Johnson Controls cybersecurity culture campaign

Using creative campaigning and gamification to grow a culture of cybersecurity at Johnson Controls

Additional credits

Illustration:

Animation:

Johnson Controls is a world leader in smart buildings, creating safe, healthy, and sustainable spaces. With a globally distributed workforce, strong cybersecurity habits are essential, but difficult to implement at scale. Seizing an opportunity to make and deploy something that would stand out, Johnson Controls partnered with Sans Serif to design and deploy a gamified cybersecurity campaign that could be implemented by a small but motivated cyber comms team. Grounded in evidence-based strategy, it uses automation and space-themed guides personifying digital security practices to drive engagement, provide timely, quality feedback, and cultivate a culture of cyber vigilance.

Cybersecurity

The mission: Stand out and build a culture of cybersecurity

The Johnson Controls security comms team recognized a window of opportunity to target a culture of cybersecurity. It also faced two common challenges: training fatigue and the torrent of corporate communications reaching employees in offices, homes, and the field. We set clear objectives, best met through a creative, marketing-style campaign emphasizing shared responsibility for consistent digital security practices. By tapping into pride in customer centricity, we reinforced that good cybersecurity is good customer service.

Enter the Cyber Defenders

Leaning into emotional motivators, we emphasized meeting workers where they are. Because research shows that story supports habit-building, we anchored our approach in narrative. After exploring several concepts, one approach stood out: a group of approachable, mission-driven characters called the Cyber Defenders. Each embodies a set of cybersecurity skills. Together, they support employees as they defend a spacecraft in CyberSpace, a dramatized environment representing the digital security challenges and choices workers face every day. Working with 3D artist Aarón Martinez, the Cyber Defenders were given visual form and placed in eye-catching environments and scenarios.

No items found.

Automating an evidence-based approach to behavior change

We identified automation plugins that work in the platforms Johnson Controls already uses to simplify implementation. After constructing a comprehensive plan around an automated feedback-and-reward loop for employees, we built SharePoint pages and banners to flesh out the characters and the campaign. The plan includes progressive tasks for each month, from small-stakes to critical engagement, using tactics supported by evidence of how learning, habit formation, and culture-building work.

Missions, verbal-visual guidelines, campaign, rollout

With a campaign story and characters in hand, it was time to fill in the details. Sans Serif supplied thematic mission introductions to draw Johnson Controls employees into the story and make them part of the action. Building on the 3D graphics, we partnered with animation studio Strange Flock and voice-over artist Greg Marsten to render a 30-second tease video to generate excitement for the Cyber Defenders.

To hand off the campaign, Sans Serif developed easy-to-use verbal-visual guidelines to empower our direct clients and the wider Johnson Controls teams to activate it going forward.

No items found.

Rollout and an enthusiastic response

Access to the monthly missions and tasks opened in October, Cybersecurity Awareness Month. Participation on SharePoint has grown exponentially in number every month since. We’re thrilled to support the Johnson Controls cybersecurity efforts with a standout creative campaign anchored in real, evidence-based tactics. And it felt great to receive one client’s feedback that we not only brought outstanding creative chops, but also real cybersecurity knowledge—we didn’t need to have concepts and issues explained to us. Instead, we cut straight to bolstering the cybersecurity culture of Johnson Controls.

No items found.