Try to esCAPE from Cybersecurity Incidents! A Technology-Enhanced Educational Approach

Abstract Incorporating gamification elements and innovative approaches in training programs are promising for addressing cybersecurity knowledge gaps. Cybersecurity education should combine hard and soft skill development when building the capacity to manage cyber incidents requiring timely communication, team collaboration, and self-efficacy in risk assessment and incident mitigation. The paper presents a design and evaluation of the technology-enhanced cybersecurity education approach CAPE which works as a hybrid escape room. It combines a virtualized infrastructure simulating the business environment and the physical environment where game participants play the role of the incident response team at the organization’s premises. The CAPE could be applied as a student-centered approach in the educational environment. The work employed a multiple-methods research approach to design a gamified approach and investigate crisis communication, collaboration, self-regulation, and technical competences in incident management scenarios. The design science methodology empowered the game’s construction with an attack surface covering physical and digital security. The undergraduate students participated in the pilot execution and completed the psychological questionnaires. The results were analyzed using statistical methods. Results of the CAPE execution showed a positive impact on student performance and increased interest in cybersecurity. The designed approach promoted field-specific competence development. The results demonstrated the significance of psychological aspects related to incident management. Graphical abstract