong within a team.

The Impact on Team Culture

Beyond pure security, Chocoblast helps create a more tightly knit work environment. Pastry mornings become moments of sharing where people chat, laugh at the chocoblasted colleague's misadventure, and strengthen the bonds between coworkers. In an era when remote work can sometimes isolate employees, these collective rituals have real value.

Chocoblast also builds collective vigilance, much like the rubber duck method (in French) encourages developers to verbalize their problems to solve them better. Every team member becomes a security player, attentive not only to their own workstation but also to their neighbors'. This shared responsibility goes beyond simple screen locking: it creates a mindset where security is no longer seen as a constraint imposed by management, but as a natural reflex carried by the group.

Chocoblast x Efficience IT

Since the start of the adventure in 2018, we have enjoyed teasing each other at Efficience IT. All the more so when it gives us the chance to have breakfast together around delicious chocolatey treats (or others).

It seemed important to us to set up a game like this to guarantee our clients complete confidentiality and security for the data we hold. Locking your screen has now become a reflex for all our employees, both for the game and for the security of their information!

Over time, chocoblasts have become rarer here, which is precisely the sign that the game has done its job. Workstations are locked, reflexes are ingrained, and a security culture is an integral part of our daily life. We recommend that every company, whatever its size, adopt this simple and effective practice to strengthen its security posture while cultivating good spirits at the office.

Going Further

• Coding conventions: a foundation for quality, set shared rules to reduce errors and standardize practices
• How does an audit work at Efficience IT? (in French), understand how a security and code quality audit unfolds
• Technical debt: should you really be afraid of it? (in French), understand why neglecting best practices fuels technical debt
• ANSSI: IT Hygiene Guide, best practices for digital security in business
• OWASP: Open Web Application Security Project, reference resources on web application security
• CNIL: Personal Data Security, obligations and recommendations for protecting data