First Steps to Improve Cybersecurity Behaviour: A Virtual Reality Experience

This paper presents VRCyberEducation, an immersive virtual reality training environment designed to reduce human-driven cybersecurity risks such as weak password practices and mishandling of removable USB devices. The authors argue that conventional security awareness training, typically delivered as text, lectures, or e-learning, is often tedious and disengaging, and they propose VR as a more engaging alternative. The environment was built in the Social VR platform NeosVR for the Oculus Quest 2 and was shaped by a four-step creative technology design process, including a semi-structured interview with two university cybersecurity experts that informed the choice of focus areas.

The evaluation used a pretest-posttest design with a convenience sample of 16 participants, consisting of university staff, students, and acquaintances of the authors, with roughly half identifying as female and most aged 18 to 35. Knowledge, attitude, and behaviour were measured with a subset of the Human Aspects of Information Security Questionnaire (HAIS-Q), and usability was assessed with the System Usability Scale (SUS). Knowledge scores increased significantly after the VR session (from a mean of 47.5 to 54.75, p < .001, Cohen's d of 1.46), and the SUS mean of 72.5 was above the commonly cited threshold of 68 for acceptable usability.

The authors caution that the small, non-random sample limits generalisability, and that the post-test was administered immediately after the experience, so retention over time remains unknown. The study covered only two cyber challenges, password management and USB handling, and the authors propose future work with larger representative samples, additional scenarios, and multi-user social VR interactions.