I perform pentesting from time to time and was at a financial company meeting with their architects, etc., it was conveyed to me that their Information Security "guru" had come on board and tried doing something similar. The outcome was horrible. I was told many were offended by the manner in which this person was conveying security and risk. E.g.: He had cardboard cutouts of people with guns with verbiage like: "This criminal wants your password, etc."
Businesses are in the business to make money. Security has no tangible ROI and anyone pitching stats (AV*EF=SLE) whether it is qualitative, or quantitative. Arguments can be made for and against this and Murphy's Law will trump them all. With that said, what benefit does a company have in spending tangible resources for a game.
Now, this was answered in the sense that, I inferred it to be a question towards security policies and procedures as a whole. The "hacme bank" comment might work in a security based field, it may work to illustrate risk to say programmers and web developers, but to the average person (receptionist, account manager), they'd be like a deer in headlights (confused).
A program like this, would cost (man hours, time spent away from work for games, etc), so unless it can be proven to say Board Members (in a big corp.), seniors (CEO, CFO, etc), that it can MAKE money somehow, I don't see it becoming a norm. While you can pitch: "It can save money" to a CEO, COO, CFO, they're likely to look for a "technical" solution (firewall, email proxy, etc) which is more cost effective than having say N amount of man hours lost on a game.
Do the math:
Big Corp (10,000 employees)
Security Game (1/2 hour of time)
Game Plays (once per quarter)
Employee Salary $7.25
If everyone was paid minimum wage, the cost per play in wages would be $36,250.00 per quarter, not including the cost to set it up, any servers, potential business losses due to someone playing, etc. At this pace, keeping people informed normally (once per quarter) and it would cost $145,000.00 on salaries alone. (7.25 [salary] * 10,000 [# of employees] / 2 [half hour of time] * 4 [times per year]) A CEO/CFO/CTO is immediately going to look for a technology to solve this issue. E.g., an email proxy server to detect phishing may cost $30,000.00, a quick email, costs nothing. Doesn't make too much financial sense to bring "games" into the environment. Business is just that, about making money.