Experiential Learning or Direct Training: Fostering Ethical Cybersecurity Decision-Making via Serious Games

Achieving secure cybersecurity systems requires a dual focus on technological aspects and human factors, both of which raise questions around ethical decision-making. While the objective is to ensure the comprehensive security of cybersecurity solutions, overlooking the ethical implications of decisions can lead to unexpected as well as unethical outcomes, giving rise to concerns aligned with basic ethical principles such as achieving benefits, avoiding harm, respecting choice, fairness, and transparency. To tackle this challenge, we have developed a serious game to educate cybersecurity participants to be mindful of the consequences of their decisions. All participants in our study engaged in experiential learning by discussing ethical dilemmas with non-player characters (NPCs) in this game. Additionally, half of our participants (training group) received explicit training in five ethical principles and undertook reflective activities. The control group did not receive this explicit training. We aimed to investigate whether experiential learning is adequate or whether additional explicit training in ethics is needed in this context. Analysis of pre- and post-tests revealed that both the training and control groups significantly improved their ability to recognise the importance of ethics after playing the game. The control group, receiving no direct training, performed equally as well as the training group in ethical decision-making. In analysing what made the ethical training effective, participants reported that virtual team discussions and choice/decision events were the most influential. The game will be further enhanced and evaluated in a future study.