Gamified Cybersecurity Training: Escape Room Approach for Students

The COVID-19 pandemic has led to an increase in the online aspects of students' lives, which has unfortunately also increased the risk of phishing attacks. While current cybersecurity defenses rely on technology and human education, the latter is often undervalued. Traditional cybersecurity training often fails to effectively engage users outside the IT department, resulting in weak training outcomes due to lack of interest and poor acceptability. To address these issues, the authors propose a gamified cybersecurity training model that integrates users and IT departments. This model involves 'Escape Room' challenges, a globally popular offline game that has also been utilized as an offline education technique. The goal is to move towards online cybersecurity training, given the online nature of cyberattacks and the growing popularity of e-learning. The authors argue that the 'Escape Room' approach provides a more interactive and immersive experience, making it more engaging and effective for participants. This paper explores the detailed design of the 'Escape Room' training, including its integration into the organization's cybersecurity training system, and analyzes its effectiveness from various angles, including gamification, implementation process, and psychological aspects of scam compliance.