Game-based learning for cybersecurity: enterprise implications from testing competing theories involving immersion, cognitive load and autonomy

Purpose In this paper, we propose and test a conceptual model of how the psychological constructs of immersion, cognitive load (CL) and perceived autonomy (PA) relate to the performance of users at cybersecurity games. Design/methodology/approach We test the proposed model through an experimental study of 208 participants who play a cybersecurity game and answer a survey. We use structural equation modeling to test our hypotheses and further compute Shapley values to assess the contribution of each construct to game outcomes. Findings Results reveal that immersion is an important explanator of CL, PA and outcome. Additionally, our statistical tests show how the inclusion of CL in the conceptual model brings out the relation between autonomy and game-outcome. Originality/value This study combines constructs stemming from different theories to propose a conceptual model that better explains game performance. The findings will help enhance learner engagement and motivation. In turn, this can potentially add value to designing cost-effective training methods that can address the growing range of cybersecurity issues in enterprises.