Key insights
5 slides
The rising threat
Anti-phishing learning games significantly improve user ability to identify phishing attempts.
Improvements persist for at least three months after training.
Key finding. Gamified cybersecurity training significantly improves user ability to identify phishing attempts, with measurable gains in classification accuracy and confidence that persist for at least three months.
1 / 5
- 01Gamified cybersecurity training significantly improves user ability to identify phishing attempts, with measurable gains in classification accuracy and confidence that persist for at least three months.See it on page 18
- 02Advanced, complex game mechanics do not provide a statistically significant performance advantage over simpler, binary-decision models in terms of user classification accuracy.See it on page 10
- 03Complex game designs offer superior diagnostic utility by capturing granular log data that reveals specific user misconceptions and decision-making patterns during URL parsing.See it on page 16
- 04The efficacy of anti-phishing learning games shows a gradual decline over time, indicating that long-term knowledge retention remains a challenge for current educational interventions.See it on page 1
- 05Interactive learning environments, including both analysis-based sorting and creative construction exercises, are effective methods for teaching factual, conceptual, and procedural knowledge regarding URL structure.See it on page 14
- 06Future research must prioritize larger, more diverse sample populations to validate these findings and determine how sustained engagement can prevent the erosion of cybersecurity knowledge.See it on page 3
Ask AI about this report
Summary
Educational interventions utilizing serious games offer a robust method for improving user resilience against phishing attacks. By focusing on URL structure and manipulation techniques, these games employ structured tutorials to teach factual, conceptual, and procedural knowledge. Evaluations involving computer science students demonstrate that interactive learning environments—ranging from analysis-based sorting tasks to creative construction exercises—consistently enhance participants' classification accuracy and self-reported confidence. These improvements are measurable immediately following gameplay and show meaningful retention over a three-month period, validating the efficacy of gamified cybersecurity training.
While all tested game mechanics successfully improve user performance, the specific complexity of the game design does not yield a statistically significant advantage in classification accuracy over simpler, binary-decision models. Despite this parity in performance outcomes, advanced game mechanics provide superior diagnostic utility. By capturing detailed log data during gameplay, these systems allow researchers to identify specific user misconceptions and decision-making patterns that are otherwise obscured in traditional testing formats. This granular data is essential for refining educational content and tailoring interventions to address common vulnerabilities in URL parsing.
The scope of this research encompasses the application of the Learning Mechanics-Game Mechanics framework to cybersecurity education, primarily targeting academic populations. Although the findings confirm that structured pedagogical approaches in gaming are effective, the observed decline in metrics during longitudinal follow-ups indicates that long-term efficacy remains a challenge. Future efforts should prioritize larger, more diverse sample sizes to confirm these results and explore how sustained engagement might mitigate the gradual erosion of knowledge over time. Ultimately, these games serve as both effective training tools and valuable instruments for psychological assessment in the digital security landscape.
