When games meet industry : A mixed-methods study of the organisational suitability of card-based cybersecurity awareness training in Swedish food manufacturing

Sammanfattning

Manufacturing organisations are increasingly becoming a more important topic of discussion in terms of cybersecurity due to the growing numbers of directed attacks towards the sector and updated regulatory requirements. Although previous research has shown that game-based training is one of the more effective methods for behavioural change, its suitability in time-constrained organisations such as in the manufacturing sector is an underexplored subject. This study investigates the use of analogue serious games for cybersecurity awareness training in large Swedish food manufacturing organisations, with a particular focus on organisational factors influencing its implementation. A mixed-methods design was used to gain a broad and deep understanding of existing barriers and potentials for game-based implementation in this sector. In practice, the qualitative data collection consisted of 12 semi-structured interviews. Additionally, a quantitative data collection was performed, using the organisational culture assessment instrument (OCAI) and 14 additional opinion-based questions with the use of a likert scale. The combination of these methods enabled this study to identify cultural and operational barriers for implementing game-based training for a large Swedish food manufacturer. The findings showed several barriers for feasibility and acceptance for example time-constraints, fears of being judged and attitude towards change, amongst others.