Gamification in IT Security – Raising Awareness through Phishing Challenges

Summary

Phishing remains one of the most prevalent forms of cyberattacks in the field of IT security. According to a survey conducted by KPMG, 53% of the German companies surveyed reported having been affected by a phishing attack [1]. Many employees fail to recognize such threats, often due to training sessions being too abstract or unengaging. This project explores how gamified elements, commonly referred to as gamification, can enhance the effectiveness of cybersecurity awareness efforts. The aim was to develop a phishing challenge that is both easily accessible and conducive to learning.

Background & Motivation

Traditional e-learning modules and video-based training sessions frequently suffer from low engagement and limited motivational impact. In contrast, gamification leverages interactive elements, points, rewards, and storytelling to positively influence user behavior. The motivation behind this project was to foster awareness through a simple yet effective game-based approach. The target audience consisted primarily of individuals without extensive IT knowledge.

Theoretical Framework

To establish a sound foundation for the challenge, the structure of typical cybersecurity awareness training programs was first examined. Subsequently, the key characteristics of so-called awareness challenges, short, active learning units with game-like features, were analyzed. Another area of focus was assessing learning outcomes, for example using the HAIS-Q questionnaire, which evaluates users’ knowledge and behavior [2]. Finally, didactic principles that support the effective integration of gamification into learning processes were reviewed.

Concept & Implementation of the Challenge

Based on theoretical insights, a custom phishing challenge was designed. The goal was to communicate the common features of phishing emails through an interactive format. This was achieved using multiple-choice scenarios and in-game decision-making. Gamified elements such as scoring systems and immediate feedback were incorporated. The technical implementation was kept deliberately simple and utilized a web-based tool, specifically Mentimeter, as it currently offers the most practical features for such use cases. The design was intentionally minimalistic and intuitive.

Evaluation & Feedback

The challenge was subsequently tested with a small group of participants. The objective was to gather initial feedback on usability and content comprehension. Several suggestions for improvement were identified, including text length and the design of individual challenge components.

Challenges & Limitations

Time constraints posed one of the main challenges, particularly in testing different formats and technologies. Technical implementation also presented minor difficulties. Furthermore, a comprehensive evaluation of the challenge's effectiveness was deliberately omitted, as the project was intended to serve as a prototype. The primary target audience consisted of users without advanced IT knowledge, and regulatory or compliance-related aspects were not taken into account.

Conclusion & Outlook

Gamification offers a promising approach to promoting cybersecurity awareness in an engaging and accessible manner. The developed challenge demonstrates that even simple, interactive formats can significantly enhance user attention and understanding of phishing threats. Future developments may include additional scenarios, expanded target groups, or the creation of a full training program. From a personal perspective, the project provided valuable experience in didactics, user experience design, and cybersecurity.

Device to be used with this documentation Maybe another device to be used with this documentation

Courses

• Einführendes Wahlfachprojekt (2025)

References

• [1] https://t3n.de/news/wer-die-meisten-phishing-mails-bekommt-statistik-der-woche-1660187/
• [2] Kathryn Parsons, Agata McCormac, Marcus Butavicius, Malcolm Pattinson, Cate Jerram,Determining employee awareness using the Human Aspects of Information Security Questionnaire (HAIS-Q),Computers & Security,Volume 42,2014,Pages 165-176,ISSN 0167-4048,https://doi.org/10.1016/j.cose.2013.12.003.(https://www.sciencedirect.com/science/article/pii/S016740481300179X)
• K. Jansson & R. von Solms (2013) Phishing for phishing awareness, Behaviour &Information Technology, 32:6, 584-593, DOI: 10.1080/0144929X.2011.632650
• Huang, C.-Y., Ma, S.-P. and Chen, K.-T., 2011. Using one-time passwords toprevent password phishing attacks. Journal of Network and Computer Applications,34(4), pp.1292–1301. Available at: https://doi.org/10.1016/j.jnca.2011.02.004.
• M. Rakhra and D. Kaur, "Studying user's computer security behaviour in developingan effective antiphishing educational framework," 2018 2nd International Conferenceon Inventive Systems and Control (ICISC), Coimbatore, India, 2018, pp. 832-836, doi:10.1109/ICISC.2018.8398916.
• Kudalkar, M., Singh, J. & Singh, S., 2024. Exploring phishing awareness and userbehavior: A survey-based investigation. International Journal for Research in AppliedScience & Engineering Technology (IJRASET)
• M. Rakhra and D. Kaur, "Studying user's computer security behaviour in developingan effective antiphishing educational framework," 2018 2nd International Conferenceon Inventive Systems and Control (ICISC), Coimbatore, India, 2018, pp. 832-836, doi:10.1109/ICISC.2018.8398916.