Citation :

Biju Abraham Verghese, Lakshmi Sudha Kondaka, "Design and Evaluation of a User-Centric Gamified Cyber-Security Awareness Framework with Behavioral Change Impact Assessment," International Journal of Engineering Trends and Technology (IJETT), vol. 74, no. 10, pp. 390-402, 2026. Crossref, https://doi.org/10.14445/22315381/IJETT-V74I10P128

Abstract

The rapid advancement of technology has resulted in increase in cybercrime activities on organization and individuals, which has intensified nowadays. Cybercrime incidents in India have sharply soared from 10.29 lakh in 2022 to 22.68 lakh in 2024, with financial losses touching ₹22,845 crore that is a 206% year on year increase. Regardless of the increase in investments of strengthening the security infrastructure, these numbers continue to increase due to ineffective management of human-related challenges. Traditional methods of conducting cybersecurity awareness sessions are unable to engage the participants, rendering such sessions ineffective. The existing solutions are developed to provide cybersecurity awareness through phishing simulations, content libraries and gamified engagement, but have several limitations. A training platform has been developed using Design Science Research methodology, incorporating skill-based segmentation training along with a comprehensive reporting mechanism highlighting the overall performance of the user and providing recommendations to enhance their approach towards real time incidents. As per the findings, knowledge gain of 30.0 percentage points in threat identification ability, a System Usability Scale score of 71.83, along with an engagement mean of 4.08 out of 5.00, confirming the platform's effectiveness as an interactive training tool.

Keywords

Behavioral change, Cybersecurity awareness, Design Science Research, Gamification, User segmentation.

References

1. Bader Alkhazi et al., “Assessment of the Impact of Information Security Awareness Training Methods on Knowledge, Attitude, and Behavior,” IEEE Access, vol. 10, pp. 132132-132143, 2022.
   [CrossRef] [Google Scholar] [Publisher Link]
2. Hui Na Chua, Jia Sheng Teh, and Anthony Herbland, “Identifying the Effect of Data Breach Publicity on Information Security Awareness using Hierarchical Regression,” IEEE Access, vol. 9, pp. 121759-121770, 2021.
   [CrossRef] [Google Scholar] [Publisher Link]
3. Jason R.C. Nurse, Joanna Milward, and Oz Alashe, “From Security Awareness and Training to Human Risk Management in Cybersecurity,” HCI for Cybersecurity, Privacy and Trust: 7^th International Conference, HCI-CPT 2025, Held as Part of the 27^th HCI International Conference, HCII 2025, Gothenburg, Sweden, vol. 15814, pp. 86-104, 2025.
   [CrossRef] [Google Scholar] [Publisher Link]
4. Areej Alyami et al., “Critical Success Factors for Security Education, Training and Awareness (SETA) Programme Effectiveness: An Empirical Comparison of Practitioner Perspectives,” Information and Computer Security, vol. 32, no. 1, pp. 53-73, 2023.
   [CrossRef] [Google Scholar] [Publisher Link]
5. Erfan Koza, Information Security Awareness and Training as a Holistic Key Factor-How Can a Human Firewall Take on a Complementary Role in Information Security?, Human Factors in Cybersecurity, vol. 53, pp. 49-57, 2022.
   [CrossRef] [Google Scholar] [Publisher Link]
6. Sunil Chaudhary, Vasileios Gkioulos, and Sokratis Katsikas, “Developing Metrics to Assess the Effectiveness of Cybersecurity Awareness Program,” Journal of Cybersecurity, vol. 8, no. 1, pp. 1-19, 2022.
   [CrossRef] [Google Scholar] [Publisher Link] 
7. Azaabi Cletus, Benjamin Weyory, and Alex Opoku, “Improving Social Engineering Awareness, Training and Education (SEATE) using a Behavioral Change Model,” International Journal of Advanced Computer Science and Applications, vol. 13, no. 5, pp. 606-613, 2022.
   [CrossRef] [Google Scholar] [Publisher Link]
8. Damjan Fujs, Simon Vrhovec, and Damjan Vavpotič, “Know Your Enemy: User Segmentation based on Human Aspects of Information Security,” IEEE Access, vol. 9, pp. 157306-157315, 2021.
   [CrossRef] [Google Scholar] [Publisher Link]
9. Nabin Chowdhury, and Vasileios Gkioulos, “A Personalized Learning Theory-based Cyber-Security Training Exercise,” International Journal of Information Security, vol. 22, no. 6, pp. 1531-1546, 2023.
   [CrossRef] [Google Scholar] [Publisher Link]
10. Seyyedeh Fatemeh Mousavi Baigi et al., “Evaluation Tools for Digital Educational Games: A Systematic Review,” Acta Medica Iranica, vol. 60, no. 8, pp. 1-10, 2022.
    [CrossRef] [Google Scholar] [Publisher Link]
11. Abdulrahman Abdullah Arishi et al., “Cybersecurity Awareness in Schools: A Systematic Review of Practices, Challenges, and Target Audiences,” International Journal of Advanced Computer Science and Applications, vol. 15, no. 12, pp. 467-478, 2024.
    [CrossRef] [Google Scholar] [Publisher Link]
12. Wenni Syafitri et al., “Methodological Review of Social Engineering Policy Model for Digital Marketing,” International Journal of Advanced Computer Science and Applications, vol. 16, no. 1, pp. 874-885, 2025.
    [CrossRef] [Publisher Link]
13. Scroll Staff, Indians Lost Rs 22,845 Crore to Cyber Fraud in 2024, a 206% Rise from Previous Year: Centre, Gift Membership, 2025. [Online]. Available: https://scroll.in/latest/1084796/
14. Sadhna Singh, Digital Arrest: The Modern-Day Cyber Scam, NITI Aayog, Government of India, 2024. [Online]. Available: https://www.niti.gov.in/node/1642
15. Alan R. Hevner, “Design Science in Information Systems Research,” MIS Quarterly, vol. 28, no. 1, pp. 75-105, 2004.
    [CrossRef] [Google Scholar] [Publisher Link]
16. Ken Peffers et al., “A Design Science Research Methodology for Information Systems Research,” Journal of Management Information Systems, vol. 24, no. 3, pp. 45-77, 2007.
    [CrossRef] [Google Scholar] [Publisher Link]
17. Thanos Papaioannou, Spyridon Eftychios Kokotos, and Aggeliki Tsohou, “Educational Escape Rooms for Raising Information Privacy Competences: An Empirical Validation,” International Journal of Information Security, vol. 24, no. 3, pp. 1-24, 2025.
    [CrossRef] [Google Scholar] [Publisher Link]
18. Aaron Bangor, Philip Kortum, and James Miller, “Determining What Individual SUS Scores Mean: Adding an Adjective Rating Scale,” Journal of Usability Studies, vol. 4, no. 3, pp. 114-123, 2009.
    [Google Scholar] [Publisher Link]
19. Microsoft, Microsoft Digital Defense Report 2023, Microsoft Corporation, 2023. [Online]. Available: https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2023