Security awareness programs and assessments often demonstrate high performance from the participants. Despite this, in real-life, security (cybersecurity) attacks often succeed because of some human error or poor judgment. We postulate that one reason for this difference is because the assessment methods grade the participants’ awareness higher than it actually is. Unlike in question-based assessments, real life often presents scenarios involving several sub-decisions, each requiring careful attention. We attempted to assess the security awareness of enterprise employees by focusing on certain real-life scenarios and developed a security-oriented serious game called ‘Right Turn’. The participants’ game responses were assessed not just on a question-answer basis, but also on the overall correctness of the scenarios having multiple sub-decisions. Our exploratory study with 5,932 participants from an enterprise setting indicates that despite having good correctness in ‘answering questions’, the participants showed inferior performance in overall ‘scenarios’ within the game. In this paper, we provide a unique perspective on gauging the performance of security serious games.