What does the research say about gamification?
Michael Sailer and Lisa Homner pooled 38 publications reporting 40 experiments, published between 2013 and 2017, that compared gamified instruction with conventional instruction. Gamification improved all three types of outcome. The effect sizes below are Hedges' g, which expresses the difference between groups in standard deviations. By common convention, about 0.2 counts as a small effect and about 0.5 as a medium one, so the knowledge effect is close to medium.
| Outcome domain | What the studies measured | Effect size (Hedges' g) |
|---|---|---|
| Cognitive | Conceptual and applied knowledge | .49 (19 studies) |
| Motivational | Motivation, attitudes, engagement, self-efficacy | .36 (16 studies) |
| Behavioral | Skills and task performance, mostly measured during the gamified activity | .25 (9 studies) |
The knowledge effect was the most stable and held in the subset of studies with the strongest designs. The behavioral effect was smaller and less stable. It was mostly measured during the gamified activity, so it shows performance in training rather than in daily work.
Workplace evidence comes from Mario Silic and Paul Benjamin Lowry. In a six-month field study with 420 participants in one organization, gamified security training designed around employees' motivation and coping needs produced statistically significant positive behavioral changes. They also found that an appropriate level of challenge mattered.
Which game mechanics work best?
In a 2017 experiment, Michael Sailer, Jan Hense, Sarah Mayr and Heinz Mandl tested single game elements against autonomy, competence and relatedness, the three psychological needs that self-determination theory describes. Badges, leaderboards and performance graphs increased competence need satisfaction and perceived task meaningfulness. Avatars, a meaningful story and teammates increased social relatedness.
The 2020 meta-analysis shows which design features went with the largest behavioral effects. Competition combined with collaboration, for example teams competing against other teams, produced the largest effect (g = .70, three experiments). Game fiction, such as a story or game world, also raised the effect (g = .41), and individual competition alone showed no significant effect. Both results come from comparisons across studies rather than direct experiments.
| Game mechanic | Best fit in a security program | Evidence |
|---|---|---|
| Badges, performance graphs (competence) | Knowledge goals such as recognizing phishing indicators or remembering the reporting steps | Raise competence and perceived task meaningfulness. |
| Leaderboards (competence) | Team-level scores or opt-in quizzes | Strongest with collaboration. Individual rankings can cause anxiety. |
| Story, game world, avatars (relatedness) | Concrete scenarios, for example a cloned-voice call from the "CFO" during a payment run | Larger behavioral effect (g = .41, three studies). |
| Teammates, team challenges (relatedness) | Reporting and verification as a team norm | With competition, the largest behavioral effect (g = .70, three experiments). |
The UK's National Cyber Security Centre describes a related approach in its phishing guidance. Some organizations ask staff to write their own phishing emails instead of only receiving simulations, and a friendly competition between peers avoids the "us vs them" relationship that simulations can create with the security team.
How to use leaderboards and time pressure well
Leaderboards and time pressure are common in security games and need the most careful design. In 2025, Anderson Kevin Gwenhure and SangGyu Nam reviewed 12 peer-reviewed studies of gamified cybersecurity training and found that these two elements often caused anxiety and disengagement, and that most programs were evaluated only during the novelty phase (JITE: Research).
Both problems have practical design answers. Team leaderboards keep the motivating effect of competition while adding collaboration, the combination with the strongest behavioral effect in the meta-analysis. Personal progress graphs show each employee's improvement without ranking colleagues.
For time pressure, reward correct decisions rather than fast ones. The NCSC recommends verifying important email requests through a second channel, and scoring should reward that check.
If you run awareness training in a German company with a works council, a leaderboard of named employees is a co-determination question before it is a design question. It processes data about individual behavior and performance, and technical systems suited to monitoring behavior or performance are subject to works council co-determination under § 87(1) no. 6 BetrVG.
What can security teams learn from Tour de Phish?
Players ride through a cyclist's first professional race and decide for each incoming email whether to reply, report or delete it. The game was built with the Department of Customer Service's Chief Information Security Office. Players earned points for correctly reporting a phishing email and lost points for replying to or deleting one, and the game drew attention to the reporting button throughout.
Feedback described the real-world consequence of each choice. A correct report told players they had protected customers' confidential information, and a click told them malware had reached the system. By 2022, the department was also directing employees who clicked a simulated phishing email to play the game, which turned it into practice at the moment of a mistake.
The game combined points, a leaderboard, time pressure and rising difficulty levels with clear rewards for reporting, and staff rated it highly. Its published results measure preference and confidence rather than reporting rates.
How to set up and measure a gamified pilot
The NCSC recommends counting how many people reported a phishing email as well as how many clicked it. Reporting also gives a gamified program a positive behavior to reward, and a small pilot tests that before a full rollout.
- Pick one behavior. Choose reporting suspicious emails, or verifying a payment that appears to come from a managing director through a second channel, rather than "awareness" in general.
- Agree the rules first. The NCSC advises checking with HR before running phishing simulations. In Germany, involve the works council if results can be tied to individuals.
- Build scenarios employees recognize. A supplier changing bank details or a caller posing as IT support works better than a generic quiz. The UK's NPSA publishes free campaign material for designing such training.
- Score teams and correct decisions. Reward correct reports and verifications at team level, give feedback right after each decision, and give no extra points for answering quickly.
- Measure before launch and for several quarters after it. Use the measures below, starting with a baseline.
- Simulation reporting rate: the percentage of delivered simulated phishing messages that employees report.
- Simulation time to report: the time from delivery of a simulated message to its first report.
- Real-world reports: the number of employee reports per period, the share that triage confirms as malicious, and the time from a confirmed malicious message's arrival to its first report.
- Verification behavior: whether employees confirm unusual requests through a second channel, for example in simulations that ask for a payment or bank-detail change.
Employee reports also work as detection. In an NCSC case study, 50 of 1,800 malicious emails reached inboxes at a financial-sector company with about 4,000 employees, staff reported 25 of them, and those reports were the first sign that the attack had passed the email filter.
A pilot scope template with success KPIs covers the scoping and sign-off steps for a pilot like this.
How revel8 supports behavior-focused practice
revel8 simulates current attacks across email, SMS, voice calls and deepfake video, personalized with OSINT. Each interaction is followed by immediate feedback and a short lesson in the Security Awareness Training. The Awareness Playlist adapts the sequence of simulations to each employee over time, and security teams follow results at group level in Risk Monitoring & Mitigation.
