The Need for Game-Based Learning Methods to Address Cyber Threats

This document argues that human error contributes substantially to cyber security breaches and that conventional awareness training often fails because of low learner engagement, positioning game-based learning as a promising alternative. Its central thesis is that training should be engaging, regular, and realistic, and that games may deliver these qualities more effectively than current approaches. The argument is motivated by the persistent gap between security knowledge and secure behaviour.

The evidence base is a small pilot survey of 37 adults, most of them university students and cyber security researchers, who had prior cyber security training. Training frequency, prior exposure to cyber threats, and the perceived relevance of training correlated positively with secure behaviour, which averaged 0.79 on a 0 to 1 scale. Perceived engagement, enjoyment, and relevance were associated with participants' belief that training had changed their behaviour. Participants generally rated existing training as neutral in engagement and enjoyment, while attitudes toward game-based training were favourable, with roughly 70% positive and fewer than 10% strictly negative. Most respondents took personal responsibility for security, though 86% also assigned responsibility to internet service providers, employers, technology providers, or government.

The findings are explicitly preliminary. The sample is small and non-representative, and the results are correlational rather than causal and not statistically conclusive. The study says little about games specifically, leaving open which game characteristics drive behaviour change. Future work is proposed to identify those characteristics, build prototype game-based training, and compare it against traditional methods to derive design guidelines.