How Semrush Aced Security Engagement Optimization via Gamification

Searching for Something Better Than the Compliance Checkbox

Semrush’s previous program delivered training, but it had reached a plateau. Participation generated little enthusiasm, administration required significant effort and employees did not experience security awareness as a shared company initiative.

Dmitriy was familiar with Hoxhunt and ensured that the platform was considered, but he left the decision to the people who would operate the program. Paula and the security team independently concluded that its gamification, automation and employee experience best matched their goals.

“The main reason we switched was the gamification. We wanted to genuinely engage people in completing security awareness training. We also found Hoxhunt much easier to administer than the legacy platform.”

— Paula Pajate, Security Compliance Specialist, Semrush

“What we started with was a video and a checkbox. Hoxhunt was a world above that. Semrush has always had a strong competitive spirit, so the gamification and team competition made it a very good cultural fit.”

— Dmitriy Sokolovskiy, Senior Vice President of Information Security, Semrush

Putting People Before the Platform

Paula defined success by what employees did and said—not simply whether the platform delivered a module. Semrush introduced Hoxhunt through friendly internal communications supported by executive leadership, positioning the program as an opportunity to build skills rather than a system designed to catch mistakes.

That tone mattered. Employees who initially felt uncertain about simulated phishing soon began sharing positive feedback, while realistic simulations challenged even experienced security professionals. Successes were reinforced, and mistakes became immediate learning opportunities rather than causes for embarrassment.

“For me, human feedback is what matters most. This is the first time people have actually reached out and said, ‘This was so cool. This was so great.’ In the past, people completed training and that was it. Now they are telling us that they enjoyed it and learned something.”

— Paula Pajate

“The goal is not to catch people. That is a punishment-based approach to training. What I want is a positive experience that stays in the memory. When people come back and say, ‘This is cool, and I’m enjoying it,’ that is amazing.”

— Dmitriy Sokolovskiy

The Leaderboard Became the Message

Once the program began, competition helped promote it organically. Employees printed the leaderboards and displayed them in offices. Managers contacted the security team to identify outstanding training and improve their teams’ positions. Friendly rivalries that had started before launch became visible signs that security awareness was entering everyday company culture.

The leaderboard was more than a ranking. It gave employees a shared objective, made participation visible and encouraged teams to take ownership of their progress. Semrush is now considering additional rewards that could build on this momentum.

“After a week or two, people really got used to it. Now they are printing out the leaderboards in the offices to follow who is at the top, who is at the bottom and how they can compete with each other.”

— Paula Pajate

“Managers started asking, ‘How can I see who on my team hasn’t completed it? I want to get on the leaderboard.’ It is rare to get people excited about security tooling, so having them come to us and ask those questions is a very good sign.”

— Dmitriy Sokolovskiy

Automation Gave a Small Team Company-Wide Reach

Semrush's compliance team consists of 4 people, where only 2 of them, on top of their daily tasks, administer Hoxhunt and run security awareness. A manual company-wide program would have consumed time needed for analysis, employee support and broader security responsibilities.

Hoxhunt automates simulation selection, scheduling, training delivery and performance measurement. Semrush needed only limited launch communications before participation began spreading across the organization. The team can now spend more time understanding results and improving the program instead of coordinating repetitive administrative tasks.

“We really needed to reduce our workload in security awareness. We are a team of four, and only two of us are administering the platform. We use Hoxhunt for both phishing simulations and our security awareness modules.”

— Paula Pajate

“We sent one communication, maybe two, and we were already seeing strong numbers and positive outreach. That tells me the tool is doing work that we normally would have been doing ourselves.”

— Dmitriy Sokolovskiy

One Month In, the Culture Was Already Moving

Semrush reached 71% company-wide completion during its first month, while some teams achieved approximately 90–93%. The speed and breadth of participation exceeded expectations.

Because the program was still new, Semrush appropriately treated these figures as evidence of engagement—not yet as proof of long-term behavior change. Employees were still learning how to use the reporting button, and the security team planned to evaluate phishing reporting, failure trends and sustained participation at the three- and six-month marks.

Even at this early stage, the combination of employee enthusiasm, manager involvement and widespread completion represented an important cultural breakthrough.

“We are only one month in, and 71% completion is what we are most happy about. (We're at 80% now, after 6 weeks). We are aiming for 100%. People are still learning after the first month, but we are getting there slowly and surely.”

— Paula Pajate

“I expected a positive outcome, but I’m not sure I expected it to happen like this—the breadth of participation was so sudden. Usually, you see a trickle. This felt more like the whole team arrived at once.”

— Dmitriy Sokolovskiy

Making Mandatory Training Something People Choose to Enjoy

Semrush transformed security awareness from a fragmented compliance activity into a company-wide program employees actively discussed, shared and competed around. Automation made the program manageable for a small team, while gamification and positive reinforcement gave employees a reason to participate beyond the requirement to complete training.

The early results provide a strong foundation for measuring longer-term changes in reporting behavior and phishing resilience. More importantly, Semrush has begun replacing passive compliance with shared responsibility for security.

“I would recommend Hoxhunt to everybody. It’s great for organizations that want people to actually enjoy compliance training that is often treated as something mandatory. Hoxhunt really does the trick and helps employees enjoy the experience while completing it.”

— Paula Pajate

“Security practitioners need better tooling. We cannot do it alone. When a platform helps us involve people in the right way and gets them excited about participating, that is a win for the entire security team.”

— Dmitriy Sokolovskiy

‍

‍