A Challenge of Developing Serious Games to Raise the Awareness of Cybersecurity Issues

This paper examines whether serious games can help raise awareness and knowledge of cybersecurity, particularly targeted email attacks, to address a shortage of cybersecurity personnel in Japan, which the authors cite as roughly 80,000 people. The approach uses a Game Jam format, in which a Serious Game Jam for Cyber Security was organized in 2014 with academic and industry participants. Around 60 university students proposed 42 game concepts, six were prototyped over two days, and three were refined into finished games: Mail Stock Farm Story, Security Growth, and The Multi-tasking, which simulate sorting good and bad email, building cyber knowledge through a dating simulation, and handling office email under time pressure, respectively.

The effectiveness of these games was tested in three experiments conducted between October and December 2014 at three universities, involving 152 students across engineering, arts, and social science majors. Participants were divided into serious game, e-learning (Moodle), written material, and no-learning groups, and knowledge was measured with 25-question quizzes derived partly from a national government IT examination, with results compared using deviation scores. The authors report that about 50 percent of students in the serious game groups improved their scores, compared with 24 percent in the no-learning control group and lower ratios for written materials (37.5 percent) and e-learning (44.4 percent), leading them to conclude that serious games outperformed the other methods, though the ordering rests on a small and uneven sample.

The authors acknowledge important limitations. Some students who gave low scores reported that the games were not fun, and log data suggested a few participants rushed the post-test, indicating that enjoyment and engagement strongly influence outcomes. The study is limited to short-term knowledge gains among Japanese university students in a single academic year, and it does not establish long-term retention or applicability to adults and professionals. The paper also reports that the Game Jam method produced playable prototypes quickly and that subsequent jams were held annually through 2018, reflecting a broader push in Japan to adopt serious games for cybersecurity education.