Security Education in Higher Education through AI-Powered Gamification

Synthesis: Cybersecurity education faces increasing challenges as AI-driven attacks become more realistic and harder to detect, while traditional video-based training in higher education suffers from low engagement and limited effectiveness. Li and colleagues explore AI-powered gamification in cybersecurity education through several short, mobile-friendly games covering topics from password security to text and phone scam recognition, incorporating quiz-based, narrative-based, and Simulation-based designs as well as interactive formats such as TikTok Mini-Games. A two-tiered evaluation with 59 college students (9 technical experts and 50 general users) indicates the potential of AI-powered gamification to improve engagement and increase attention to cybersecurity topics in higher education.

Key Findings

1. Traditional video-based cybersecurity training in higher education often suffers from both low engagement and limited effectiveness.
2. AI-powered gamification can deliver engaging, meaningful, and personalized learning experiences.
3. Several short, mobile-friendly games cover topics from password security to text and phone scam recognition.
4. Designs incorporate quiz-based, narrative-based, and simulation-based gamification strategies as well as interactive formats such as TikTok Mini-Games.
5. A two-tiered evaluation with 59 college students indicates potential to improve engagement and attention to cybersecurity topics.

What this means for practice

• Instructors. Replace long desktop security modules with short, mobile-first mini-games: among the 50 general students surveyed, 90% (45/50) agreed or strongly agreed that they felt more confident avoiding security risks after playing, and 78% (39/50) said the game improved their understanding of staying secure online.
• Designers. Keep generative AI in the adversarial role only — producing phishing text or scam calls — and deliver the explanatory teaching content through standard, non-generative interfaces, as this study's phone-scam module did to guarantee pedagogical accuracy.
• Designers. Randomize the human-facing surface of scam simulations (the phone module varied gender, tone, and accent across voice profiles) so the game does not reinforce stereotypes about who commits cyber attacks.
• Administrators. Shift campus security metrics from compliance to resilience, tracking how students perform in simulated attacks over time rather than the percentage who complete a video module — the direction the authors advocate for institutional policy.
• Instructors. Integrate gamified modules into the LMS rather than running them as standalone awareness tools; the authors identify this as the next step precisely because the current platform sits outside coursework.

Limitations

• The main evaluation is a self-report preference survey: 50 general students (25 male, 25 female) at one university rated the games, so the evidence is acceptance and self-reported confidence rather than observed resistance to real phishing or behavioral change.
• The expert tier was not independent: the 9 technical experts were the games' developers and alpha testers, so their judgments of scenario accuracy, AI-response realism, and deployment stability are self-assessment by the design team.
• No control group and no learning measure: the study reports no comparison against existing training and no pre/post knowledge or behavior outcome.
• The platform was validated as a standalone tool outside the university LMS, leaving untested whether embedding the modules in coursework changes engagement or completion.

Citation

Li, Buzaid, & Qu (2026). Security Education in Higher Education through AI-Powered Gamification.