Humans impact security outcomes more that any technology, policy or process. One-size-fits-all training programmes often don’t consider why humans continue to exhibit poor security behaviours or how different people perceive security and risk differently. The way we communicate security practices to the end-users needs to change to enable behaviour modification.
Play is the most natural way to learn, and a game-play environment offers end-users an informal and safe environment to learn and exhibit their intuitive security behaviour.
Gamification can be used to collect data associated with user attitudes, knowledge and behaviour, and to help design a personalised cybersecurity training programme that can assess individuals’ risk perception and the consequent need for security and trigger behaviour modification. Organisations may strategically use this to understand, measure and improve cyber risk where human behaviour is the root cause.
