Gamified Cyber Security Training: Everything You Need to Know

Games are designed to be addictive.

Ever watch a friend lose themself for hours in a Candy Crush or Call of Duty binge?

Games put you in the dopamine-rich headspace of the flow state.

Science describes flow state as a state of optimal performance in which you're completely engaged in a task to the point where you stop thinking about time and place.

Imagine the things you can learn and the cybersecurity skills you can build when you enter a flow state for security awareness.

Our minds crave achievements and rewards so intensely that success in a game activates behavior-reinforcing brain chemicals.

That's what drives us to play more and more.

The mobile gaming industry has effectively hooked millions on games.

Social media has hooked millions more by applying gamification principles via Stanford University Professor, B.J. Fogg's behavior model.

What do we mean by getting hooked?

When people find something pleasing, they chase that same rush of happy brain chemicals by repeating the behavior.

In games, they'll do anything to reach the next level and feel a sense of achievement: even learn cybersecurity skills.

Recently, other industries have also picked up the idea of gamification.

For example, companies have been blending gamification into educational applications to improve  learning.

If you've tried Duolingo, you have some idea of how gamified learning can look.

In the guide below, we'll look at how gamification in cyber security training actually works, the outcomes you can expect as well as the best practices needed to maximise its effectiveness.

‍

What is gamification in cyber security? And why should you use it?  

📚 Quick definition: As the name suggests, gamified cyber security training incorporates game-like elements into traditional training to improve engagement and learning.

Gamified learning helps you maximize user engagement and measurably change cyber behavior.

74% of breaches are due to the human element.

So, motivating people to spot and report a real phishing attack is a game changer.

Game mechanics will make the learning experience more fun and motivating...

But gamification is not all about, well, fun and games.

Gamification is a scientifically validated model for conditioning desired behavior.

Game mechanics reward people for taking specific actions to specific cues.

Eventually, cybersecurity behavior becomes a matter of instinct and habit.

With gamified products, a variety of game elements are implemented as part of the product design.

Gamified products typically use level systems, competency levels, rewards, badges, steaks, motivational messages and positive communication, leaderboards, or progress checking to keep employees engaged.

‍

‍

What does gamification in security awareness training look like?

Interactive learning modules: Gamified training content is usually broken down into interactive modules, where employees actively participate in scenarios and tasks rather than passively consuming information. These modules might include things like simulations, quizzes, and problem-solving exercises.

Points, badges and leaderboards: Employees earn points for completing tasks, answering questions correctly and achieving specific milestones. Badges are awarded for accomplishments - with a leaderboard displaying top performers.

Real-world scenarios: Effective gamified training should include hands-on practice with real-world cyber security scenarios, such as simulated phishing emails or data breaches.

Immediate feedback and rewards: Employees receive immediate feedback on their actions, helping them understand what they did right or wrong. Rewards for correct actions and positive feedback are designed to reinforce positive behavior without punishing mistakes.

Adaptive learning paths: Gamified training (like Hoxhunt) often includes adaptive learning paths that adjust based on performance. This personalization ensures that employees receive content suited to their skill level.

‍

‍

Benefits of gamified cyber security training

Increased engagement

The interactive and competitive elements of gamification are designed to keep learners engaged and motivated, making them more likely to complete the training and retain information.

This approach has been shown to boost engagement by 60% and make 90% of employees feel more productive and involved.

The AES Corporation, a Fortune 500 company in the energy industry, won a prestigious CSO50 award by applying gamification to their cybersecurity awareness and behavior change program using Hoxhunt.

Their engagement skyrocketed from 10% to 70% in just a few months.

Improved retention

The use of real-world scenarios and immediate feedback helps reinforce learning, which generally leads to better retention of security principles and practices.

Some sources estimate that gamified cybersecurity training increases employee retention by up to 40%.

Enhanced learning experience

Gamification makes learning fun and enjoyable, reducing the monotony often associated with traditional training programs.

According to one study, 83% of respondents who received gamified training felt more motivated.

Whilst another study found that 89% of employees cited gamification increased their happiness and productivity.

Measurable progress

You can't change what you can't measure.

Using points, badges and leaderboards provide measurable indicators of progress and performance, so you can actually track and report on the effectiveness of your training programs.

Practice with realistic cyber threats

By simulating real-world threats, gamified training gives employees an opportunity apply their knowledge in a safe environment, preparing them for actual cyber security challenges.

This is how organizations Hoxhunt are able to boost their detection rates by over 75% on average.

‍

Game mechanics and behavioral science

Just because something looks cool and is fun to use doesn't mean that it's "just a game."

Social media companies, for instance, have poured millions into creating a sticky UX based on Stanford Professor, B.J. Fogg's Behavior Design model, which rewards users for engagement.

We talked to security awareness expert, Ira Winkler, for one of our CISO Sandbox webinars. Here's what he had to say about gamification: 

"Gamification is not a game. Gamification is actually a very specific business principle that says, 'We are taking game principles and applying it to solve a business problem' … [and] rewarding somebody for learning.”

“I appreciate what Hoxhunt does. Hoxhunt sends out the phishing messages appropriate to the level of knowledge of the person. If you don't have a tool like that, you need to figure out, 'How am I going to structure phishing messages that are going across the entire range of potential phishing knowledge?' and can tailor what we do to each person."

IRA WINKLER
CISO at CYE, former Chief Security Architect for Walmart, and best-selling author

‍

Structural gamification vs. content gamification

There are two types of gamification: structural gamification and content gamification.

Structural gamification: refers to the application of game elements to the structure of a learning environment without changing the content itself. This approach focuses on the mechanics of engagement, such as scoring, competition, and rewards, to motivate learners.

Content gamification: involves integrating game elements into the learning content itself. This approach redesigns the learning material to make it more interactive and engaging, often through the use of narratives, challenges, and problem-solving activities.

Typically, products like Duolingo or Hoxhunt use structural gamification, meaning that they are applying game elements to drive the learning, but they are not changing the content of the learning material.

The learning content simulates traditional learning materials.

When gamification is content-based, it means that the learning content is altered.

For example, it could be using a story to teach people something new.

In phishing training, the structural gamification approach works best because the aim is to simulate realistic phishing emails so that people can spot them and report them in real-life too.

The ideal outcome of a phishing attack is a threat report because it alerts the SOC to danger and accelerates its removal from the system.

By putting the learning content into a gamified environment, it feels more positive and less disruptive for their workflow.

‍

What is the 'Mario Effect'? And why does it matter?

Gamification works best in a safe and positive environment to take learning to the next level.  

Positive emotions are strong internal triggers, so when we succeed, we will be more likely to go back to the same good experience to satisfy our brains’ cravings for recognition and success.

The information security leaders at G2, the world's top software review site, chose Hoxhunt specifically because of the positive user learning experience.

"I would say we've seen the light. We've seen what's possible with a positive approach to security awareness."

GARRETT COOK
Former Head of Information Security at G2

The Super Mario Effect Ted Talk by Mark Rober cites scientific research that shows how much better people learn when they aren't afraid of failure, and are rewarded for success.

“This is what I call The Super Mario Effect: Focusing on the princess and not the pits, to stick with a task and learn more... By reframing the learning process, the fear of failure is often taken off the table and learning comes more naturally.”

MARK ROBER

‍

Evolution, gamification and phishing training

The workplace and society at large has undergone a digital transformation...

And the dangers of being online have also exponentiated.

However, humans haven't had the thousands of years necessary to sense danger online like we did in the forest.

We evolved to see crocodiles in the river, not phishing attacks in our inbox.

Organizations do their best to play catch up by training their employees.

But people generally hate mandatory security awareness training.

This is why we use game mechanics - to 'hack' the brain to accelerate the development of these vital security skills and instincts in a matter of months.

Gamification changes the human risk game.

Training frequency and the motivational aspects of game elements and rewards can make phishing training both enjoyable and effective in a positive light.

Here's what security awareness expert Lisa Kubicki (now at Microsoft) told us when she was the Director of Trust & Security Training & Awareness at DocuSign:

"Employees need to see it, read it, play with it, hear it, and do it daily. This won’t require a huge time commitment by them, but it will require that we have some of their time, short little bites of time on a regular basis..."

"To get them to commit to that time, it must be fun, rewarding, and meaningful. It must connect to what’s important to them and how they are evaluated on their performance. It must overcome elements of how the brain works so that we get a more secure, more trusted, and more committed trust culture. We must both acknowledge and encourage the desired behaviors."

LISA KUBICKI

Director, Education & Awareness, Digital Security & Resilience at Microsoft (former Director of Trust & Security Training & Awareness at DocuSign)

‍

So, what are the main goals of gamified phishing training?

Educate and build security awareness

First and foremost, you want to educate employees on the dangers of social engineering, emails, phishing, and on risky online behavior like password management, information sharing, and safe browsing.

Show people what sort of threats they could face in real life and teach them how to act appropriately.

Phishing takes top priority because:

1. It's the perfect cue-response-reward activity for gamified learning and behavior change
2. Social engineering is the biggest risk facing the organization

Engage and motivate employees

Frequent practice reinforces good behavior and builds skill levels.

Moreover, without frequent practice, users won’t be up-to-date on all the upcoming and trending threats.

To keep them engaged and come back for more, the training must be interesting for them, matching their skill and knowledge level, or even their culture.

Motivation is key for engagement and that’s why gamified elements can make training more enjoyable for people.

When you reward employees and positively reinforce that they are taking the right action, they will be more likely to keep participating and learn more.

Create positive habits

The goal of phishing training is to change behavior.

Game mechanics and game design work when applied to phishing training because the user experience is built around a desired action: hitting the threat reporting button.

Dozens of simulated phishing emails per year means dozens of in-game rewards for reporting those emails.

In that extended flow state, threat reporting becomes a habit and resilience becomes a reflex.

Hoxhunt research is the first to show a clear connection to gamified phishing training performance, and its impact on real threat detection.

Within one year of beginning training with Hoxhunt, 2/3 of employees globally report a suspicious real email.

Before gamified phishing training with Hoxhunt, the baseline for real threat detection is scant to negligible.

Build a security culture

With gamified phishing training, you can remove the negative emotions that people associate with security education.

Through frequent, gamified phishing simulations, they'll learn that staying safe online is important...

And will most likely start caring more about other aspects of cybersecurity too.

When users are on your side, they will actually support your defenses instead of posing a risk to them.

When they learn the habit of spotting and reporting emails, their chances of falling victim to a phishing attack will be lower.

In a positive environment, even if they fall victim, they will dare to come forward, which is great because you can start figuring out what happened and how you can prevent a breach.

How to maximise outcomes of gamified cyber security training

Use an adaptive learning model

Learning occurs at the boundaries of skill and knowledge.

In science, this is known as the zone of proximal development.

It's an old and well-established concept that could also be called the Goldilocks zone.

The gamified training challenge needs to be not too easy, not too hard, but just hard enough to get a dopamine kick out of an achievement.  

To tailor training to individual employees' skill level and background at enterprise scale, AI is necessary.

Employees should be trained using realistic scenarios that matches their level of cyber security awareness and skills.

Once they're feeling confident and motivated, you can then start to slowly increase the difficulty level.

Hoxhunt uses an adaptive learning model to, as Greg Petersen at Avanade says, meet people where they're at and take them to where they need to go to be secure.

Implement user-centered design

For educational software, another important aspect is user-centered design.

The UI/UX should always think of the end-user first by recognizing their needs and goals.

This is essential for the design and development process.

At Hoxhunt, user-centered design is the alpha and omega of product development.

As a people-first cybersecurity training platform, we always think of how we can make the training experience better for the employees.

The CSO50-winning team at AES even brought in their Global Director of Digital Experience, a non-cybersecurity role, to optimize their award-winning program.

Ingrain habits with frequent training

Frequent training is absolutely essential for changing behavior and forming habits.

By forming habits, our brains can learn to execute complex behaviors with minimal conscious thought.

When a habit is ingrained, it turns behavior into a reflex for a certain situation.

Think about how a master martial artist reacts when a punch is thrown; instinct kicks in.

Research by USC Professor, Wendy Wood tells us that about 40% of our daily activities are done on the brain's version of autopilot.

Old habits are hard to break and new habits are hard to form because it takes repetition and motivation to build the new neural pathways to a healthy behavior.

When we build habits, our brains’ basal ganglia can focus on other things that are not as automatic.

When a habit is formed, it’s like the brain takes a shortcut and immediately does the next correct step.

There are two essential elements to creating a habit:

• Frequency: how often the behavior occurs.
• Perceived utility: whether we find the task useful and rewarding.

When a certain event occurs frequently enough, we start forming the habit, and we will make it a default behavior.

But if something doesn’t occur frequently enough, it cannot become a habit.

Studies show that after six months, employees start to forget what they have learned.

🚨 Warning: you'll need a careful mix of training and gamification

Gamification is not simple to implement.

It needs careful design, a combination of the game-like mechanism and the actual purpose of the product.

In order to make your phishing outstanding, gamification has to be carefully integrated into the learning journey in a way that’s not disruptive but instead just helps with reinforcing people’s motivation to participate.

‍

Drive engagement and safe behaviors with Hoxhunt

Hoxhunt was purpose-built to deliver interactive, bite-sized phishing training that employees love.

We believe that training works best when its frequent, engaging and tailored to each employee's specific location, role and skill level.

So, we designed a solution that maximizes training outcomes by serving every user a personalized learning path that measurably changes behavior.

• Use AI to guide each employee on a unique path to resilience. 


• Cover all your phishing training needs with a training library that is constantly updated with the latest attacks drawn from millions of threat reports.

• Drive true risk reduction with realistic simulated attacks that mimic threats in the wild.

• Get a complete picture of risk and documented behavior change outcomes with Hoxhunt's analytics dashboard/.

‍

Gamified cyber security training FAQ

What is gamified cyber security training?

Gamified cyber security training integrates game design elements into cybersecurity training sessions to make learning more engaging and effective.

This approach uses interactive scenarios, problem-solving activities, and friendly competition to enhance employee engagement and improve knowledge retention.

How does gamification improve cybersecurity awareness training?

Gamification makes cybersecurity awareness training more engaging by incorporating interactive experiences and real-life scenarios.

This method allows employees to see the immediate impact of their actions within a safe, simulated environment.

Gamified learning environments enhance the retention of concepts and foster practical skills, making the training more effective than traditional methods.

How can gamified training address the skills gap in cybersecurity?

Gamified training addresses the skills gap by offering personalized learning experiences and practical experiences that adapt to individual skill levels.

Can gamified cyber security training be used for different types of employees?

A6: Yes, gamified cyber security training can be tailored for different types of employees, from entry-level staff to high-ranking executives.

Personalized learning experiences ensure that the training is relevant and effective for all participants.

How do gamified training programs measure success?

Success in gamified training programs is measured by improvements in knowledge retention, changes in security behavior, and the ability to effectively respond to simulated cyber threats.

Metrics such as completion rates, scores on cybersecurity games, and performance in real-world scenarios are used to assess the effectiveness of the training.