Cyber Security Awareness Review

Implementing Gamification in Corporate Cybersecurity Awareness Education: A Literature Review

Cybersecurity in corporations has many challenges and employee awareness is one of them. Gartner (2023) predicts that by 2025, a lack of talent or human failure will be responsible for more than half of significant cyber incidents. In 2022, phishing attempts were the most common threat vector (83%) that UK companies identified as cyber-attacks (GOV.UK, 2022). Educating employees in cybersecurity awareness is therefore essential, yet surveys conducted at UK companies and organizations in 2020, 2021 and 2022 reveal a limited amount of training (Zatterin et al., 2022). Only about half of the UK's large commercial companies provide cybersecurity training to non-cyber employees, and only about three in five companies are satisfied with the cybersecurity awareness training of their wider workforce. One of the challenges identified in these surveys is the need for high-quality and cost-effective educational solutions to raise awareness about cybersecurity.

Several studies examine employee involvement in cybersecurity awareness training and measurable performance of educational programmes. Byrd (2022) indicates that a lack of employee engagement is one of the reasons cybersecurity awareness training fails. He states that there are several reasons for this failure, including: boring content, using too many technical words and lack of real-world examples. At the same time, the company Cyberready (n.d.), which specializes in cybersecurity training, describes an in-depth study by Osterman Research on their website. The study reveals the failure of cybersecurity awareness training, especially when it comes to employee behaviour related to phishing attacks. Cyberready also discusses the justification for effective cybersecurity awareness training that will generate a significant return on investment (ROI).

In a white paper, Cyberready acknowledges limited transformation in employee behaviour as a result of corporate cybersecurity awareness training. In addition, no measurable key performance indicators (KPIs) are associated with these kinds of training. Such obstacles highlight the need for improvement and suggest that an effective cybersecurity education programme would be one that: a) makes employees want to participate, b) increases their cybersecurity awareness, c) changes employee cybersecurity behaviour over the long term, d) is measurable by KPIs, and e) generates ROI. One possible solution could be gamification.

Existing literature points to a growing trend in gamification of cybersecurity awareness education. Gamification is a game design element used in a non-game context to improve skills and knowledge (Deterding et al., 2011). Unlike game-based learning, which focuses on creating games for educational purposes, educational gamification focusses on game-like experiences (Glover, 2013). The purpose of using gamification is to encourage and foster acceptance of learning conducive behaviours, and to establish learning motivations (Botte, et al., 2022). Examples of gamifications are: avatars; websites featuring profiles, which display progress bars to indicate how ‘complete’ the profiles are; surveys comprising illustrations instead of text; online language courses with simulations of real-life situations; and quizzes with answers that can be moved around on a digital screen. Gamification can also be the use of game mechanics and game dynamics such as challenges and rewards. Since gamification includes elements of motivation and measurement, its use could take conventional cybersecurity awareness training to the next level.

Based on the above theory, the following question is asked: “Would gamification in cybersecurity awareness education be an effective solution for companies to increase cybersecurity awareness and transform employee cybersecurity behaviour?” This literature review attempts to answer the foregoing question. The first part of the review analyses the effect of gamification on cybersecurity awareness, including game mechanics and game dynamics. In the second part, the use of spear phishing is considered as a gamification element. The third part introduces the possibility of using gamification as a measurement tool for cybersecurity awareness. Finally, a conclusion and discussion of the findings are presented.

Cybersecurity Awareness Gamificationw

Game mechanics, which are the rules, processes and data of games, and are part of gamification (Adams & Dormans, 2012). By using the rules, processes and data separately or together, it is possible to increase user motivation. According to Beza (2011), game mechanics include rewarding elements, such as points, levels, challenges and leader boards. Leader boards are large boards that display the ranking of users in a competitive game. They comprise of a high-score table and “bring fame” by displaying and highlighting the user’s name. In addition to game mechanics, gamification can make use of game dynamics. Game dynamics are design interventions that increase engagement (Sjøvoll & Gulden, 2017). To influence behaviour, six game dynamics can be used in gamification: 1) Reward – something of value given in recognition of one's effort or achievement; 2) Status – acknowledgment of fame or prestige by others through attention and respect; 3) Achievement – a need to achieve something by working towards goals; 4) Self-expression – expression of one's autonomy and originality; 5) Competition – a competitive encounter between multiple users; and 6) Altruism – a desire to help other people without getting a reward (Bunchball, 2010). Both game mechanics and game dynamics encourage engagement and fun.

Buisman (2014) describes an experiment that was conducted at Radboud University in 2014 that showed compelling benefits of using gamification. The goal of this experiment was to find a set of gamification elements that could be added to a project management tool to increase its use and encourage student engagement. Gamification elements, including points and leader boards, were applied to an existing open-source project management tool. A group of students used the gamification project management tool, while a control group used a non- gamification project management tool. Experimental quantitative data and qualitative survey data were collected. The study found that engagement, involvement and motivation of those using the gamification project management tool were higher than those who using the non-gamification project management tool.

In his systematic review of cybersecurity awareness gamification, Onduto (2021) studied relevant papers published between 2010 to 2021. His research found that most cybersecurity awareness gamifications implement role-playing and other game mechanics that effectively convey the cybersecurity awareness message. These gamifications increase knowledge and changes cybersecurity behaviour. According to Onduto's review, the cybersecurity awareness games are perceived as educational, motivating and entertaining by the users (Yasin et al., 2018, as cited in Onduto, 2021). With the results of his research, Onduto concurs the findings of Buisman (2014). Thus, increasing of engagement, involvement and motivation through the implementation of gamification in cybersecurity educational programmes can be effective in cybersecurity awareness education within corporations.

Spear Phishing Gamification

Spear phishing, also known as whaling, is a type of phishing attack that targets individuals or organizations primarily through malicious emails (Crowdstrike, n.d.). Spear phishing is a real-life situation, so using it as a simulation in combination with a reward component turns spear phishing into a gamification element. For example, a corporation can test its employees' response to a phishing email. When the employees open the malicious email, they receive a reply email with negative feedback. Subsequent to this test, all employees who reported the malicious email to the IT department are positively credited in an email sent to all employees of the corporation.

By using spear phishing as an awareness gamification in corporations, employees who fall into the trap can learn from it. Kruger & Kearney (2006) suggest that simulated realistic phishing attacks can be used to detect employee behavioural weaknesses, while Kearney & Kruger (2013) suggest using simulated realistic phishing attacks to improve organizational learning. In his research results, Onduto (2021) argues that gamification is underused for evaluation purposes, while De Vries (2018) argues that the opposite is possible. De Vries shows that spear phishing gamification can be used for training purposes as well as for measuring cybersecurity awareness.

Cybersecurity Awareness Measurement Using Gamification

The measurement of cybersecurity awareness behaviour commonly focusses on: following policies, keeping passwords secret, reporting security incidents, employee actions and consequences. Generally, these measurements are performed separately from educational trainings and are usually conducted prior to educational activities. Regardless the fact that measurement techniques are available, published measurements of cybersecurity behaviour are lacking (Witsenboer et al., 2022). Measurement techniques, such as Human Aspects of Information Security Questionnaire (HAIS-Q) are mostly applied in research and in laboratory environments (Butavicius et al., 2017, as cited in De Vries, 2018).

De Vries (2018) conducted a case study in which he used spear phishing gamification to achieve a higher level of engagement, as well as a quantification measurement method for cybersecurity awareness. His case study revealed that employees sometimes open and respond to phishing emails even though they expect the emails to be malicious because they feel "cyber-safe" in their environment. While the employees learned to become more aware of cyber threats, the employed gamification method also collected information about the employees’ cybersecurity behaviour. The collected information gave the employers quantitative data on cybersecurity risks associated with their employees’ behaviour. De Vries' research demonstrates that spear phishing gamification can also be used as a quantitative measuring instrument in addition to an educational training. By collecting data through gamification, corporations can increase the effectiveness of their cybersecurity education programme. The spear phishing gamification can integrate KPI measurements and generate a significantly higher ROI, compared to the ROI achieved when conducting measurements and applying education separately.

Conclusion and Discussion

Gamification increases engagement, involvement and motivation in cybersecurity awareness education. It can be used as a measurement tool to scale quantitative awareness of the employees. Spear phishing gamification is one of the gamification tools that can be applied for education and measurement purposes at the same time. Utilizing gamification for education and measurement simultaneously, can lead to an effective solution for corporations in raising cybersecurity awareness. It increases the ROI of investment in cybersecurity awareness.

Beyond these gamification benefits, a desired outcome for cybersecurity awareness education is a long-term behavioural change toward cybersecurity. According to Onduto (2021), follow-up evaluations of the long-term gamification effectiveness in cybersecurity awareness are lacking. Therefore, this topic should be further investigated. Another element to examine when developing gamification for cybersecurity awareness is the impact of the gamification components on the employees. Beza (2011) argues that the use of game mechanics can confuse learners in the sense that the gamified environment is very different from real life. She also claims that students easily assume that they are only allowed to learn, collaborate or help if they are rewarded. Onduto (2021) explains the need to clarify the importance of cybersecurity topics and elaborate the cybersecurity risks that need to be developed. If gamification users learn about cybersecurity risks but do not understand the importance of cybersecurity topics, the effect of gamification on user behaviour may be limited. Hence, additional research is necessary to determine whether gamification of cybersecurity education and the use of spear phishing gamification are efficient for corporate utilization.

Finally, it is important to recognize that multiple studies show a significant correlation between educational gamification and engagement, involvement and motivation (Buisman, 2014; De Vries, 2017; Deterding et al., 2011; Glover, 2013; Rieff, 2018; Scholefield & Shepherd, 2019). At the same time, they do not show significantly higher levels of cybersecurity awareness and behaviour change when implementing gamification in cybersecurity education. Thus, the main benefits of gamification, and notably spear phishing gamification in corporate cybersecurity awareness education, are the high level of employee engagement, involvement and motivation, and the combination of cybersecurity training and measurement.