Skip to content
Asinnah
العربية
All research

Mohammad Jaafar

Published Technical report

  • Serious games
  • Cybersecurity awareness
  • Human factors
  • User study

Abstract

Cybersecurity breaches often result from human decisions rather than technical failures, yet traditional awareness training, delivered through static e-learning and compliance courses, rarely holds attention or changes behaviour. This paper designs, implements, and evaluates CyberNet, a scenario-based web serious game that encodes five everyday threats (phishing, password choice, voice phishing, removable-media baiting, and public Wi-Fi exposure) as short branched decisions with narrated outcomes and debriefs, grounded in the MDA, MOTENS, and Garris frameworks. The five concept areas map onto a ten-item knowledge test, two items each.

In a single-group, within-subjects, pre- and post-test study with N = 102 participants, mean accuracy rose from 54.80% to 77.75%, a gain of 22.94 percentage points (paired Cohen's d = 1.07, p < 0.001), and all five concepts reached family-wise significance under Holm–Bonferroni correction, with effects from d = 0.39 (vishing) to d = 0.85 (password). Confidently-incorrect answers fell from 39.8% to 20.3%, and moved into confident-correct rather than uncertainty. An eleven-item engagement survey scored high but did not correlate with the knowledge gain.

The paper contributes a review of serious games for cybersecurity awareness, the deployed prototype released as an anonymous study instrument, empirical evidence from a within-subjects study, and a presentation-layer instrument that evaluates narration, music, and visual design as a distinct dimension. Limitations of the single-session design and three extensions (a control group, a delayed-retention follow-up, and a post-debrief behavioural probe) are discussed.

In brief

  • A twenty-minute browser game walks people through five everyday attacks as decisions with consequences: a phishing email, a password choice, a scam phone call, a found USB stick and a public Wi-Fi menu.
  • Across 102 participants, knowledge-test accuracy rose from about 55% to about 78%, with a large effect size, and every one of the five topics improved significantly.
  • People did not just learn; they became better calibrated. Confidently wrong answers halved, and those answers became confidently right rather than unsure.
  • Knowing is not the same as doing: in the password scenario, 73% answered correctly afterwards but only 54% picked a safe password in the moment, so training should test choices after the lesson, not before.

Cite this paper

@techreport{asinnah2026cybernet,
  title       = {CyberNet: A Scenario-Based Web Serious Game for Everyday Cybersecurity Awareness},
  author      = {Mohammad Jaafar},
  institution = {Asinnah},
  year        = {2026},
  url         = {https://asinnah.com/en/research/cybernet-scenario-based-cybersecurity-awareness-game}
}

More research