A video game to improve the hiring process
It's no secret that we believe strongly in the power of gamification at Secure Code Warrior to engage developers to code securely. It's what we do, and the results have been amazing so far. But what about using an actual video game to assess potential new hires? Is that going a step too far, or could it possibly be an effective practice?
That's what the startup Scoutible is doing, and I have to say I'm intrigued by their approach. Scoutible assesses potential hires using a video game - not gamified assessments, but an actual video game experience - and checks how the person behaves in certain situations. The game captures "millions of data points used to measure a candidate's various attributes" during just 20 minutes of gameplay, and uses those data points to rate how the candidate would do for the job in question.
There's a lot to like here, and a lot to learn from as well. The product is flexible to meet their customers'needs, and it targets a problem that many people responsible for hiring have known for a long time. Self-reported assessment, like Myers-Briggs, just aren't reliable. They allow you to "game" the system, or at least try to, by not being entirely honest. In a game, you have an objective and must adapt and problem solve to meet that objective. It's quite simple, and ingenious if it works as Scoutible claims. I can't wait to hear more about it.
Gaming versus gamification
Scoutible's approach makes sense for their target audience and use case. At one point in Secure Code Warrior's journey, we considered the value of a full gaming platform, or mini games built into the training, but in the end that angle didn't really add enough value for our purposes. The end users who take our security training know they are supposed to be learning.
Within our Secure Code Warrior platform, we measure the secure coding skills of a software developer while using game-based elements to keep them engaged. That means keeping these questions in mind:
- Do they understand the most common software security weaknesses?
- Can they fix common security bugs using framework specific security functions?
- Are they confident about their software security skills?
- What are their strengths and skills gaps in terms of secure code?
Caring by design
There's another reason I can relate strongly with Scoutible's product. Not only is it a benefit to the hiring company, but also to the candidate. Not all strong candidates you'll encounter are good at interviewing. For some, it's just not in their personalities. For others, they might never have been taught the fine art of interviewing, or maybe they're new to the workforce and this is their first interview.
This is where I see a similarity with software developers. Sadly, there just isn't a focus on security in many university programs. Aspiring developers are told "You'll learn it on the job." They leave school knowing how to make their code work, but they unknowingly perpetuate all of the same vulnerabilities that we've been fighting against for 20 or more years.
When developers do get that job and ask to learn about security, they have even less time than when they were in school. They're paid to produce functional, effective software, and many of the developer security training courses ... well, they're boring. Let's be honest.
What if you could get your developers, new and old, to care about security without really thinking about it? How do you make training interesting, engaging, and even fun, while also still being effective?
That's our challenge, and just like Scoutible's, it's a very real one. Just because the problem is incredibly serious doesn't mean the solution has to be mundane and boring. We've tried that already. We prefer to inject a little fun, excitement, competition, and engagement into our solution. So far, it's worked very, very well.
I thought if we could build a tool that felt like a game, and incorporated tests for the appropriate personality and cognitive attributes, we could address many of the problems I'd been studying.
https://www.inc.com/kevin-j-ryan/scoutible-video-game-reinventing-the-hiring-process.html
Chief Executive Officer, Chairman, and Co-Founder
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoChief Executive Officer, Chairman, and Co-Founder
Pieter Danhieux is a globally recognized security expert, with over 12 years experience as a security consultant and 8 years as a Principal Instructor for SANS teaching offensive techniques on how to target and assess organizations, systems and individuals for security weaknesses. In 2016, he was recognized as one of the Coolest Tech people in Australia (Business Insider), awarded Cyber Security Professional of the Year (AISA - Australian Information Security Association) and holds GSE, CISSP, GCIH, GCFA, GSEC, GPEN, GWAPT, GCIA certifications.
It's no secret that we believe strongly in the power of gamification at Secure Code Warrior to engage developers to code securely. It's what we do, and the results have been amazing so far. But what about using an actual video game to assess potential new hires? Is that going a step too far, or could it possibly be an effective practice?
That's what the startup Scoutible is doing, and I have to say I'm intrigued by their approach. Scoutible assesses potential hires using a video game - not gamified assessments, but an actual video game experience - and checks how the person behaves in certain situations. The game captures "millions of data points used to measure a candidate's various attributes" during just 20 minutes of gameplay, and uses those data points to rate how the candidate would do for the job in question.
There's a lot to like here, and a lot to learn from as well. The product is flexible to meet their customers'needs, and it targets a problem that many people responsible for hiring have known for a long time. Self-reported assessment, like Myers-Briggs, just aren't reliable. They allow you to "game" the system, or at least try to, by not being entirely honest. In a game, you have an objective and must adapt and problem solve to meet that objective. It's quite simple, and ingenious if it works as Scoutible claims. I can't wait to hear more about it.
Gaming versus gamification
Scoutible's approach makes sense for their target audience and use case. At one point in Secure Code Warrior's journey, we considered the value of a full gaming platform, or mini games built into the training, but in the end that angle didn't really add enough value for our purposes. The end users who take our security training know they are supposed to be learning.
Within our Secure Code Warrior platform, we measure the secure coding skills of a software developer while using game-based elements to keep them engaged. That means keeping these questions in mind:
- Do they understand the most common software security weaknesses?
- Can they fix common security bugs using framework specific security functions?
- Are they confident about their software security skills?
- What are their strengths and skills gaps in terms of secure code?
Caring by design
There's another reason I can relate strongly with Scoutible's product. Not only is it a benefit to the hiring company, but also to the candidate. Not all strong candidates you'll encounter are good at interviewing. For some, it's just not in their personalities. For others, they might never have been taught the fine art of interviewing, or maybe they're new to the workforce and this is their first interview.
This is where I see a similarity with software developers. Sadly, there just isn't a focus on security in many university programs. Aspiring developers are told "You'll learn it on the job." They leave school knowing how to make their code work, but they unknowingly perpetuate all of the same vulnerabilities that we've been fighting against for 20 or more years.
When developers do get that job and ask to learn about security, they have even less time than when they were in school. They're paid to produce functional, effective software, and many of the developer security training courses ... well, they're boring. Let's be honest.
What if you could get your developers, new and old, to care about security without really thinking about it? How do you make training interesting, engaging, and even fun, while also still being effective?
That's our challenge, and just like Scoutible's, it's a very real one. Just because the problem is incredibly serious doesn't mean the solution has to be mundane and boring. We've tried that already. We prefer to inject a little fun, excitement, competition, and engagement into our solution. So far, it's worked very, very well.
I thought if we could build a tool that felt like a game, and incorporated tests for the appropriate personality and cognitive attributes, we could address many of the problems I'd been studying.
https://www.inc.com/kevin-j-ryan/scoutible-video-game-reinventing-the-hiring-process.html
It's no secret that we believe strongly in the power of gamification at Secure Code Warrior to engage developers to code securely. It's what we do, and the results have been amazing so far. But what about using an actual video game to assess potential new hires? Is that going a step too far, or could it possibly be an effective practice?
That's what the startup Scoutible is doing, and I have to say I'm intrigued by their approach. Scoutible assesses potential hires using a video game - not gamified assessments, but an actual video game experience - and checks how the person behaves in certain situations. The game captures "millions of data points used to measure a candidate's various attributes" during just 20 minutes of gameplay, and uses those data points to rate how the candidate would do for the job in question.
There's a lot to like here, and a lot to learn from as well. The product is flexible to meet their customers'needs, and it targets a problem that many people responsible for hiring have known for a long time. Self-reported assessment, like Myers-Briggs, just aren't reliable. They allow you to "game" the system, or at least try to, by not being entirely honest. In a game, you have an objective and must adapt and problem solve to meet that objective. It's quite simple, and ingenious if it works as Scoutible claims. I can't wait to hear more about it.
Gaming versus gamification
Scoutible's approach makes sense for their target audience and use case. At one point in Secure Code Warrior's journey, we considered the value of a full gaming platform, or mini games built into the training, but in the end that angle didn't really add enough value for our purposes. The end users who take our security training know they are supposed to be learning.
Within our Secure Code Warrior platform, we measure the secure coding skills of a software developer while using game-based elements to keep them engaged. That means keeping these questions in mind:
- Do they understand the most common software security weaknesses?
- Can they fix common security bugs using framework specific security functions?
- Are they confident about their software security skills?
- What are their strengths and skills gaps in terms of secure code?
Caring by design
There's another reason I can relate strongly with Scoutible's product. Not only is it a benefit to the hiring company, but also to the candidate. Not all strong candidates you'll encounter are good at interviewing. For some, it's just not in their personalities. For others, they might never have been taught the fine art of interviewing, or maybe they're new to the workforce and this is their first interview.
This is where I see a similarity with software developers. Sadly, there just isn't a focus on security in many university programs. Aspiring developers are told "You'll learn it on the job." They leave school knowing how to make their code work, but they unknowingly perpetuate all of the same vulnerabilities that we've been fighting against for 20 or more years.
When developers do get that job and ask to learn about security, they have even less time than when they were in school. They're paid to produce functional, effective software, and many of the developer security training courses ... well, they're boring. Let's be honest.
What if you could get your developers, new and old, to care about security without really thinking about it? How do you make training interesting, engaging, and even fun, while also still being effective?
That's our challenge, and just like Scoutible's, it's a very real one. Just because the problem is incredibly serious doesn't mean the solution has to be mundane and boring. We've tried that already. We prefer to inject a little fun, excitement, competition, and engagement into our solution. So far, it's worked very, very well.
I thought if we could build a tool that felt like a game, and incorporated tests for the appropriate personality and cognitive attributes, we could address many of the problems I'd been studying.
https://www.inc.com/kevin-j-ryan/scoutible-video-game-reinventing-the-hiring-process.html
Click on the link below and download the PDF of this resource.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
View reportBook a demoChief Executive Officer, Chairman, and Co-Founder
Pieter Danhieux is a globally recognized security expert, with over 12 years experience as a security consultant and 8 years as a Principal Instructor for SANS teaching offensive techniques on how to target and assess organizations, systems and individuals for security weaknesses. In 2016, he was recognized as one of the Coolest Tech people in Australia (Business Insider), awarded Cyber Security Professional of the Year (AISA - Australian Information Security Association) and holds GSE, CISSP, GCIH, GCFA, GSEC, GPEN, GWAPT, GCIA certifications.
It's no secret that we believe strongly in the power of gamification at Secure Code Warrior to engage developers to code securely. It's what we do, and the results have been amazing so far. But what about using an actual video game to assess potential new hires? Is that going a step too far, or could it possibly be an effective practice?
That's what the startup Scoutible is doing, and I have to say I'm intrigued by their approach. Scoutible assesses potential hires using a video game - not gamified assessments, but an actual video game experience - and checks how the person behaves in certain situations. The game captures "millions of data points used to measure a candidate's various attributes" during just 20 minutes of gameplay, and uses those data points to rate how the candidate would do for the job in question.
There's a lot to like here, and a lot to learn from as well. The product is flexible to meet their customers'needs, and it targets a problem that many people responsible for hiring have known for a long time. Self-reported assessment, like Myers-Briggs, just aren't reliable. They allow you to "game" the system, or at least try to, by not being entirely honest. In a game, you have an objective and must adapt and problem solve to meet that objective. It's quite simple, and ingenious if it works as Scoutible claims. I can't wait to hear more about it.
Gaming versus gamification
Scoutible's approach makes sense for their target audience and use case. At one point in Secure Code Warrior's journey, we considered the value of a full gaming platform, or mini games built into the training, but in the end that angle didn't really add enough value for our purposes. The end users who take our security training know they are supposed to be learning.
Within our Secure Code Warrior platform, we measure the secure coding skills of a software developer while using game-based elements to keep them engaged. That means keeping these questions in mind:
- Do they understand the most common software security weaknesses?
- Can they fix common security bugs using framework specific security functions?
- Are they confident about their software security skills?
- What are their strengths and skills gaps in terms of secure code?
Caring by design
There's another reason I can relate strongly with Scoutible's product. Not only is it a benefit to the hiring company, but also to the candidate. Not all strong candidates you'll encounter are good at interviewing. For some, it's just not in their personalities. For others, they might never have been taught the fine art of interviewing, or maybe they're new to the workforce and this is their first interview.
This is where I see a similarity with software developers. Sadly, there just isn't a focus on security in many university programs. Aspiring developers are told "You'll learn it on the job." They leave school knowing how to make their code work, but they unknowingly perpetuate all of the same vulnerabilities that we've been fighting against for 20 or more years.
When developers do get that job and ask to learn about security, they have even less time than when they were in school. They're paid to produce functional, effective software, and many of the developer security training courses ... well, they're boring. Let's be honest.
What if you could get your developers, new and old, to care about security without really thinking about it? How do you make training interesting, engaging, and even fun, while also still being effective?
That's our challenge, and just like Scoutible's, it's a very real one. Just because the problem is incredibly serious doesn't mean the solution has to be mundane and boring. We've tried that already. We prefer to inject a little fun, excitement, competition, and engagement into our solution. So far, it's worked very, very well.
I thought if we could build a tool that felt like a game, and incorporated tests for the appropriate personality and cognitive attributes, we could address many of the problems I'd been studying.
https://www.inc.com/kevin-j-ryan/scoutible-video-game-reinventing-the-hiring-process.html
Table of contents
Chief Executive Officer, Chairman, and Co-Founder
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoDownloadResources to get you started
Resources to get you started
10 Key Predictions: Secure Code Warrior on AI & Secure-by-Design’s Influence in 2025
Organizations are facing tough decisions on AI usage to support long-term productivity, sustainability, and security ROI. It’s become clear to us over the last few years that AI will never fully replace the role of the developer. From AI + developer partnerships to the increasing pressures (and confusion) around Secure-by-Design expectations, let’s take a closer look at what we can expect over the next year.
OWASP Top 10 For LLM Applications: What’s New, Changed, and How to Stay Secure
Stay ahead in securing LLM applications with the latest OWASP Top 10 updates. Discover what's new, what’s changed, and how Secure Code Warrior equips you with up-to-date learning resources to mitigate risks in Generative AI.
Trust Score Reveals the Value of Secure-by-Design Upskilling Initiatives
Our research has shown that secure code training works. Trust Score, using an algorithm drawing on more than 20 million learning data points from work by more than 250,000 learners at over 600 organizations, reveals its effectiveness in driving down vulnerabilities and how to make the initiative even more effective.
Reactive Versus Preventive Security: Prevention Is a Better Cure
The idea of bringing preventive security to legacy code and systems at the same time as newer applications can seem daunting, but a Secure-by-Design approach, enforced by upskilling developers, can apply security best practices to those systems. It’s the best chance many organizations have of improving their security postures.