Cybersecurity: What if we learned by playing? Four experts testify

To raise awareness among internal (and even external) audiences but also to explore scenarios while working on group dynamics, companies and institutions are increasingly turning to gamification to address cybersecurity issues as well as any crisis situation that puts an organization, or even a country, under tension.

InCyber interviewed four experts who use this playful and particularly enriching approach for participants as well as game designers and requesters. Here are their testimonials, their experiences, and their advice for getting the most benefit from games as tools for training, preparation, anticipation, and continuous improvement in a contemporary world where uncertainty is increasingly becoming the norm.

The Expert Panel

Cécile Wendling is a futurist and research associate in social sciences at Sciences-Po. Her field of expertise is risk and crisis anticipation. She has also worked for the Strategic Research Institute of the Military School (IRSEM) on the comprehensive approach to crises. With her firm Pan-or-amiques, she is also a consultant and speaker.

Adrian Taylor is a consultant with his firm 4sing in strategic anticipation and facilitator of simulation workshops and futurist scenarios. Quadrilingual, he has also been an army officer, lobbyist, civil servant in an international organization, and researcher at a university. He accompanies various industrial sectors on anticipation and governance issues.

Patrick Ruestschmann is deputy director in charge of Joint Wargaming at the Joint Center for Concepts, Doctrines and Experiments (CICDE), the military think tank of the Armed Forces Staff. He notably designs and facilitates wargames/serious games for French high authorities for their counterparts in allied countries.

Frédéric Duflot is co-founder and CEO of Examin, a company created in 2019 that offers software to assist with auditing, compliance, and certification in cyber matters. Originally, he is a lawyer specializing in cybersecurity from the public sector (ANSSI, Ministry of the Interior). An inveterate fan of board games, he recently developed Eveil Cyber, a game to train different audiences in cybersecurity.

Why rely on games to address specialized topics like cybersecurity or prepare for a crisis?

C.W.: Games have the undeniable merit of opening up fields of reflection on different types of problems while offering a more accessible and inclusive format for participants who may sometimes balk or not want to take an interest in a subject that is nevertheless essential for their activity. Rather than having a long didactic presentation, people live a collective experience for a few hours. They learn concepts and notions but not only that. The dynamics of the game push them to interact with each other, to make decisions when faced with facts that occur during a session. It stimulates creativity and also solicits emotions.

A.T.: Humans essentially evolve through the experiences they go through during their lives. Games precisely allow for creating purposeful experiences to raise awareness and develop behaviors and thought patterns. They also allow people to visualize, understand different subjects, and even encounter contexts they don’t know or know poorly. With games, participants quickly abstract from reality. They slip into a role, must develop another vision, and draw lessons from it that they may not have necessarily thought of.

P.R.: Using a game allows for obtaining unparalleled levels of engagement and attention from participants. It’s much more powerful and enriching than a classic linear presentation. Moreover, the collective aspect generates discussions during the game, awareness, new questions, and a desire to delve into subjects that weren’t considered before. Finally, games are something modular that can be constantly adapted according to the profiles that will participate, the targeted objectives, and the expected pedagogical level.

F.D: On topics not always easy to grasp like cybersecurity, games bring a much better cognitive impact. It helps overcome certain blocks and makes certain concepts less arid. Learning is significantly improved with even emulation between different participants. Another strong point: games can be configured for various objectives. This can consist of raising awareness among a fairly broad audience, remediating based on lived experiences, or thinking prospectively about potential risks. The range is wide and adapts to all levels of expertise.

What are the important criteria to integrate upstream to ensure the success of a gamification program?

C.W.: First of all, it’s about not playing for the sake of playing or giving in to a certain trend to be fashionable! You absolutely must first focus on the desired effect if you decide to use a game. It is necessary to take into account the specific needs that you are trying to address through a game, clearly determine the expectations from the population that will play, and design a scenario and rules according to the profiles of the participants. This phase is essential for the game to be well received and bring benefits to the players.

A.T: In my view, there are two dimensions that are crucial to integrate for the game to maintain its effectiveness. First, consider the culture of the company or organization from which the players come. Especially from a managerial and cultural point of view. Indeed, hierarchical relationships are not experienced in the same way depending on the sectors of activity, the size of the company, the personality of the leader, or even the culture of the country. Asian countries, for example, do not have the same approach to management as Western countries. This is an important point to know when composing groups of players. Otherwise, it can bias the course of the game. The other dimension is to ensure the involvement of the leader. The fact that they agree to make themselves available will have a beneficial impact.

P.R.: The initial framing is fundamental. You need to agree on the question that the game should address and clearly define the scope of expectations and targeted objectives. As long as the requester of a game is not sufficiently precise on these points, my team and I do not start designing the game. It is necessary to have a pitch of a few lines on which everyone agrees. We should not hesitate to spend time on it, if necessary. The relevance and effectiveness of the game itself depend on it!

F.D.: Among others, I focus on two essential points to ensure that the game will work positively. This first involves testing the ergonomics of the game. I tend to say that, when creating a game, for one hour of effective design, you will need to do four hours of testing. A board game must be attractive with meaningful pawns and objects. With pleasant and easy-to-read cards. All these little details can hinder the smooth running of the game. You have to accept criticism and revise your copy. Then, during a session, game facilitation is key. First in explaining the rules. When the game starts, the facilitator must be as inclusive as possible and identify the different profiles, for example extroverts and introverts. Everyone must be able to express themselves and contribute. You also need to know how to handle game breakers and neutralize them if necessary. Otherwise, the game risks going off track and demotivating the group.

What types of games do you use?

C.W.: There are many game formats today. In person around a board with cards and pawns. Sometimes with the addition of digital screens. We can also rely on a totally immersive model with online games or virtual reality headsets. Scenarios can be realistic or completely fictional. In fact, the choice of format depends closely on the experiential effect sought from those who will play. Is it about acquiring knowledge, stimulating their creativity, or encouraging collaboration? This is what should guide the adoption of a format.

A.T: As part of my interventions, I often use a collaborative game called “Neustart.” This board game for 2 to 12 players is inspired by “Black-out,” an anticipation novel by Austrian writer Marc Elsberg. The scenario evokes a vast cyber-attack that cuts electricity in several major European cities. The players are members of a municipal crisis cell and must maintain the supply of basic necessities to the population as well as calm and order for as long as possible. It’s very immersive and interactive, and yet it’s never really the same process that operates. I constantly make adjustments to the game procedures depending on the profiles of the participants, the size of the city they need to protect. It’s fundamental for people to fully appropriate the game. There is no good or bad game in itself. It needs to be adapted, almost tailored!

P.R.: At CICDE, we have the advantage of having an advisory unit to think about creating new games and a studio that will work on their design. We exclude nothing. We make a lot of board games, but sometimes we expand the game with a digital environment to feed the scenario, such as social media posts, real-fake TV news, simulations to produce quantitative data, and AI-generated content. The all-digital format can also be considered, although it limits a bit more, in my opinion, the interactivity that a physical game in person elicits, especially with the profiles of our participants.

F.D.: For the moment, I am focusing on developing and evolving our board game. The physical mode seems particularly well-suited for bringing players together and having them dialogue about cybersecurity. However, I have introduced options in the game according to the profile of the participants. For example, there is a card game more oriented toward regulations that is introduced into the game when there are lawyers. The modularity of the game is important.

If you had only a few words to convince leaders and teams to resort to gamification in their own organizations, what asset would you highlight?

C.W.: In terms of team dynamics, games offer a particularly interesting asset: allowing each person to understand the other’s point of view. Either by taking on their role or by trying to understand the meaning of their action. This increases inclusivity and collaboration. Living this experience then helps in daily life to smooth out relationships.

A.T.: Games can be a revealer of personalities. I have already seen players who are usually reserved or dare not say or contribute, having much more proactive behaviors during a game. For managers, it’s an additional very interesting reading grid. And then, games also help to establish lists of actions and corrections to be made in real life. It’s not just a parenthesis.

P.R.: One of the many assets of games is that they push players to step out of their comfort zone, to explore paths and ask questions. Even if we don’t necessarily have the answers at the end of the game, it contributes to revisiting one’s thought patterns and opening up to other perspectives. Games also help to observe the behaviors and reactions of others. This helps to work on human relationships and collaboration.

F.D.: On complex notions or specialized knowledge, games are an excellent lever to overcome certain reluctances or resistances, or even a lack of interest. On cybersecurity, games allow introducing complex or very abstract subjects for many people in a playful way. In the end, they are even happy to have useful notions for their own daily life, for example on the risks of identity theft or phishing.