Which Cyber Training has the greatest learning impact?
Which training formats are most effective in the context of cyber training and have the greatest learning effect?
Why do we need Cyber Training?
One of the biggest and most costly dangers for companies is a cyber-attack in which customer and company data is stolen or the company becomes a victim of ransomware extortion. A secure technical infrastructure is often not enough here, because 97% of all hacker attacks are aimed at the human security gap, so-called “social engineering”. In 91% of all cases, cyber-attacks occur through an accidentally opened mail.
To eliminate this security gap, employees should be trained in security awareness. For example, employees should be able to recognize when an e-mail is a phishing e-mail and when it is not.
Thus, how can employees be trained in the best possible way to recognize cyber-attacks in time and protect the company?
Since all of these dangers lurk on the Internet, the only way to address them is through targeted cyber training in the form of e-learning formats. We will look into the question of which training formats are most effective in the context of cyber training and have the greatest learning effect.
The different e-learning formats
The way we learn has changed since the digital age. Why bother poring over books when the answer can be found in an entertaining way, in an attractive visualization, and straight to the point in a digital format?
Digital learning formats range from videos to games. The content of these formats can often be adapted to the needs of the user and put together individually.
More and more people use digital media to learn: schoolchildren and students as part of digital learning offerings from educational institutions, private individuals, for example for professional development, or companies that train their employees digitally.
Here we provide a brief overview of the most popular learning formats and their application in the field of cyber training:
The way we learn has changed fundamentally since the advent of YouTube & Co.: complicated content is conveyed succinctly and concisely with the use of videos. It is often easier to present complex contexts more effectively using images and visual effects than by simply reading. Learning videos are usually accompanied by audio tracks to provide an additional linguistic explanation of what is being shown.
Companies often use explainer videos to explain products or services to their customers.
So, learning videos are in demand like never before and are a standard format in e-learning.
Videos are often used for training purposes in security awareness cyber training, because the dangers that lurk in the cyber environment must also be presented visually, so that people know, for example, what a phishing e-mail looks like and how to recognize fake links.
Now, what characteristics should a training video have for it to have the best possible learning effect on the participants? On the one hand, the length of the video plays an important role: videos longer than 3 minutes can become boring and the viewers’ concentration drops. However, longer videos often make sense depending on the training content; but they should then be entertaining.
In general, videos should be produced in a style that is engaging and appropriate to the training content. The key here is to strike a balance between entertainment and knowledge transfer: Very complex topics, for example, require a more unexciting style, while lengthy topics and, as mentioned above, longer videos should be made as entertaining as possible to keep viewers’ attention.
The following is an overview of the most popular video styles in the cyber training context:
- Digital animation: The animation style is widely accepted everywhere and thus in the cyber training environment: Animations are suitable for young to old, as well as for simple to complicated content. Moreover, the video material can be used interculturally and in different language regions. Educational videos resort to the animation style, and for good reason: animated videos break down complex content and convey knowledge in an entertaining way. By means of animation, just about any content, no matter how abstract, can be presented in an appealing way. There are almost no limits to the imagination. Animated videos can be made more or less entertaining, depending on the requirements of the training content. For example, complex content can be kept black and white to reduce distraction, while more elements and colors can be used to convey dry content. An example of a cyber training video from LUCY’s new security awareness series in cartoon animation style can be found here.
- Whiteboard animation style is a form of animation in which a story is illustrated with marker pens on a whiteboard and explained via audio track. This video style allows users to fully concentrate on the learning content to be conveyed thanks to its simple and unagitated presentation, thus achieving a high recall and learning effect, and is therefore particularly suitable for rather complex topics. They therefore offer a good opportunity to explain concepts in a simple and appealing way. In addition, the production as well as the customization of whiteboard videos is relatively inexpensive and can be easily accomplished with little effort. An example of a LUCY Cyber Training video in whiteboard style can be found here.
- Comics: The comic style is currently very popular and conveys training content in a particularly entertaining way. However, this can quickly appear somewhat childish and unprofessional. Well-known comic styles include anime and manga.
- Live action: This format uses real actors. This way, the participants should be able to immerse themselves more easily in the situations. For this reason, we at LUCY place great emphasis on providing short live-action videos. For example, role plays, interviews, or even “soap operas” can be filmed to teach users what they need to know. Although this learning format is very realistic and can be exciting, it is very costly to produce and customization is nearly impossible. Further, live-action videos are often longer and this circumstance can exceed the available training budget per employee. Watch a LUCY Live-Action Cyber Training Video here.
- Interactive video: Interactive video is a combination of educational videos and games and quizzes. The videos are paused at regular intervals and users then answer questions about the previously learned content or they can even help decide the course and outcome of a video. This innovative learning format is considered particularly popular because users are less distracted and more involved than with a normal video or game. The acquired knowledge is thus tested at regular intervals and, if answered correctly, the motivation and enjoyment of learning also increases. This innovative and varied form of digital learning is often called the “future of e-learning” because of its high learning effect. And this method is also very popular in cyber training, as it allows learned material to be tested. For example, in cyber training, a video can first explain what the characteristics of a hacker scam are and then test this knowledge in a quiz.
Interactive videos are LUCY’s “specialty” and are often used in LUCY Cyber Training due to the high entertainment factor and learning effect. Here you can find an example of an interactive LUCY Cyber Training.
In game-based learning, knowledge is acquired with the help of digital games. The aim is to impart knowledge to the participants in a fun and entertaining way. The focus here is on the fun factor and also the “win” factor. For example, players can reach different levels or track their status on a leaderboard. Training participants should not feel as if they are attending a training session where they are forced to listen, but rather as if they are playing a game in their free time. Game-based learning is therefore considered to be particularly effective and is often used accordingly.
Games are also used in LUCY’s cyber training: The LUCY Phishing Game, for example, is modeled on “Who Wants to be a Millionaire?” Jokers can be used, as in the well-known game, and different levels, or amounts of money, can be reached. Play the LUCY Game.
Quizzes are a form of game-based learning, in which the knowledge of the participants is tested in a playful way, usually with multiple-choice options. Often a quiz follows a learning block to test what has been learned before or at the beginning and after completion of the overall training to be able to measure how successful the training has been.
The LUCY Cyber Training Malware Quiz tests the participants to check if they can recognize malicious software. Test yourself with LUCY’s Malware Cyber Training Quiz.
Standard or Individual Cyber Training?
We have thus seen that there are different types of e-learning formats and their application in cyber training, which are differently effective and can be used for different purposes. In addition to learning formats, there are other characteristics that are important for successful e-learning in the cyber training context. One important factor is the degree of customization of training content.
When producing e-learning content, a general distinction is made between standard production and individual production.
Standard content is produced for the masses and is sufficient if there is no need for company or industry-specific adaptations and prefabricated content is sufficient to meet the training objectives.
Where standard content is not sufficient due to company or industry-specific requirements, learning content can be customized and tailored specifically to the needs of employees and companies.
Customized cyber training content therefore makes it possible to train employees in a targeted manner: For example, if employees are to be trained to recognize phishing scams, the phishing tests used should be similar to the designs of suppliers or payment systems often used by the company in order to make the cyber training as realistic as possible.
Based on our experience, the need for individual adaptation increases significantly from a company size of 50 people. This is because larger companies have defined guidelines and requirements that they would like their staff to be trained in. You often hear: “The course on ‘secure password use’ largely covers our requirements, but we would like to add our company specifics”.
Monitoring learning outcomes and reporting.
What you can’t measure you can’t manage: that’s why the ability to monitor learning outcomes is another important characteristic in the implementation of e-learning training. On the one hand, this refers to the learning progress, but also to the improvement to the starting point. It is therefore important to test and record the knowledge level of the participants before the start of the training and then to query this regularly during the course and at the end of the training in order to be able to measure the success of the training. This can be done using integrated monitoring systems. By tracking their own learning progress and successes, training participants can be motivated to stay on track. Companies can measure the extent to which their investment in training is bearing fruit.
In the cybersecurity context, employees’ security awareness is tested at the beginning of the cyber training using various simulated cyber-attacks, such as phishing or smishing. Their progress is then monitored over time: how sensitized are employees to cyber-attacks and how able they are to recognize them.
With LUCY, it’s easy to measure cyber training learning progress and verify learning achievement. Attack statistics and learning progress can be tracked in real-time and over time. You can also track attack simulation statistics such as the number of emails opened, number of links clicked, and successful attacks.
For more information, visit https://lucysecurity.com/.
About Lucy Security
Founded in 2015, Lucy has transformed the ethical hacking experience of its founders into comprehensive training software that provides a 360° view of an organization’s IT security vulnerabilities. Lucy continues to receive numerous industry awards, including the ISPG Award 2020 for Best Cyber Security Education and Training and the Cybersecurity Excellence Awards 2020 for Best Anti-Phishing and Best Security Education Platform. The company is headquartered in Zug, Switzerland, with a U.S. office in Austin, TX. Further information can be found at www.lucysecurity.com