Cyber Security Training Built as a City to Explore: A Case Study

Cyber security awareness training has a compliance problem that is really an attention problem. The content is mandatory, so everyone completes it, and completion tells you nothing about whether a single person will pause before clicking a link three months later.

Against a background of rising breaches and cyber crime, a multinational beverage company asked our team to build training that would genuinely help its employees become cyber secure. The brief was explicit that engagement was not the end goal. The program had to generate interest, then convert that interest into behavioral change, and finally produce organization-wide awareness with high participation behind it.

The Challenge

Security awareness sits in an awkward category. It is compliance training, so it carries all the reluctance that label attracts, but unlike most compliance content it depends entirely on decisions employees make alone and unprompted. Nobody supervises the moment someone connects to an unsecured network or forwards a file they should not.

That combination means the training cannot rely on being remembered as rules. It has to leave people more alert, which is a different design target from making them informed.

How the Solution Was Built

A city rather than a course

To draw learners into the topic we built a city filled with insights on cyber security best practices, delivered as the story of a character moving between locations to reach a complete understanding of the concepts. Learners work through an IT desk, a cafe, and other locations, each carrying its own material.

The city structure does something a module list cannot. Cyber security risk is defined by place, since the threats at an office desk are not the threats in a coffee shop on public wifi. Organizing the content by location rather than by topic maps the learning onto the same distinction the risk itself follows.

Guidelines delivered through characters

The guidelines arrive through conversations between characters rather than as lists. Learners navigate through a sequence of moments involving two colleagues, which keeps the material in the register of something happening rather than something being stated.

Video where a concept needs weight

Video segments appear where a point needs more emphasis than a screen can carry, covering topics such as the handling of sensitive confidential information. Reserving video for the concepts that most deserve it is what stops it becoming background noise across a long program.

Earning the tip

Games, puzzles, quizzes, and interactions run throughout in an organized, smoothly flowing sequence designed to hold interest and improve recall. In one activity learners select segments of a wheel to answer questions across secure internet usage, secure email usage, mobile device protection, and password protection, with lighter trivia mixed in between.

A points system and rewards keep learners motivated and reinforce the concepts, with an experience meter tracking progress through the thirty screens of the journey.

Applying it inside the environment

The strongest activity asks learners to apply what they have learned by finding the risks in a location themselves. In the cafe, learners select items in the environment to reveal a question and earn points for answering correctly, examining the router, the laptops left open on tables, and the screens visible behind the counter.

This is the exercise that does the real work. Being told to watch for exposed screens in public places produces agreement. Scanning a cafe scene and finding them yourself produces the habit.

Custom illustration throughout

We created customized illustrations and graphics to carry the concepts, and varied the screen treatments across the program to keep the experience feeling fresh rather than repetitive.

The Strategies Behind the Design

Four strategies power the solution.

• Story Based Learning
• Gamification
• Custom Visual Design
• Personalized Learning

Video-based learning runs alongside these, and delivery combines personalized learning, mobile learning, and microlearning through the client LMS and LXP.

The Impact

Learners found the training highly engaging, and the reason given was the freshness of the design approach rather than the subject matter. On a topic employees have usually met before in a duller form, the treatment is what earns their attention.

Learners assimilated the best practices, became more vigilant about cyber security threats, and applied the concepts well. Vigilance is the word worth holding onto. It describes a state rather than a piece of knowledge, and it is what the program was built to produce.

The company is now developing much wider and more varied awareness programs, with the aim of building cognizance continuously and sustaining a safe and secure working environment.

Build Security Awareness That Sticks

Security awareness training fails when it produces employees who know the rules and still behave as though they do not. This program worked by organizing the content around the places where risk actually differs, letting learners find the hazards themselves rather than reading about them, and giving them a reason to keep going. If your security training is being completed but not acted on, Liberate can help you rebuild it. Get in touch to talk it through.

‍