Gamification of Information Security Awareness and Training

Security Awareness and Training (SAT) programs are commonly put in place to reduce risk related to insecure

behaviour among employees. There are however studies questioning how effective SAT programs are in terms

of improving end-user behaviours. In this context, we have explored the potential of applying the concept of

gamification – i.e. using game mechanics – to increase motivation and learning outcomes. An interactive SAT

prototype application was developed, based on interviews with security experts and a workshop with regular

employees at two companies. The prototype was tested by employees in a second workshop. Our results

indicate that gamification has potential for use in SAT programs, in terms of potential strengths in areas where

current SAT efforts are believed to fail. There are however significant pitfalls one must avoid when designing

such applications, and more research is needed on long-term effects of a gamified SAT application.