Using Game-Based Learning Methods to Demystify Cyber Security Concepts for Adult Learners

The paper presents the Gamified Intelligent Cyber Aptitude and Skills Training (GICAST) project, a game-based learning resource designed to introduce cyber security concepts to low-confidence adult learners aged 24 to 65 who lack degree-level qualifications and work in low-paid or low-skilled jobs vulnerable to automation. Its central claim is that narrative-driven mini-games, embedded at the start of each week of an eight-week badged open course on the OpenLearn platform, can make a complex technical subject more accessible and engaging. The authors frame this against a UK cyber security skills shortage and the economic pressures of the COVID-19 period, positioning games as a tool for retraining and broadening participation in the sector.

The design rests on a two-layer model combining story-based scenarios with game mechanics, using analogy-driven, real-life, and concept-driven narratives, and a deliberately simple Minecraft-style visual aesthetic given budget constraints. Each game doubles as a stealth assessment that adapts learners to a fast-track or regular pathway, though learners were free to ignore these recommendations. The literature review acknowledges that fewer than a third of existing cyber security games have been properly evaluated, which the authors use to frame their study as a proof of concept.

Evaluation drew on pre and post surveys (177 and 167 eligible responses), focus groups, platform analytics, and quiz data, combining qualitative and quantitative methods within a theory-of-change framework. Reported results include a 20.8% course completion rate within three months, compared with a 12.9% median from an earlier study, and an average completion time of about four weeks against eight for a comparable non-game course. Around 94% of respondents reported enjoying the course, and 71% credited the fun element of the games with increasing their engagement. The authors conclude that games support engagement and retention, while noting limitations including the small pilot scale, self-reported measures, and negative reactions to dated graphics.