Serious Games to Improve Privacy and Security Knowledge for Professionals: A Systematic Literature Review

Serious games serve as a potent pedagogical tool for enhancing cybersecurity and privacy awareness among professionals, offering risk-free environments where users can learn from simulated errors. By leveraging mechanics such as role-playing, storytelling, and competitive gamification, these digital interventions effectively improve participant knowledge and critical thinking skills. Simulations currently dominate the landscape, as they provide the necessary complexity to address human-centric security vulnerabilities while maintaining high levels of user engagement.

Research activity in this field experienced a notable surge between 2018 and 2020, with European nations, led by Germany, emerging as the primary hubs for development. Most existing solutions are web-based and frequently supported by academic or public funding. Despite this growth, the industry remains in a nascent stage, with many offerings restricted to preliminary testing phases. There is a clear lack of standardized design frameworks, which complicates the ability to measure long-term efficacy across diverse professional environments.

A critical gap exists regarding sector-specific applications, particularly within high-stakes industries like healthcare. While current games succeed in general awareness training, they often fail to address the nuanced, specialized requirements of highly regulated professional fields. To mature as a training methodology, the sector requires increased investment in tailored, industry-specific game design and more rigorous, large-scale empirical research. Moving forward, developers must align game mechanics more strategically with specific learning outcomes to ensure that these tools provide sustainable, measurable improvements in organizational security posture.