Developing Interactive Cybersecurity Snacks

Research

Human error is the leading cause of cybersecurity breaches, yet most cybersecurity education tools focus on raising awareness rather than changing behaviour. Many existing interventions are delivered online, which saves time but often results in limited emotional engagement and little practical impact. This study investigates how short, engaging, on-site “Cybersecurity Snacks” can motivate employees to adopt safer cybersecurity behaviours within time-constrained organisational environments.
The research asks: How can a playfully designed Cybersecurity Snacks be efficiently developed to increase motivation for change in employees' cybersecurity behaviour?
Using Educational Design Research, the project combines a literature review with iterative design, interviews, prototyping, and thematic analysis. Conjecture mapping will connect design decisions to behavioural outcomes. The final output will include a master’s thesis and high-fidelity Cybersecurity Snack prototypes for organisational use.
The study develops Cybersecurity Snacks as brief microlearning units that can be completed during employees’ breaks. Playful design elements—drawing on the PLEX framework—are included to enhance engagement without the restrictive structure of gamification. To support behavioural change, the intervention is grounded in the COM-B model, focusing specifically on increasing motivation (assuming capability and opportunity are already present).
Two theoretical components are used to strengthen motivational impact: (1) Embodied Cognition Thesis: On-site, multisensory activities enhance cognitive engagement compared with the sensory limitations of online training.; (2) Emotional Arousal Theories: High-arousal emotions improve memory and motivation. Elements from Russell’s Circumplex Model of Affect and high-arousal wording from the ANEW database will be used to evoke emotional responses that drive behavioural change.
Overall, this project aims to provide organisations with a time-efficient, engaging, and behaviour-focused cybersecurity education method. The combination of playful design, embodied learning, and emotional arousal is expected to enhance motivation and reduce risky cybersecurity behaviour linked to human error.

Research design

This pragmatic study applies the Educational Design Research framework, which integrates theory and practice to enhance educational innovations and contribute to learning theory (McKenney & Reeves, 2019). Due to the time constraints of the thesis, only the first two Educational Design Research phases—literature review and iterative design—will be conducted. The study will use interviews, constructions, and prototypes throughout a complex but efficient five-stage iterative design process, with each stage involving new sets of all three elements.

Examples of studied Cybersecurity Snacks