Exploring the versatility of gamification as an educational method for ISA training

Sammanfattning

Human error remains a dominant factor in cybersecurity breaches, underscoring the need for effective methods to improve Information Security Awareness (ISA). One emerging approach is gamification (using game-based elements in non-game contexts) to enhance user engagement and learning outcomes. This thesis presents a systematic literature review (SLR) investigating the versatility and effectiveness of gamification as an educational tool for ISA. The review analyzes studies that implement gamified methods for security training, with a focus on both their methods and reported outcomes. The search included publications discussing gamified ISA tools with measurable positive or negative results. Findings reveal a diverse range of game genres employed, including quizzes, simulations, role-playing, and narrative-driven scenarios. These games target various ISA topics such as phishing, password strengths, social engineering, and security routines. The findings also include four SLR to highlight effectiveness and versatility. For further clarity on the subject, informal interviews were conducted with experts in the field to strengthen or weaken our research findings, and results showed that it strengthened our findings. Overall, the reviewed literature suggests that gamified approaches can significantly improve user awareness and behavior, though effectiveness varies by game design and target audience.