CyberNet: A Scenario-Based Web Serious Game for Everyday Cybersecurity Awareness

Cybersecurity breaches often result from human decisions rather than technical failures, yet traditional awareness training, delivered through static e-learning and compliance courses, rarely holds attention or changes behaviour. This paper designs, implements, and evaluates CyberNet, a scenario-based web serious game that encodes five everyday threats (phishing, password choice, voice phishing, removable-media baiting, and public Wi-Fi exposure) as short branched decisions with narrated outcomes and debriefs, grounded in the MDA, MOTENS, and Garris frameworks. The five concept areas map onto a ten-item knowledge test, two items each.

In a single-group, within-subjects, pre- and post-test study with N = 102 participants, mean accuracy rose from 54.80% to 77.75%, a gain of 22.94 percentage points (paired Cohen's d = 1.07, p < 0.001), and all five concepts reached family-wise significance under Holm–Bonferroni correction, with effects from d = 0.39 (vishing) to d = 0.85 (password). Confidently-incorrect answers fell from 39.8% to 20.3%, and moved into confident-correct rather than uncertainty. An eleven-item engagement survey scored high but did not correlate with the knowledge gain.

The paper contributes a review of serious games for cybersecurity awareness, the deployed prototype released as an anonymous study instrument, empirical evidence from a within-subjects study, and a presentation-layer instrument that evaluates narration, music, and visual design as a distinct dimension. Limitations of the single-session design and three extensions (a control group, a delayed-retention follow-up, and a post-debrief behavioural probe) are discussed.