Successful Gamification of Cybersecurity Training

The behavioral aspect of cybersecurity has gained more attention in recent years. By their actions, people can improve the security of their devices and organizations, but also hinder the successful implementation of security in these areas. As awareness campaigns where information is merely distributed are not effective, we designed a cybersecurity serious game applicable for cybersecurity training. The effectiveness of this game was experimentally tested against a noncybersecurity game that did or did not contain cybersecurity information, through measures of the theory of planned behavior. Results showed that the cybersecurity game resulted in higher self-reported scores on attitudes, perceived behavioral control, intentions, and behavior compared with both noncybersecurity games. For subjective norms, we only found an effect in the comparison between the cybersecurity game and the noncybersecurity game without additional information.