The SECRIOUS project takes a game-based approach to improving knowledge and attitudes in cybersecurity practices. Our methodology includes interdisciplinary Serious Game co-design with coders and aims to produce critical reflection on participants’ own coding practice. To encourage this we created a series of Small Provoking Games (SPGs) about the project’s three overarching topics (Code Security; API Security; Security Lifecycle) and five co-produced themes (Coder Practices; Code Motivation; Morality; Resources; Communication). Games and play are well-suited for creating both reflection-in-action and reflection-on-action. Provoking a lasting change in attitudes towards secure coding practice requires dialogic or inquiry-based reflection leading to transformative reflection We define a ‘provoking game’ as one that uses the techniques of reflective game design to produce cognitive and affective challenge – a eudaimonic appreciation of the player experience. This emphasises a players’ sense of purpose and aims to create exo-transformation (change in attitudes and/or practice outside the game). SPG design foregrounded Khaled’s principles of reflective game design and was led by serious game experts, a cybersecurity expert, and a playwright but included input from the entire SECRIOUS team to define each game’s specific focus. Two SPGs were produced: Protection (which challenges the assumption of ‘absolute’ cybersecurity protection) and Collaboration (which highlights communication in cybersecurity developer teams) with a third in progress. SPGs feature highly exploratory gameplay, expected failure, and focus on metaphor (of both game objects and player actions) to create doubt, contradicting existing mental models and encouraging the players to question the game rules and underlying concepts. The games were used within game-jams to provoke critical discussion, a creative mindset, and group reflection. This paper analyses the design process of these two SPGs and reflects on our contribution to reflective game design.