Qualitative research methods from psychology and social sciences are feasible tools to gain deep understandings of people’s IT security behaviour, knowledge, sentiments and routines. One of these methods, individuals’ own expression in the form of drawings, sketches, charts and other visual representations, are important to understand deep knowledge and mental models. However, those methods are, to some degree, dependent on the artistic skills of the participants – those that are not confident in their handwriting and drawing might engage less. Building Blocks (sets of interlocking bricks) require less artistic ability and it is very easy to engage participants – they can just start building. IT security researchers already used such bricks to model participants thoughts, but in heterogeneous ways. We on the other hand used the LEGO \(^{\copyright }\) SERIOUS PLAY \(^{\copyright }\) (LSP) method – that describes a structured way on how to build models – to conduct four workshops (with \(n=48\) participants in total), in which the participants were asked to build multiple models of everyday IT security in different contexts. We performed a first initial coding of the pictures we took during the workshops. In this paper we report our research method, what we did to improve the workshops and data collection and what we learned so far by using LSP.