Despite all the resources enterprises have invested in security training, common cyber attack methods such as phishing continue to afflict organisations in the UK.
The Q3 2022 Cyber Threat Report from Beaming highlighted that UK businesses experienced 169,824 attacks between July and September. While this number decreased by 4% compared to the previous quarter, it still represents one attack occurring every 47 seconds.
Human beings are often painted as the weakest links in any security program. However, with an adequate training program in place, security incidents that exploit human error can be minimised.
What if companies could turn cyber security training from a chore into something their employees got excited about? Gamifying your cyber security training can fulfill these objectives and achieve much more.
Here are three reasons why gamifying security training holds a lot of promise.
Games reinforce complex behaviour
Examine the current gaming landscape, and you’ll find highly detailed storylines, character arcs, and quests. The average gamer has to master several skills before progressing further. Even games like racing sims and sports challenges are complex enough to involve challenges that incrementally increase in difficulty and resemble the real thing.
Cyber security is likewise a collection of complex tasks from the average user’s perspective. For instance, if an employee receives an email, identifying whether it’s a phishing attempt or a legitimate one is truly challenging. How can they figure out whether the sender’s address is genuine? How do they know whether the shortened link in the email is not malicious without clicking it?
Employees do receive training in this regard, but those programs are often ineffective. A seminar or a collaborative exercise isn’t enough to instill complex thought processes and analysis in a user’s mind. Gamification boosts engagement by getting people to invest emotionally in an outcome.
While surface-level gamification, such as rewards and in-game medals, are great, companies can go further by creating highly engaging simulations that employees need to face as they go about their daily business. As they explore the ramifications of the decisions they make in these simulations, users will automatically understand what actions to take when it isn’t a game.
A company cannot fully replicate every real-world situation in a simulation. However, it can educate employees on the right thought process. Questions like when to escalate a situation, when to delete a suspicious email, and how to self-monitor online activity will be answered easily, reducing the burden security teams face.
Build a strong culture of security
Games bring people together, as the numerous online gaming communities have long proved. Cyber security training also brings people together, although often for the wrong reasons, unfortunately. Most employees view these sessions as tedious, and as a result, security suffers.
The average security training session is led either by the CISO, another security team member, or an outside consultant. While informative, these seminars come across as highly technical and leave everyone in a daze. While no one doubts the speaker’s credentials, the right way to behave in a situation often gets glossed over.
For instance, the training instructor might assume certain behaviors by default, thanks to their security background. They might miss that the average user does not have in-depth security training. This fact applies even to developers and technical personnel. Security is a niche field that does not crossover a lot.
Gamifying the learning program can motivate people to stay engaged by encouraging them to compete against each other, or to come together to solve an issue or analyse a problem. Games do a great job of delivering complicated information in a highly engaging manner. For instance, many games always onboard a new player with a tutorial that tells the player what to do, shows them how to do it, and allows them to test their skill.
A similar security training structure will help users figure out the right actions to take and ingrain this behavior in them.
Reframes training as exciting
Who doesn’t love a good game? Companies can transform their training experience into something employees look forward to by introducing gamification elements. Not only can they build excitement, but scale their programs too.
For instance, employees might complete certain security learning modules on their own time every week. The company can host a larger seminar once every quarter, thus making security a routine event. Gaming elements such as progress bars, leaderboards, and easter eggs will have employees looking forward to their training, instead of dreading it.
Much depends on the design of the platform, of course. However, a training platform that has simple gamification elements will still work better than one that has none.
A gamified platform also makes it easy for a company to get its employees to collaborate and solve potential security issues in a safe environment.
Gamification is the future
Consumer apps have gone down the gamification route for a while now and the time has come for security training platforms to do the same. Whether it’s building excitement or ingraining complex behaviors into users, the benefits of gamifying security training far outweigh the costs.
Leave a Comment