Cyber security is a global issue and this post is about the design thinking behind our latest Game with Purpose, created not for gamers, but workplace professionals young and old around the world.

We wanted to prove games can be at least as effective as eLearning by affecting positive behaviour change in a fun and rewarding experience. As with all Preloaded games, our aim is for the winning strategy to require a deep understanding of the content so the act of playing to win is learning in action. Here’s how we did it.

K.I.S.S

A key part of concept and planning was a paper prototype to enable the design team to play through the idea and observe some early flaws. As you’d expect from the wealth of cyber-security issues, there were too many moving parts and a complex game mechanic was obscuring the key learning. It was particularly important to resolve this issue early because our target audience were not typical gamers. Working on paper gave us the opportunity to rapidly iterate the design.

From paper prototype to early digital prototype

We threw away the world map and associated narrative, instead simply focussing on the protection of data. Action cards are played against incoming threat cards targeting your company’s network of ‘nodes’, represented by items like computers, phones, personnel and cloud storage. Referring to the day to day business environment and terminology had the benefit of lowering the cognitive load which improves the digestion of learning content.

Learning content

Compared with traditional eLearning, the faster pace of games requires information to be ‘chunked’ into smaller, more digestible pieces. This means being efficient not just with the content, but screen real-estate and the way it’s presented. The user interface (UI) went through a number of iterations to accommodate contextual information so learning is conveyed at the point of action rather than in abstracted menu systems.

When an outbreak is triggered, it’s accompanied by a real world example, key features of the outbreak and the best way to defeat it. Zero Threat employed the simple but effective method of drip-feeding content over a number of seconds to encourage players to read.

Scrolling over an action card gives information about that action, then after a delay reveals the numerical gameplay attributes, encouraging players to process the narrative content and build connections around strengths and weaknesses. Ultimately players are invited to make strategic choices designed to correspond with real-world cyber defence strategies.

The huge range of content was integrated in various formats

Originally, action card headings were based around job titles to make the game more personable and show that people are the key – i.e. ‘Junior Technician’ or ‘Secretary’. However, we settled on titles that link directly to the action that card performs – i.e. ‘Report suspicious email’ or ‘Change password’. This surfaced the learning content more effectively and encourages players to consider their actions in the real world.

In card games, players tend to develop strategies around preferred cards, so we reduced the range of cards over time to create distinct gameplay options. To reinforce key gameplay – and learning – moments we created a narrative log. The effect each action has on the network is recounted in the log, providing extra context.

AI behaviour

The opponent is designed to act in accordance with how a real threat might behave. Each threat card has an associated category relating to real-world scenarios, for example, a ‘Social engineering’ threat will attack a ‘Personnel’ node. Alongside this, each virus outbreak is designed to represent real-world behaviour; a worm spreads quickly through the network, while a trojan is hard to detect and does not trigger an alert.

During AI testing, a few issues needed ironing out. An outbreak could only infect an unprotected node, but in later stages of the game all nodes may be defended. We created an advanced behaviour so the opponent switches its strategy to first clear a node’s defence, then infect. The inspiration for this came from an unlikely source.

Honda’s VTEC engine was very innovative when it first launched. It was designed to work well at low RPM and be smooth around town and when the RPM reaches a certain level it switches to a different cam profile, thus unleashing more power. When approaching this problem we were reminded of this system and implemented a similar solution.

Striking visual effects were used to drive home the severity of an outbreak

A question of balance

Zero Threat is essentially a numbers game and a powerful config sheet was created to easily update game settings. Our design team used graphs to gauge probability curves, ensuring the game balance was, on paper at least, in the right ball park.

However, there’s no replacement for manual playtesting and this game in particular took a fair chunk of time to balance. In the end, it was time well spent, because game ‘feel’ is so important, regardless of the numbers behind it. But next time we tackle a simulation like this we’ll prioritise some automated testing behaviour! This would help us quickly mimic a wide range of abilities and play-throughs, helping identify play patterns to inform balance tweaks.

You can’t replace game play testing wholesale, but it would certainly lighten the load.

Game modelling and balancing in action

A product of (and for!) our time

Zero Threat is the first in a line of high-quality training games that draw on the wealth of expertise across Learning Technologies Group to address critical business challenges. 40% of the world’s population have internet access and this is only going to grow, along with the risk of cyber crime.

If you want to bring your workforce up to speed in a modern and engaging way, get in touch, we’d love to help.