Game Based Cyber Security Training: Are Serious Games Suitable for Cyber Security Training?

This analysis evaluates the efficacy of serious games as training tools for cyber security, a field increasingly vital due to the high economic and social costs of digital crime. The primary objective is to determine whether gaming interventions can effectively educate both the general public and security professionals. The study utilizes a structured literature review of 28 academic papers and a targeted web search of 15 commercial or institutional products to assess the current state of the industry.

Key findings indicate that while the field is growing, it remains in an immature state. Most existing academic studies and products focus on general public awareness, such as phishing and basic online safety, with a notable lack of resources tailored to IT professionals or management decision-makers. Furthermore, the majority of interventions are designed for short-term, single-session use, which contradicts established knowledge that effective behavioral change requires long-term, sustained engagement.

Methodologically, the research highlights a significant gap in rigorous evaluation. Of the 28 academic papers reviewed, only 11 provided evaluable data, and even these suffered from small sample sizes and a lack of measurable effect sizes. While early feedback is generally positive, there is insufficient empirical evidence to definitively conclude that serious games are effective for long-term cyber security training. The study concludes that future efforts should shift toward scenario-based, case-study approaches that integrate with ongoing professional workflows rather than relying on isolated, short-term gaming interventions. Further research is required to develop and validate tools specifically designed for technical and managerial stakeholders.