Proofpoint is a trusted partner to over 80 of the Fortune 100, over 14,000 large enterprises, and millions of smaller organizations in stopping threats, preventing data loss, and building resilience across people and AI workflows. Proofpoint’s collaboration and data security platform helps organizations of all sizes protect and empower their people.

Its security awareness platform, ZenGuide (formerly Proofpoint Security Awareness Training), is used by more than 6,000 customers to train over 58 million end users.

Shortly after joining Proofpoint I was given the responsibility of improving the end-user experience for ZenGuide as the Product Manager for ZenGuide’s Learner Experience team.

The problem. Security training optimized for completion wasn't producing the behavior customers actually needed. I helped redefine success around real security actions, designed a system to reinforce those behaviors, and looked for evidence that stronger learner engagement translated into better security outcomes.

The design approach. We grounded the design in the Octalysis framework, running a series of internal workshops to map what actually motivates learners and then translated those core drives into mechanics that fit a security training context. The work kicked off in Fall 2025. Within roughly six months, we moved from early discovery and concept development to an Early Access launch in Spring 2026.

What we built.

• Points for completing valued actions like finishing training modules and reporting suspicious emails. Points were intentionally simple so users could understand the relative value of an action directly in the interface.

• Ranks (every 20 points) and Levels (every 100 points) to create visible progression and give learners attainable short and long-term goals.

• Badges for high-value real-world achievements, including correctly reporting an actual malicious email. This connected the reward system directly to the security outcomes customers cared about most.

The system continued to evolve after launch, with additional mechanics such as Streaks and Badges added in 2027.

The results. Following Early Access in Spring 2026, the new learner experience reached General Availability in Fall 2026 and exceeded 90% customer adoption by the end of the year.

More importantly, we saw a strong relationship between participation in the gamification system and phishing resilience. Companies with at least one user who earned the “Live One” badge for reporting a real malicious email had a 64% lower median click rate in phishing simulations than companies where no user had earned the badge.

The data showed correlation rather than proof of causation, but it gave us an important signal: the organizations showing the strongest engagement with real-world security behaviors were also substantially less likely to fall for simulated phishing attacks.

By rewarding the behaviors that mattered most, we turned engagement into a meaningful part of improving security outcomes.