Provocative Games to Encourage Critical Reflection

The paper presents "Provocative Games," or Small Provoking Games (SPGs), developed within the SECRIOUS project to encourage critical reflection among coders about cybersecurity. Its central premise is that games built on reflective design principles, metaphor, exploratory play, and expected failure can shift developers' attitudes toward security. The authors frame success as exo-transformation, meaning lasting change in attitudes or practice that extends beyond the game itself. The work is grounded in an interdisciplinary co-design process using Triadic Game Design and is primarily a statement of design rationale and intent rather than a report of empirical outcomes.

The core contribution is two games, Protection and Collaboration. Protection targets common coder misconceptions, such as the beliefs that cybersecurity is optional, binary, or that "the more the better," and aims to convey that absolute security is unattainable. Collaboration emphasizes team communication and infrastructure mechanics. Each game maps core mechanics such as movement, collection, planning, and feedback to specific learning outcomes, and each was designed to make cybersecurity approachable for novices through metaphorical gameplay and productive failure.

Evidence so far is preliminary and comes from Serious Game Jams, where the games were used with participants. Observations suggest that the metaphorical design lowered barriers for novices and that structured post-play reflection helped players connect in-game experiences to real-world practice, with signs of productive ambiguity and meaningful conceptual connections. Formal effectiveness evaluation has been deferred to later work and remains pending.

The stated goals of that forthcoming evaluation are to test whether the games foster inquiry-based reflection and whether players move from being consumers of cybersecurity games to becoming co-designers of them. Until those results are available, the work's contribution lies chiefly in its design framework and its proposal for pairing provocative games with reflective debriefing as a means of introducing security concepts to coders.