Cybersecurity on the Move: Investigating the Efficacy of a Movable Escape Room as an Educational Tool for Healthcare Employees

A mobile cybersecurity escape room, delivered via a converted vehicle termed a "cyber truck," was evaluated as a training tool for healthcare employees, with the central question being whether such an intervention can measurably improve security awareness and behavior among staff who face persistent cyber threats in clinical settings. The study enrolled 96 healthcare professionals and measured change using the HAIS-Q, a validated instrument for information security awareness. Scores rose sharply immediately after the intervention, from a pre-test mean of 16.3 to a post-test mean of 30.8, a large effect (Cohen's d = 2.16, p = .001). Gains were significant across email usage, password practices, social engineering, and software updates.

Retention at one-month follow-up was more limited but still meaningful. The delayed-test effect was medium in size (d = 0.74, p = .006), though it was based on only 26 matched participants after substantial dropout. At follow-up, the only domains retaining significant gains were social engineering and software updates, while email and password improvements did not persist at the same level in the delayed assessment, though the earlier analysis had reported them as significant at follow-up.

The authors interpret these results as evidence that gamified, experiential training is a promising approach for healthcare cybersecurity education, given the sector's exposure to ransomware and other disruptive attacks. Their conclusions are tempered by several constraints: uneven team sizes, high attrition, a small delayed-test sample, and the inability to determine which specific components of the escape room produced the observed effects. The study's contextual grounding draws on prior research into healthcare cyber incidents, phishing trends, and simulation-based learning.