Incentive design in gamified cyber security training: the roles of loss aversion and fixed rewards

Human cognitive vulnerabilities remain the primary attack vector in organisational cyber security, yet traditional security education, training, and awareness (SETA) often fails to address this due to repetitive compliance formats and subsequent knowledge decay. Although gamification is widely proposed as a strategy to mitigate this ‘advice fatigue’, many implementations treat points-based incentives as a uniform motivational mechanism. This study examines the learning effects of two psychologically distinct points-based architectures: loss aversion (LA), operationalised through punitive point and streak deductions, and fixed rewards (FR), operationalised through positive point and streak accumulation. Using a two-cycle design science research approach, we evaluated these competing architectures in a pilot study ( n = 27) and a larger-scale evaluation involving online crowd workers recruited through Prolific ( n = 128). The results suggest a trade-off between experiential flow and productive cognitive friction. While participants in the FR condition reported descriptively higher mean scores across user engagement scale (UES-SF) dimensions, these between-group differences were statistically non-significant, and translated into only modest overall knowledge gains (+4.65%). In contrast, the LA condition appeared to introduce a form of productive cognitive friction. Although participants perceived this condition less favourably, the prospect of losing points may have encouraged more effortful, reflective (System 2) processing, resulting in statistically significant overall knowledge gains (+10.71%). These results suggest that points-based gamification mechanisms should not be viewed as interchangeable motivational tools. We propose a potential design trade-off between maximising user engagement and promoting deeper cognitive processing to guide SETA developers in strategically incorporating friction and reward mechanisms.