# Cybersecurity Training Acceptance: A Literature Review

Joakim Kävrestad, Wesam Fallatah, Steven Furnell

► To cite this version:

Joakim Kävrestad, Wesam Fallatah, Steven Furnell. Cybersecurity Training Acceptance: A Literature Review. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.53-63, 10.1007/978-3-031-38530-8_5. hal-05462079

HAL Id: hal-05462079

https://inria.hal.science/hal-05462079v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_3.png" /></figure>

# Cybersecurity Training Acceptance:
A Literature Review

Joakim Kävrestad¹(✉), Wesam Fallatah² ID, and Steven Furnell² ID

¹ University of Skövde, Skövde, Sweden
joakim.kavrestad@his.se

² University of Nottingham, Nottingham, UK
{wesam.fallatah, steven.furnell}@nottingham.ac.uk

**Abstract.** User behavior is widely acknowledged as a crucial part of cybersecurity, and training is the most commonly suggested way of ensuring secure behavior. However, an open challenge is to get users to engage with such training to a high enough extent. Consequently, this paper provides research into user acceptance of cybersecurity training. User acceptance can be understood from a socio-technical perspective and depends on the training itself, the organization where it is deployed, and the user expected to engage with it. A structured literature review is conducted to review previous research on cybersecurity training acceptance using a social-technical approach. The paper contributes with an overview of how user acceptance has been researched in the three social-technical dimensions and with what results. The review shows that previous research mostly focused on how the training method itself affects user acceptance, while research focusing on organizational or user-related dimensions is more scarce. Consequently, the paper calls for further research on the organizational aspects of user acceptance of cybersecurity training and how user acceptance can differ between user groups.

**Keywords:** security · training · education · user · acceptance · adoption

## 1 Introduction

Developing resistance to cyberattacks is now a crucial task for any organization. A core step is establishing an underlying security culture, which involves raising cybersecurity awareness among staff members [1]. That seeks to make staff aware of existing cybersecurity threats and how they can avoid them. The most common threats targeting users include phishing, credential theft, and ransomware, and a common notion of how to protect against these is via cybersecurity training [2]. Such training efforts seek to educate users on how to behave securely, thereby contributing to better security culture. While the potential benefit of cybersecurity training is undeniable, a common problem is getting users to actively engage with it [3]. If users do not do so, the training cannot provide its intended beneficial effect.

Consequently, this paper seeks to present initial research into user acceptance of cybersecurity training. Adopting a socio-technical approach, the project postulates that
acceptance is influenced by the proposed training itself, the user, and organizational factors. The effect of the training itself has been demonstrated in several previous studies investigating user perception of various cybersecurity training methods [4]. As for the user, the effects of demographics, such as age and gender, have been studied but with conflicting results [5]. However, no previous research has taken a holistic approach to research acceptance of cybersecurity training through a socio-technical lens. Therefore, this research aims to synthesize existing research about user acceptance in the three socio-technical dimensions.

The paper presents the findings from a structured review of prior works on the acceptance of cybersecurity training and education. The next section provides background context in terms of the socio-technical approach being applied, leading to a more specific discussion of the literature review methodology in Sect. 3. The main findings are then presented in Sect. 4, focusing on the technical, organizational, and user-centered dimensions. The discussion then concludes in Sect. 5, drawing together the implications of the work thus far. The results provide an overview of the research landscape. Others can use them to gain a holistic understanding of the domain and as a foundation for future research.

## 2 Socio-technical Perspectives on User Acceptance

Baxter and Sommerville [6] describe that a socio-technical approach to system design leads to higher user acceptance and stakeholder value. Interpreted in the domain of this research, it can be argued to increase user adoption of cybersecurity training and improve the outcomes of such training. In essence, a socio-technical approach assumes that a technology depends on itself, its users, and the organization in which it is used [7]. Prior user acceptance research in those dimensions is outlined below.

Technical aspects, relating to the technology itself, have been extensively discussed, and summaries are provided by Venkatesh and Bala [8] and Lee et al. [9]. In the context of this research, technology refers to the cybersecurity training effort itself. Venkatesh and Bala [8] and Lee et al. [9] highlight system quality as a contributor to user acceptance. System quality is further described as how easy and intuitive a technology is to use and how well it supports the user's job performance. Those factors are to be considered in relation to other technologies with similar purposes. Users will adopt a technology that is comparatively better to a greater extent. Technical aspects relating to cybersecurity training have been the focus of previous research. In Kävrestad et al. [10], it is demonstrated that the implementation of cybersecurity training impacts users' willingness to adopt the training. A possible reason is described in Bello and Maurushat [11], who argue that users are more prone to use intuitive and easy-to-use cybersecurity training. Similar findings are presented by Dahabiyeh [12], who also emphasizes the quality of the presented content.

Aspects relating to the user include demographic aspects where age, nation of residence, and gender have been discussed as possible mediators of user acceptance [5]. Venkatesh and Bala [8] and Lee et al. [9] further describe that a user's computer skills and attitude will also have an impact. Both a user's predisposition to try new technology and self-efficacy will also impact user acceptance. Organizational aspects first include
availability, where time, support, and systems availability positively impact user accep-
tance [8, 9]. Organizational culture will also have an impact, where user acceptance is
impacted by managerial support and how the organization's members perceive a tech-
nology, i.e., subjective norms [8, 9]. The impact of organizational aspects relating to
cybersecurity training acceptance has received less attention from the research commu-
nity. Nevertheless, Dahabiyeh [12] suggested management support, engagement from
colleagues, and dedicated IT staff to impact the acceptance of cybersecurity training
positively. Reeves et al. [4] also describe colleagues as important positive or negative
mediators of cybersecurity training acceptance.

A core component of a socio-technical approach to systems design is the view that performance is reliant on all socio-technical dimensions, which are highly intertwined [6]. A consequent property is that system goals can typically be addressed in more than one way. One can, for instance, assume that a certain technology may work well in one organization but less so in another. As an example, one can assume that users in a military organization may be more prone to adopt cybersecurity training than users in a more relaxed environment because of their predisposition to follow orders and strive for security. A solution with the same goals may have to be designed in a different way in, for instance, a non-hierarchical startup company.

## 3 Methodology

This research was conducted as a structured literature review following the methodology proposed by Paré and Kitsiou [13]. As suggested by Meline [14] and Jesson et al. [15], an inclusive approach was adopted in the selection of databases and development of search query. The search query used in this research was (Cyber OR Information OR IT OR computer) AND security AND (training OR education) AND (adoption OR acceptance OR usage). The intention was to capture all likely variants of how ‘security’ might be labeled within the relevant sources while also seeking works specifically relating to the training and education perspectives (‘awareness’ was not used as a keyword alternative on the basis that this potentially refers to a shallower level of engagement with users, and so had the potential to bring in studies that had merely sought to bring attention to security issues rather than more specifically guiding users on how to deal with them). The last segment of the query then used keyword variants that aimed to focus on works specifically concerned with the user acceptance aspect of the training experience.

The search string was applied to the following databases and indexes; ACM, IEEE Xplore, DBLP, Science Direct, and Scopus. The searches were restricted to research papers published within the last ten years. Inclusion criteria were established before the searches [16]. Only papers meeting the following criteria were included in this research: Included papers should be peer-reviewed and report their own data and conclusions relating to end-user acceptance of cybersecurity training. Reviews of other research, opinion papers, and likewise are removed. The domain of included papers should be the training of users and not the education of security professionals.

Following database searches, the resulting papers were subject to screening. The screening process is documented in the PRISMA diagram displayed in Fig. 1, which is
based on Page et al. [17] and Sarkis-Onofre et al. [18]. Identified papers were analyzed using thematic coding as follows [19]:

1. Each publication was read in its entirety and labeled by which of the three socio-technical dimensions of user acceptance it was related to. One publication could be related to more than one dimension.

2. How each publication contributed to each respective dimension was extracted.

3. The extractions for each dimension were combined into a cohesive text, which is presented in the upcoming results section.

The resulting publications selected for inclusion are cited throughout the results section.

<figure><img src="image_4.png" /><figcaption>**Fig. 1.** PRISMA diagram outlining the searching and screening process</figcaption></figure>
# 4 Results

A total of 16 papers were selected for inclusion in this study after the filtering process. The papers were first labeled according to what socio-technical dimensions they discussed, revealing that all papers discussed the training itself, the technical dimension. Five papers discussed the organizational dimension, and one paper discussed the social dimension. All included papers and the labeling is documented in Table 1.

<table><caption>**Table 1.** Categorization of included publications</caption><thead><tr><td>Paper</td><td>(T)echnical</td><td>(O)rganizational</td><td>(U)ser-Centered</td></tr></thead><tbody><tr><td>Kävrestad et al. [10]</td><td>X</td><td>X</td><td>X</td></tr><tr><td>Dahabiyeh [12]</td><td>X</td><td>X</td><td></td></tr><tr><td>Haney and Lutters [20]</td><td>X</td><td>X</td><td></td></tr><tr><td>Ma et al. [21]</td><td>X</td><td>X</td><td></td></tr><tr><td>Shillair [22]</td><td>X</td><td></td><td></td></tr><tr><td>Wash and Cooper [23]</td><td>X</td><td></td><td></td></tr><tr><td>Silic and Lowry [24]</td><td>X</td><td></td><td></td></tr><tr><td>Shen et al. [25]</td><td>X</td><td></td><td></td></tr><tr><td>Wen et al. [26]</td><td>X</td><td></td><td></td></tr><tr><td>Jin et al. [27]</td><td>X</td><td></td><td></td></tr><tr><td>Kletenik et al. [28]</td><td>X</td><td></td><td></td></tr><tr><td>Cullinane et al. [29]</td><td>X</td><td></td><td></td></tr><tr><td>Gokul et al. [30]</td><td>X</td><td></td><td></td></tr><tr><td>Stockett [31]</td><td>X</td><td></td><td></td></tr><tr><td>Offor and Tejay [32]</td><td>X</td><td></td><td></td></tr><tr><td>Bélanger [33]</td><td>X</td><td>X</td><td></td></tr></tbody></table>

Next, how the papers contributed to the understanding of the adoption of cybersecurity training in each respective dimension was extracted and stored in an Excel table. An excerpt of the resulting classifications and summaries is shown in Table 2.

The following subsections summarize the extracted content for each dimension of cybersecurity training adoption.

## 4.1 Technical Dimensions

The technical dimension was the most prominent dimension in the 16 papers included in this review. In fact, the nature of the training itself was, to some extent, discussed in all included papers. Five of those argue that user satisfaction is important for cybersecurity training efforts before developing training efforts and evaluating user satisfaction of them
<table><caption>**Table 2.** Excerpt of information extracted from analyzed papers (O = Organizational and T = Technical).</caption><thead><tr><td>Paper</td><td>Dimension</td><td>Extraction</td></tr></thead><tbody><tr><td>Haney and Lutters [20]</td><td>T</td><td>The paper describes that the message itself must be understandable and usable, meaning that users must be able to understand and convert the message into their daily life. The research was an interview study with 28 security experts</td></tr><tr><td>Haney and Lutters [20]</td><td>O</td><td>The paper reports that trust in the source of a security message is imperative for users to listen to that message. Consequently, the security organization must build a reputation within the organization, leading to a higher degree of user adoption. The research was an interview study with 28 security experts</td></tr><tr><td>Ma et al. [21]</td><td>T</td><td>Reports on a survey with 293 respondents and show that user satisfaction impacts user stickiness, how willing users are to use training repeatedly. Satisfaction is both impacted by the perception of the training tool (quality and fun) and how other around a person thinks about the training tool (social influence)</td></tr><tr><td>Ma et al. [21]</td><td>O</td><td>Reports on a survey with 293 respondents and show that user satisfaction impacts user stickiness, how willing users are to use training repeatedly. Satisfaction is both impacted by the perception of the training tool (quality and fun) and how other around a person thinks about the training tool (social influence)</td></tr><tr><td>Dahabiyeh [12]</td><td>T</td><td>The paper reports on research primarily studying organizational decision-making concerning cybersecurity training but argues for user-friendliness as important for user adoption</td></tr><tr><td>Dahabiyeh [12]</td><td>O</td><td>The paper reports on research primarily studying organizational decision-making regarding cybersecurity training but argues for the engagement of stakeholders throughout the organization as important for user adoption</td></tr><tr><td>Shillair [22]</td><td>T</td><td>This research aims to research user needs regarding cybersecurity training and presents recommendations for cybersecurity training. The key conclusions are that training adoption can be facilitated by training available in different formats and with easy-to-understand content. The research method was a survey with 800 respondents</td></tr></tbody></table>

(continued)
<table><caption>**Table 2.** (continued)</caption><thead><tr><td>Paper</td><td>Dimension</td><td>Extraction</td></tr></thead><tbody><tr><td>Wash and Cooper [23]</td><td>T</td><td>The paper describes an interesting dilemma relating to the technical nature of the training. Training “after the event” is only provided to users who do the event. Phishing training will, for instance, only be provided to users who click a link. The paper demonstrates how the technical implementation of training can facilitate or hinder adoption</td></tr></tbody></table>

[24–28]. Shen et al. [25] describe that the properties of the training itself will greatly impact the user’s perception of that training, which is further supported by Dahabiyeh [12]. Ma et al. [21] and Cullinane et al. [29] further show that user satisfaction impacts a user’s willingness to use and re-use cybersecurity training tools and states that the perceived quality and fun of a training tool will influence the perception of it. The so-far presented papers discuss gamified training, and it can be concluded that user perception differs between cybersecurity games. Kävrestad et al. [10] further show that user perception differs between different types of security training and suggests that contextual training is preferred over eLearning platforms and cybersecurity games. In contrast, Gokul et al. [30] suggest that games are more engaging than training using mandatory quizzes.

To ensure that any cybersecurity training effort is positively perceived, it must be developed with its intended recipients in mind [31]. On that note, Offor and Tejay [32] argue that cybersecurity training for adults must be developed using pedagogical principles for adults. Stockett [31] further suggests that tailoring training to different user groups will facilitate adoption. Some suggestions pertaining to the content of the training can also be found in the included papers. Haney and Lutters [20] argue that the material must be tailored to the recipient in a way that makes it easy to understand and convert into their daily life. Shillair [22] also stresses the importance of understandable content and suggests that users have diverse preferences, which could be met by providing training in different formats. Making the material appear personal and mandatory is also described as a factor that can improve user adoption rates [31, 33].

A final interesting dilemma is reported by Wash and Cooper [23], who discuss the timing of training. Wash and Cooper [23] describe that phishing training is sometimes a part of a phishing exercise and is provided to users who act on the messages in those drills by clicking a link. While that may be effective for the users who click the links, other users would not be trained.

## 4.2 Organizational Dimension

Organizational dimensions are discussed in five included publications and in two main themes. The first theme is trust in the security organization, which is described by Haney and Lutters [20]. They describe that trust in the source of a security message is imperative for users’ willingness to listen to that message. Consequently, the security
organization must build a reputation within the organization, leading to a higher degree of user adoption. Similarly, Dahabiyeh [12] describes that commitment from various organizational stakeholders is needed to ensure user participation in training efforts. The notion of trust has also been found to impact user adoption in a survey with over 1400 respondents, who ranked trust in the sender as one of the most important factors for willingness to adopt cybersecurity training [10].

The second theme can be described as informal culture, where Ma et al. [21] describe that social influence is important for user stickiness, the degree to which users will continue to use a training effort. Social influence can assist in making training feel mandatory, which also contributes to user adoption [33].

## 4.3 User-Centered Dimension

User-centered dimensions include how user demographics, abilities, and traits can impact user adoption of cybersecurity training. It is only explicitly studied in one of the included papers, Kävrestad et al. [10]. Kävrestad et al. [10] research if worry about cyberthreats impacts users' willingness to adopt cybersecurity training. While they find that to be the case, they also describe worry as a weak mediator. In addition, it can be mentioned that several papers included in this research argue that training should be tailored to various user groups, suggesting that user groups' different needs are understood. However, none of these describe how different groups should be trained.

# 5 Conclusions

The aim of this research was to synthesize existing research about user acceptance of cybersecurity training from a socio-technical perspective. It was conducted as a structured literature review, where 16 papers were included after database searches and screening. The results suggest that the majority of the existing research focused on the nature of the training interventions themselves. This research reveals a consensus that user perception of cybersecurity training is imperative for the adoption of such training. Furthermore, included papers describe that easy-to-understand material that users can adopt in their daily routines is paramount for positive user perception. Furthermore, the included papers demonstrate a great variety in how cybersecurity training can be implemented, with different results in terms of user perception. This suggests that employing design practices such as user-centric design can be beneficial.

Several included papers further describe formal and informal culture as important mediators for adoption. Trust in the security organization and social influence were the most prominent themes and show that awareness-raising stretches beyond the delivery or procurement of a measure. Rather, it is a matter of organizational culture. Finally, the impact of user demographics, abilities, or traits was implicitly acknowledged in several included papers that described individualization as important for cybersecurity training adoption. However, only a single paper researched how it could impact adoption and found worry about cyberthreats to have a limited impact.
## 5.1 Limitations

This research intended to review the current research landscape using a structured literature review methodology. To ensure that relevant publications were included in the research, an inclusive mindset was adopted in developing search strings, selecting databases, and screening papers. Nevertheless, a possible limitation of this research can be that relevant research was not included. A detailed explication of the search and inclusion protocol enables others to build from the present review.

## 5.2 Future Work

This research reveals an uneven distribution of publications in the three social-technical dimensions of cybersecurity training acceptance. Most notably, several publications seem to imply that different users should be trained in different ways. However, sources detailing which those groups are and how they should be trained are scarce. This dilemma can be addressed by research focusing on what distinct groups there are and what needs they have. It can, for instance, be imagined that users with different skill sets, cognitive abilities, or roles have different needs and expectations. A second direction for future work concerns organizational culture, which is described as important in several papers included in this research. However, how to develop a culture that fosters high adoption of cybersecurity training remains largely unknown.

## References

1. Uchendu, B., Nurse, J.R., Bada, M., Furnell, S.: Developing a cyber security culture: current practices and future needs. Comput. Secur. 109(c) (2021)

2. Joinson, A., van Steen, T.: Human aspects of cyber security: behaviour or culture change? Cyber Secur.: A Peer-Rev. J. 1(4), 351–360 (2018)

3. Bada, M., Sasse, A.M., Nurse, J.R.: Cyber security awareness campaigns: why do they fail to change behaviour? arXiv preprint (2019)

4. Reeves, A., Calic, D., Delfabbro, P.: “Get a red-hot poker and open up my eyes, it’s so boring” 1: employee perceptions of cybersecurity training. Comput. Secur. 106 (2021)

5. Kävrestad, J., Furnell, S., Nohlberg, M.: What parts of usable security are most important to users? In: Drevin, L., Miloslavskaya, N., Leung, W.S., von Solms, S. (eds.) WISE 2021. IAICT, vol. 615, pp. 126–139. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-80865-5_9

6. Baxter, G., Sommerville, I.: Socio-technical systems: from design methods to systems engineering. Interact. Comput. 23(1), 4–17 (2011)

7. Mumford, E.: The story of socio-technical design: reflections on its successes, failures and potential. Inf. Syst. J. 16(4), 317–342 (2006)

8. Venkatesh, V., Bala, H.: Technology acceptance model 3 and a research agenda on interventions. Decis. Sci. 39(2), 273–315 (2008)

9. Lee, Y., Kozar, K.A., Larsen, K.R.: The technology acceptance model: past, present, and future. Commun. Assoc. Inf. Syst. 12(1) (2003)

10. Kävrestad, J., Gellerstedt, M., Nohlberg, M., Rambusch, J.: Survey of users’ willingness to adopt and pay for cybersecurity training. In: Clarke, N., Furnell, S. (eds.) HAISA 2022, pp. 14–23. Springer, Cham (2022). https://doi.org/10.1007/978-3-031-12172-2_2
11. Bello, A., Maurushat, A.: Technical and behavioural training and awareness solutions for mitigating ransomware attacks. In: Silhavy, R. (ed.) CSOC 2020. AISC, vol. 1226, pp. 164–176. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-51974-2_14

12. Dahabiyeh, L.: Factors affecting organizational adoption and acceptance of computer-based security awareness training tools. Inf. Comput. Secur. 29(5), 836–849 (2021)

13. Paré, G., Kitsiou, S.: Methods for literature reviews. In: Handbook of eHealth Evaluation: An Evidence-Based Approach. https://www.ncbi.nlm.nih.gov/books/NBK481583/. Accessed 12 Apr 2023

14. Meline, T.: Selecting studies for systematic review: inclusion and exclusion criteria. Contemp. Issues Commun. Sci. Disord. 33, 21–27 (2006)

15. Jesson, J., Matheson, L., Lacey, F.M.: Doing Your Literature Review: Traditional and Systematic Techniques. Sage (2011)

16. Wohlin, C., Runeson, P., Höst, M., Ohlsson, M.C., Regnell, B., Wesslén, A.: Experimentation in Software Engineering. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-29044-2

17. Page, M.J., et al.: The PRISMA 2020 statement: an updated guideline for reporting systematic reviews. Int. J. Surg. 88, 105906 (2021). https://doi.org/10.1016/j.ijsu.2021.105906

18. Sarkis-Onofre, R., Catalá-López, F., Aromataris, E., Lockwood, C.: How to properly use the PRISMA statement. Syst. Rev. 10(1), 1–3 (2021). https://doi.org/10.1186/s13643-021-01671-z

19. Braun, V., Clarke, V.: Using thematic analysis in psychology. Qual. Res. Psychol. 3(2), 77–101 (2006)

20. Haney, J.M., Lutters, W.G.: “It’s scary… It’s confusing… It’s dull”: how cybersecurity advocates overcome negative perceptions of security. In: Proceedings of the Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018). USENIX (2018)

21. Ma, S.F., Zhang, S.X., Li, G., Wu, Y.: Exploring information security education on social media use Perspective of uses and gratifications theory. Aslib J. Inf. Manag. 71(5), 618–636 (2019)

22. Shillair, R.: Talking about online safety: a qualitative study exploring the cybersecurity learning process of online labor market workers. In: Proceedings of the 34th ACM International Conference on the Design of Communication. ACM (2016)

23. Wash, R., Cooper, M.M.: Who provides phishing training? Facts, stories, and people like me. In: Proceedings of the 2018 Chi Conference on Human Factors in Computing Systems. ACM (2018)

24. Silic, M., Lowry, P.B.: Using design-science based gamification to improve organizational security training and compliance. J. Manag. Inf. Syst. 37(1), 129–161 (2020)

25. Shen, L.W., Mammi, H.K., Din, M.M.: Cyber security awareness game (CSAG) for secondary school students. In: Proceedings of the 2021 International Conference on Data Science and Its Applications (ICoDSA). IEEE (2021)

26. Wen, Z.A., Lin, Z.Q., Chen, R., Andersen, E.: What hack: engaging anti-phishing training through a role-playing phishing simulation game. In: Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems. ACM (2019)

27. Jin, G., Tu, M., Kim, T.-H., Heffron, J., White, J.: Game based cybersecurity training for high school students. In: Proceedings of the 49th ACM Technical Symposium on Computer Science Education. ACM (2018)

28. Kletenik, D., Butbul, A., Chan, D., Kwok, D., LaSpina, M.: Game on: teaching cybersecurity to novices through the use of a serious game. J. Comput. Sci. Coll. 36(8), 11–21 (2021)

29. Cullinane, I., Huang, C., Sharkey, T., Moussavi, S.: Cyber security education through gaming cybersecurity games can be interactive, fun, educational and engaging. J. Comput. Sci. Coll. 30(6), 75–80 (2015)
30. Gokul, C.J., Pandit, S., Vaddepalli, S., Tupsamudre, H., Banahatti, V., Lodha, S.: PHISHY - a serious game to train enterprise users on phishing awareness. In: Proceedings of the 2018 Annual Symposium on Computer-Human Interaction in Play Companion Extended Abstracts. ACM (2018)

31. Stockett, J.: Dr. InfoSec: how to teach your community to stop worrying and love 2-factor authentication. In: Proceedings of the 2018 ACM SIGUCCS Annual Conference. ACM (2018)

32. Offor, P., Tejay, G.: Information systems security training in organizations: andragogical perspective. In: Proceedings of the 20th Americas Conference on Information Systems. AIS (2014)

33. Bélanger, F., Maier, J., Maier, M.: A longitudinal study on improving employee information protective knowledge and behaviors. Comput. Secur. 116, 102641 (2022)