Augmented Reality, Virtual Reality, and the Metaverse in Cybersecurity Education and Training: A Systematic Literature Review

Extended reality technologies and the metaverse are increasingly being explored as tools for cybersecurity education. Following PRISMA guidelines, this systematic literature review analyzes the current state of research on the use of extended reality technologies, namely virtual reality, augmented reality, and mixed reality, as well as the metaverse, in cybersecurity education and training. Across the reviewed literature, extended reality technologies emerged as promising tools for bridging theoretical cybersecurity knowledge with applied practice through interactive, experiential, immersive, and gameful learning. The most frequently reported learning outcomes concerned cybersecurity knowledge acquisition and reinforcement, cybersecurity awareness and risk recognition, conceptual understanding, and learning engagement and enjoyment. Practical cybersecurity skills and higher-order thinking competencies (e.g., critical thinking, analytical reasoning, problem-solving, etc.) were less frequently reported. Game-based learning and gamification were particularly prominent, highlighting their close relationship with immersive technologies and cybersecurity education. Additionally, a relatively balanced distribution among studies that focused on virtual reality, augmented reality, and the metaverse was observed. However, the field remains limited by a strong focus on higher education, short-term and predominantly quantitative evaluations, limited use of established pedagogical and assessment frameworks, and challenges related to accessibility, cost, infrastructure, and privacy. The findings highlight the considerable potential of extended reality technologies and the metaverse to enrich cybersecurity education and training and to support positive learning outcomes.