2026 Cyber Security Awareness Month Phishing Derby

Opt in below to take part in our Phishing Derby, where you'll receive four simulated phishing emails throughout October. Sponsored by Information Security and Data Privacy in celebration of Cybersecurity Awareness Month, this challenge is a fun way to sharpen your phishing detection skills!

THE RULES: 1. You must sign up to participate 2. You must report all four simulations correctly within three days of the email arriving in your inbox. 3. Don't ruin the game for others - when you find one of the simulations - keep it to yourself (and report it). 4. If you click on a link in one of the phishing emails, you can still be entered to win as long as you report it.

HOW TO REPORT: All four messages should be reported to phishing@harvard.edu by forwarding the email or by using the 'Report' button in Outlook. The simulated phish in this contest will be more challenging than what you see in the monthly simulations, but we will never impersonate someone from the university.

HOW TO WIN: One winner will be selected from the group of people who report all four emails, however, you will be on the list as someone who successfully completed the derby. The list will be shared on Slack!

Sign up for the 2026 Phishing Derby

Enrollment ends on September 30