Enhancing Cybersecurity Education Through Multi-Opposing-Role Gameplay and Simulations

"The XSS Game" (TXG) is a web-based educational game designed to teach Cross-Site Scripting attacks through a multi-opposing-role structure featuring Attacker, Defender, and User perspectives, supplemented by a Simulator Zone for hands-on experimentation. The work argues that most existing cybersecurity games neglect the user's perspective and rarely combine narrative quizzes with simulations, and it positions TXG as a response to that gap. The game was piloted with 162 second-year computer science students, who completed it in roughly 16 minutes on average, and the cohort was largely experienced gamers with varied prior cybersecurity knowledge.

The central finding is that gameplay produced a statistically significant improvement in XSS knowledge (Wilcoxon Z = 3.40, p = 0.00067, effect size r = 0.52), a moderate effect the authors characterize as practically meaningful. Roughly 75% of participants expressed positive sentiment toward gaming as a learning medium. Players especially valued the multi-opposing-role format and the immediate feedback it provided, while requesting more varied tasks and interface improvements.

The Simulator Zone, by contrast, attracted engagement from only about 22% of participants, so conclusions about its educational impact remain preliminary. The authors acknowledge that the absence of a control group limits causal claims about the learning gains, and they plan follow-up studies with control comparisons and qualitative interviews. Overall, the study offers encouraging evidence that role-based, scenario-driven games can support cybersecurity education, while identifying clear priorities for refining the simulation component and strengthening the evidence base.