Social engineering is a major threat in today's cybersecurity landscape. Unlike other types of cyberattacks, social engineering focuses on exploiting human psychology rather than technical vulnerabilities. By manipulating individuals into revealing sensitive information or taking
...
Social engineering is a major threat in today's cybersecurity landscape. Unlike other types of cyberattacks, social engineering focuses on exploiting human psychology rather than technical vulnerabilities. By manipulating individuals into revealing sensitive information or taking actions against their own interests, malicious actors can cause significant harm, ranging from financial loss to compromised systems. As a socio-technical problem, it requires not only technical measures but also awareness on the human side to defend against these threats. With advancements in technology and, most recently, generative artificial intelligence, social engineering attacks are becoming increasingly sophisticated, highlighting the urgency to educate individuals about how to recognise and defend against them. While existing efforts in research and industry mostly focus on interventions for workplace settings, little attention has been given to approaches targeted at the general public or everyday life contexts. This thesis addresses this gap by designing and evaluating a serious game to raise awareness of social engineering, focusing on families as the target group. The resulting game, “Connected & Protected”, employs an asymmetric tabletop format in which one player takes on the role of a social engineer, while the others play as family members, trying to protect their personal data from the attacker. The aim of the game is to educate players about common influence principles used in social engineering, how to counter them, and the risks that come with sharing personal data. The project takes a human-centred approach and involves users in multiple phases, including feedback sessions and playtesting to support concept development and prototyping. The game was evaluated using a pre- and post-test study design with 15 participants across five family groups, including a delayed post-test two weeks later to measure knowledge retention. The evaluation focused on three main areas: social engineering awareness, self-perceptions, and game experience. Results indicated that the game had positive effects on social engineering awareness, with significant improvements after gameplay that were largely retained at the delayed post-test. Participants improved in their ability to recognise influence principles in social engineering scenarios and showed increased knowledge about defensive strategies and data-sharing risks. Self-efficacy and perceived preparedness to deal with social engineering attempts likewise increased significantly after gameplay, while perceived susceptibility did not change notably. The game experience was overall well-received, with particularly high scores for enjoyment and audiovisual appeal, along with a positively rated perceived learning effect and willingness to play the game again. With this project, we provide novel insights into designing serious games for social engineering education aimed at the general public, leveraging the family setting as a medium for shared learning and intergenerational knowledge exchange. The contributions can serve as a starting point for practitioners and policymakers to extend security awareness interventions beyond the workplace, making social engineering education more accessible by bringing it into people's homes.