Adaptive Learning Methodology for Cybersecurity Culture through Simulations and Gamification

People, not technology, are the decisive factor in most information security incidents: phishing and other social-engineering attacks exploit users, not systems. Traditional awareness training — a periodic lecture followed by a test — rarely changes behaviour durably and serves poorly users who differ in age, role and competence, a problem especially acute in Kazakhstan and Central Asia, where digital services are mobile-first and Kazakh-language security education is almost absent. This article develops an adaptive-learning methodology for building a cybersecurity culture across user levels, integrating diagnostic risk profiling, an adaptive trajectory, safety-constrained interactive attack simulations and gamification; a PRISMA-guided bibliometric mapping of 129 works in Web of Science and Scopus grounds the integration gap it addresses. The methodology is formalised as a technical specification and implemented as a deployed, trilingual (Kazakh, English, Russian) web-and-mobile platform whose behaviourally scored simulation logs feed a per-learner risk profile that drives trajectory adaptation. We describe the platform’s core algorithms — action scoring, risk-profile update and weak-spot course recommendation — and report their performance: on the live deployment they execute server-side in under three milliseconds, while authenticated API endpoints respond in roughly 60–85 ms end-to-end. End-to-end operation is verified on a demonstration cohort of 61 learner accounts, 124 course enrolments (34 completed) and 264 graded quiz attempts at a mean score of 76.7%. These results establish feasibility rather than training efficacy, which a randomised controlled trial will measure. The contribution is a reproducible, culture-oriented, Kazakh-inclusive methodology, its technical specification, and a working platform that turns awareness into measurable, adaptive behavioural training.