Spreading cybersecurity awareness via gamification: zero-day game

This research project aims to increase the employees' cybersecurity awareness by proposing a training program that consists of pre-game and post-game phishing attacks, pre-game and post-game surveys, and an interactive zero-day game with embedded threat scenarios. Furthermore, we propose five flowcharts that simulate common cyberattacks. The zero-day game consists of five levels. The first level trains employees in using complex passwords. Two levels cover the social engineering attacks: one level trains employees about suspicious links and online survey tricks, while the other level trains players about the organization's security policies. The fourth level educates employees about malware spread via repackaged fake applications. The last level educates employees about phishing email attacks. Furthermore, we developed a chatbot inside the game to aid users in playing the different game levels. Additionally, two surveys and two phishing attacks are carried out to assess the employees' knowledge level of cybersecurity threats. The zero-day cybersecurity awareness program is applied to twenty-three employees. Experimental results indicate that the zero-day cybersecurity awareness program is more engaging and effective than traditional awareness programs. Results also indicate that the proposed program accurately measures and improves the employees' cybersecurity awareness level.