Given the increasingly interconnected world we live in, having a perception of the risks inherent in cybersecurity becomes crucial. No one is immune, and due to this pervasiveness, it is strictly required to design approaches and tools capable of educating anyone to recognize and avoid threats related to cybersecurity. Due to the efectiveness recognized to storytelling to engage learners of any age and grade, this article aims to provide an overview of current practices regarding approaches, tools, and assessments to raise awareness about cybersecurity via storytelling based on a systematic literature review. It revises 19 relevant articles out of 60 not duplicated records indexed by major databases, i.e., Scopus, ACM Digital Library, IEEE Xplore, which are compared in terms of target audience and assessment approach. Articles are relevant if they adopt digital tools to raise awareness concerning cybersecurity. It results in 30 digital academic or commercial tools, compared in terms of availability, supporting features, and target audience. According to the review results, storytelling is an interesting approach to lower access points to cybersecurity, demonstrating that there are glimmers of use in the corporate sector, too. Storytelling is mainly used in combination with game-based approaches, simulating real scenarios or engaging participants with interactive quizzes. Although freely available tools are rare and often discontinued, there is a short list of promising digital tools publicly available along with educational material. While storytelling is used as an entry point to raise learners' awareness about cybersecurity, further efort should be invested in approaching professionals.
We live in an increasingly interconnected world with the habit of exchanging information on the Web
continuously. Consequently, cybersecurity is becoming a more and more pervasive issue afecting
the lives of almost everyone. It implies a great need for everyone to be aware of the dangers and
consequences of using technology daily. Kids start surfing the Web, looking at videos, and playing
on tablets, unaware of the potential risks in cyberspace since the early stage of their childhood. This
non-conscious use spurs parents’ concerns about consuming inappropriate content or inadvertent
personal data sharing. Similarly, older adults often lack appropriate support to protect themselves [
Storytelling is recognized as an efective means in learning setting as it engages learners [
Given these premises as a promising learning approach, we investigate whether and to what extent
storytelling is explored in Cybersecurity Education. Storytelling might be beneficial in this field as
learning cybersecurity requires an holistic view, keeping into consideration organizational, societal,
legal, psychological, and economical aspects concerning security rather than merely focusing on
technological implications [
We analyze and compare educational programs for cybersecurity that take advantage of storytelling. Via a Systematic Literature Review approach, we extensively revise the literature indexed by major databases looking for peer-reviewed contributions in the intersection between cybersecurity and storytelling. It results in the revision of 19 articles considered relevant by two independent evaluators. Besides comparing educational approaches and their efectiveness, we are interested in identifying and comparing digital tools used in educational programs for teaching cybersecurity via storytelling. This review aims to: • understand the current practices related to increasing end-user awareness and education about cybersecurity via storytelling by reporting the target audience, the learning approach, the taught topic(s), the used tools, and the performed assessment, • articulate reflections on future directions to design approaches and tools to teach cybersecurity professionals, • encourage reproducibility and transparency of documented results by publishing row and elaborated data concerning the performed literature review as a reproducibility package, openly accessible online via Zenodo.
The structure of our work is organized as follows. Section 2 discusses the research methodology applied in this study to conduct a Systematic Literature Review and the Research Questions (RQs) that guided the study. Section 3 reports results, which are discussed along with the RQs in Section 4. Finally, Section 5 concludes the article with final thoughts and future directions.
This section clarifies the research questions (RQs), the data collection process, and the inclusion criteria based on the reported literature review.
Research Questions at the basis of this literature review follow:
RQ - What is the current situation related to increasing end-user awareness and education about cybersecurity via storytelling? Data Collection. The literature review was conducted by in-depth reading, interpreting, and categorizing papers proposing educational activities to increase end-user awareness and education about cybersecurity and taking advantage of storytelling. The aim was to develop a comprehensive understanding and critically assess the available tools relevant to moderate this activity. This review considered studies involving any target, from scholars to workers, without distinguishing in the formulated query or the inclusion/exclusion criteria.
This review focuses on contributions with an academic structure, published as peer-reviewed articles until April 2024, and indexed by Scopus1, ACM Digital Library2 and IEEE Xplore3. Accordingly, the 1Scopus: https://www.scopus.com 2ACM Digital Library: https://dl.acm.org 3IEEE Xplore: https://ieeexplore.ieee.org query results have been retrieved on April, 23rd 2024. Moreover, the procedure is fully detailed, making it possible to systematically repeat it on other databases. We used cybersecurity and storytelling and diferent variations of these terms as keywords. Specifically, we carried out the following query: (cybersecurity OR “cyber security” OR “cyber-security”) AND storytelling) configuring the diferent databases to look for the query in the title, abstract, and keyword. We apply no filters concerning the year of publication and subject areas. A total of 53 papers met these criteria, which have been integrated with hand-picked articles, reaching a total of 60 non-duplicate papers. Figure 1 summarizes the exclusion and inclusion criteria considered during the selection process on the basis of this literature review, which is detailed in the following.
Inclusion/Exclusion criteria. The screening process started, and the eligibility criteria were set. At this stage, a paper is considered relevant and hence eligible for the review process if it is published in a peer-reviewed venue, and it applies storytelling to cybersecurity. Two researchers autonomously screened articles by reading titles and abstracts. Results were recorded in a spreadsheet which coded whether a paper was judged to be either relevant (1) or irrelevant (-1). Then, they jointly discussed coding outcomes corresponding to opposite opinions until reaching an agreement. A similar approach has been performed in the eligibility phase. At this stage, a paper is considered relevant and hence to be considered included in the review if it is available, it applies storytelling for cybersecurity awareness and education via a digital tool without any constraint on the learner’s age. More in detail, we consider any contribution reporting approaches relevant to introducing, teaching, improving awareness, or engaging users in learning about cybersecurity via storytelling in any context. The two researchers autonomously coded articles and then jointly discussed opposite codes until reaching an agreement. It results in 19 included articles, which present or cite 30 either academic or commercial digital tools. Bias and limitations. The performed query might have missed studies targeting specific cybersecurity topics, using domain specific terminology concerning attacks, simulations, threats. However, we hypothesize that in introducing the research at least once cybersecurity is cited among title, abstract and keywords. The same thought might be related to storytelling and the risk that authors used synonyms or alternative ways to refer to the same approach.
In the current stage, the review only considers peer-reviewed contributions while collecting digital tools. Developers might opt for publishing them as open source software rather than opting for academic contributions. However, the performed process is described in so detail to enable reproducibility also on code repositories, such as GitHub, GitLab or Bitbucket, and enable the tool comparison with those cited in the literature.
Replication package. To strengthen the replicability, enable transparency, and support verification of our review, we have published a bundle with all the bibliography at each stage of the PRISMA chart annotated with comments and tags. In the replication package freely available on Zenodo at the link https://doi.org/10.5281/zenodo.11126096, the reader can see: the results of the search on Scopus, IEEE Xplore, and ACM Digital Library, both in terms of the performed query and the collection of articles matching the keyword in terms of BibTeX. Moreover, we also report hand-picked articles as a separate bibliography. These four raw bibliography files share the same prefix of 0. with x progressive number from 1 to 4, combined with the name of the queried database. The merged file contains all distinct articles annotated with tags to distinguish eligible articles from those not. Tags are reported in the BibTeX comment per each entry, along with the cause of the not eligibility, such as #notpeerreviewed (3 out of 17 not eligible), #outofscope (13 out of 17 not eligible), documenting if an updated version of the same contribution appeared, e.g., a journal version extending a conference paper (just a single case out of 17 not eligible). All contributions satisfying inclusion criteria applied on abstracts are reported in the bibliography entitled eligible, which documents which article has been included or not, along with the rationale for excluding it or the taxonomy to justify and categorize the inclusion. Reasons and taxonomy are modeled as tags reported in the comment field of each entry. Reasons for exclusion are #notpeerreviewed (5 out of 24 not included), #notinenglish (1 out of 24 not included) or out of scope, e.g., not proposing a digital tool to support the cybersecurity educational activity (18 out of 24 not included). Finally, the included bibliography reports eligibility and inclusion comments for the 19 included articles. Cross-cutting tags concern #debated articles, where the final scores required a discussion among evaluators. While raw articles are available as bib files, the articles corresponding to the merging, eligibility, and inclusion stages are accessible as bib files and HTML tables to simplify readability. The reproducibility package is completed by a index file that documents the procedure followed.
We come up with 19 included contributions summarized in Table 1, along with the tool(s) used, the target audience, and the addressed topic. The assessment column in Table 1 reports the performed assessment or the intended goal in proposing the educational activity as declared by authors by distinguishing approaches to engage, introduce, improve awareness, creativity, or let participants learn about cybersecurity by focusing on the impact on participants, meanwhile keeping track of contributions that involved target audience in the co-design of the toolkit or performed a usability assessment. We consider relevant to emphasize contributions performing co-design or usability studies as they are rare even if it is crucial to collect end-users feedback and improve the digital tool before measuring the impact that tools might have on end-users. The target column in Table 1 reports age when explicitly outlined in the evaluation of the revised contribution, keeping it generic when a target audience is reported at the design level, often missing a formal assessment.
Each included contribution presented a technology-enhanced educational scenario. As a result,
Table 2 compares tools by distinguishing commercial solutions, i.e., those released by companies,
and academic ones, referred to by included articles. Moreover, digital tools are classified according
to the educational approach in which the tool has been used, extending the classification proposed
by Chowdhury and Gkioulos [29]. In particular, we classified tools as game-based approaches, e.g.,
serious games, gamified environments or simulation platforms for teaching cybersecurity, video-based
approaches, focused on the use of recorded videos as educational material, comics and other approaches.
Tools are compared in terms of accessibility as explicitly modeled via the link column that reports
how to access it, along with the link’s status and the tool’s free nature. Moreover, for each tool, we
report the topic distinguishing between general purpose and domain-specific tools, the target audience,
and the technology used for the delivery mode if it enables authoring and supports collaboration. In
the following, we discuss tools according to the educational approach that exploits them.
Game-based approaches mainly use storytelling in terms of storyline. Educational approaches in this
category often combine interactive quizzes as checkpoints to assess learned concepts with gamified
elements such as awards in the case of correct replies and levels of increased complexity to challenge
participants. INTERLAND [34], Carnegie Cadets [30], PBS Cybersecurity Lab [31], CyberBullet [16],
Wolf, Hyena, and Fox game [23], Criminal Investigation [25], PlayingSafe [12], SAEG [14] belong to this
category. As an alternative to quiz, What.Hack [19] engages participants with sequence of puzzles, while
CyberCIEGE [
Comics-based approaches mainly focus on characters and roles involved in cybersecurity. All the tools supporting this kind of approach enable and require learners to author comics via general-purpose tools, such as Creative Suite [41], GameSalad Creator [42], comicgen [40], StoryboardThat [44], ComicBEE [39], or environments tailored to domain-specific scenarios, such as PrivacyToon [ 43] which focuses on privacy-related issues.
Uncategorized approaches include experiments with social robots, such as Zenbo [47], or interfaces used mainly by professionals to detect, organize, and render vulnerabilities to workers, such as visualization interfaces RouterJoyVis [45] and YourNetStory [46] used to visualize home router trafic data [21] or ontology driven storytelling GUI to let workers identify vulnerabilities in log files [28].
This section discusses results by organizing insights according to takeaways. Discussions will be aligned with RQs in the conclusions.
A handful of working and freely available tools. According to the performed systematic literature review, we devised 30 tools used or cited by educational activities to teach cybersecurity. They are almost equally distributed between academic and commercial tools, as evident by white and gray rows in Table 2. However, if we focus on available tools, the number narrows to 18, moving to 15 if we limit fully working tools, and only five if we are also interested in freely available solutions. This change in number may be mainly related to the interest in defining prototypes for research purposes, followed by the lack of funding and discontinuity in maintenance observed in academia. The five completely working and freely available tools are web-based and are almost commercial solutions, where CyberSecurity Lab [31], INTERLAND [34], and PrivacyToon [43] are domain-specific and tailored on privacy and (cyber)security topics, while Pixton [36] and comicgen [40] are general purpose tools that can have been used in cybersecurity learning activities.
Actively engage participants. Collaboration is widely exploited in learning settings because of
its efectiveness concerning individual eforts [ 48]. However, only 8 out of 30 tools were used in
the surveyed articles exploring cybersecurity education via storytelling support collaboration. It is a
surprising insight as cybersecurity may benefit from collaboration [ 24] as it naturally involves diferent
actors, which can be simulated via role-playing. Meanwhile, stories can be easily created and understood
in collaboration [
Cybersecurity is increasingly pervasive and has a global impact on nearly everyone. People now live in a cyber world where data are stored digitally and continuously shared online. Therefore, there is an urgent need for all to increase awareness concerning risks and how to mitigate their impact. As storytelling is considered a promising educational approach, we investigate its exploitation in cybersecurity education. The presented results are retrieved via a systematic literature review of peer-reviewed contributions indexed by the major databases focusing on initiatives exploiting storytelling in cybersecurity education via digital tools. While peer-reviewed articles have been revised mainly in terms of the performed assessment, tools have been assessed in terms of availability, target, and supported features.
Replying to RQ, storytelling is explored as a promising approach to increase learners’ awareness and education about cybersecurity, probably due to the perceived potentiality to simplify the access point to complex and technical topics. Moderators of cybersecurity educational activities can rely on a handful of working and freely available tools, mainly commercial released for free, along with publicly available educational material. However, it is only marginally explored for professionals. Workers should be more involved as target groups, collecting their needs and verifying the utility of proposed tools to satisfy users’ requirements. In a single case, workers are the target group, and storytelling is used as an approach to detect and verbalize vulnerabilities in log files. It envisions the possibility of using stories to identify patterns and visually render information along with narration to guide interpretation and mitigate the impact of vulnerabilities. In this direction, we consider relevant mentioning tools such as RouterJoyVis [45] and YourNetStory [46] to visually render patterns and ontology-driven GUI [28] to verbalize vulnerabilities.
Practical implications and future direction for future technology-enhanced learning tools. While game-based approaches are promising to engage participants of any age, end-users play the passive role of the information consumers. Alternative approaches, such as those based on videos and comics, opt for moving end-users to the position of story creator. Starting from those initiatives, it would be beneficial to encourage participants further to play an active role in authoring stories.
Digital tools often lack accompanying educational material, hindering reproducibility and transparency. Researchers must invest further efort in publicly and openly making educational videos or supporting material available. This will not only simplify the learning experience but also enable fair comparison among experiences, fostering a more responsible and transparent learning environment.
Surprisingly, collaboration is only partially exploited while learning cybersecurity. While some activities are moderated in such a way that participants collaborate with a unique robot or interface, collaboration is rarely mediated by the tool itself. As a result, collaboration disappears when the experience move to a remote setting. To keep the learning experience as unchanged as possible when transitioning between in-person and remote activities, it is crucial that digital tools spur technologymediated cooperation and collaborative work.
Finally, there are some topics that are fundamental challenges in cybersecurity, such as information disorder, that are not explicitly covered by the included contributions. It is crucial to consider those aspects in the future, spurring a wider awareness in terms of data literacy and conscious consumption of content on the web capable of distinguishing misleading content from authentic one. Likewise, it is crucial to provide citizens of all genders and ages with (digital) tools necessary for an informed use of digital currencies dealing with cybersecurity and blockchains.
This work was partially supported by the SERICS (PE00000014) under the MUR National Recovery and Resilience Plan funded by the European Union - NextGenerationEU. This communication reflects only the author’s view, and the Commissions are not responsible for any use that may be made of the information it contains. [11] P. Kumaraguru, J. Cranshaw, A. Acquisti, L. Cranor, J. Hong, M. A. Blair, T. Pham, School of phish: a real-world evaluation of anti-phishing training, in: Proceedings of the 5th Symposium on Usable Privacy and Security, ACM, 2009. doi:10.1145/1572532.1572536. [12] M. Newbould, S. Furnell, Playing safe: A prototype game for raising awareness of social engineering, Australian Information Security Management Conference (2009). [13] F. Giannakas, G. Kambourakis, S. Gritzalis, CyberAware: A mobile game-based app for cybersecurity education and awareness, in: International Conference on Interactive Mobile Communication Technologies and Learning (IMCL), 2015, pp. 54–58. doi:10.1109/IMCTL.2015.7359553. [14] A.-S. T. Olanrewaju, N. H. Zakaria, Social engineering awareness game (SEAG): an empirical evaluation of using game towards improving information security awareness, in: Proceedings of the 5th International Conference on Computing and Informatics, ICOCI, 2015. URL: https: //api.semanticscholar.org/CorpusID:8873731. [15] L. Zhang-Kennedy, K. Baig, S. Chiasson, Engaging children about online privacy through storytelling in an interactive comic, Electronic Visualisation and the Arts (EVA) (2017) 1–11. doi:10.14236/ewic/HCI2017.45. [16] J. Mikka-Muntuumo, A. Peters, H. Jazri, CyberBullet-Share Your Story: an interactive game for stimulating awareness on the harm and negative efects of the internet, in: Proceedings of the 2nd African Conference for Human Computer Interaction: Thriving Communities, 2018, pp. 1–4. doi:10.1145/3283458.3283482. [17] B. Ledbetter, Z. Wallace, A. Harms, A. Siraj, L. Buchanan, CySCom: Cybersecurity COMics, in: 2016 IEEE Conference on Intelligence and Security Informatics (ISI), IEEE, 2016, pp. 282–284. doi:10.1109/ISI.2016.7745490. [18] J. Barela, T. E. Gasiba, S. R. Suppan, M. Berges, K. Beckers, When interactive graphic storytelling fails, in: 2019 IEEE 27th International Requirements Engineering Conference Workshops (REW), IEEE, 2019, pp. 164–169. doi:10.1109/REW.2019.00034. [19] Z. A. Wen, Z. Lin, R. Chen, E. Andersen, What.Hack: Engaging anti-phishing training through a role-playing phishing simulation game, in: Proceedings of the CHI Conference on Human Factors in Computing Systems, ACM, 2019, p. 1–12. doi:10.1145/3290605.3300338. [20] S. V. Veneruso, L. S. Ferro, A. Marrella, M. Mecella, T. Catarci, CyberVR: an interactive learning experience in virtual reality for cybersecurity related issues, in: Proceedings of the International Conference on Advanced Visual Interfaces, ACM, 2020, pp. 1–8. doi:10.1145/3399715.3399860. [21] M. Schufrin, D. Sessler, S. L. Reynolds, S. Ahmad, T. Mertz, J. Kohlhammer, Information visualization interface on home router trafic data for laypersons, in: Proceedings of the International Conference on Advanced Visual Interfaces, 2020, pp. 1–3. doi:10.1145/3399715.3399970. [22] F. Khalid, T. El-Maliki, Teachers’ experiences in the development of digital storytelling for cyber risk awareness, International Journal of Advanced Computer Science and Applications 11 (2020). doi:10.14569/IJACSA.2020.0110225. [23] D. P. Snyman, G. R. Drevin, H. A. Kruger, L. Drevin, J. Allers, A wolf, hyena, and fox game to raise cybersecurity awareness among pre-school children, in: International Symposium on Human Aspects of Information Security and Assurance, Springer, 2021, pp. 91–101. doi:10.1007/ 978-3-030-81111-2_8. [24] Y.-M. Chiou, T. Barnes, S. M. Jelenewicz, C. Mouza, C.-C. Shen, Teacher views on storytelling-based cybersecurity education with social robots, in: Interaction Design and Children, 2021, pp. 508–512. doi:10.1145/3459990.3465199. [25] A. M. P. Hall, John Grady Mohanty, N. D. Nguyen, J. C. Bahamón, H. Ramaprasad, M. Sridhar, Criminal investigations: An interactive experience to improve student engagement and achievement in cybersecurity courses, in: Proceedings of the 53rd ACM Technical Symposium on Computer Science Education-Volume 1, 2022, pp. 696–702. doi:10.1145/3408877.3439630. [26] S. Suh, S. Lamorea, E. Law, L. Zhang-Kennedy, PrivacyToon: Concept-driven storytelling with creativity support for privacy concepts, in: Designing Interactive Systems Conference, 2022, pp. 41–57. doi:10.1145/3532106.3533557. [27] W. Heiden, T. Kless, T. Neteler, A crossmedia storytelling platform to empower vulnerable groups for IT security, in: International Conference on Interactive Digital Storytelling, Springer, 2023, pp. 195–201. doi:10.1007/978-3-031-47658-7_17. [28] R. Hassan, C. Bandi, M.-T. Tsai, S. Golchin, S. M. P D, S. Rafatirad, S. Salehi, Automated supervised topic modeling framework for hardware weaknesses, in: 24th International Symposium on Quality Electronic Design (ISQED), 2023, pp. 1–8. doi:10.1109/ISQED57927.2023.10129378. [29] N. Chowdhury, V. Gkioulos, Cyber security training for critical infrastructure protection: A literature review, Computer Science Review 40 (2021) 100361. [30] Carnegie Mellon’s Information Networking Institute and Carnegie Mellon CyLab, Carnegie Cadets: The MySecureCyberspace Game, 2007. URL: http://www.carnegiecyberacademy.com, [Online, Last access April 8th, 2024]. [31] NOVA Labs, Cybersecurity Lab, 2013. URL: https://www.pbs.org/wgbh/nova/labs/lab/cyber, [Online, Last access April 8th, 2024]. [32] Ion Storm, Deus Ex, 2000. [33] exosyphen studios, Hacker Evolution Duality, 2011. [34] Google, INTERLAND, 2017. URL: https://beinternetawesome.withgoogle.com, [Online, Last access
April 8th, 2024]. [35] Ubisoft, WhatDogs, 2014. URL: https://www.ubisoft.com/it-it/game/watch-dogs/watch-dogs, [Online, Last access April 8th, 2024]. [36] Pixton Comics Inc., Pixton, 2022. URL: https://www.pixton.com, [Online, Last access April 8th, 2024]. [37] Plotagon, Plotagon, 2013. URL: https://www.plotagon.com, [Online, Last access April 8th, 2024]. [38] PowToon Ltd., PowToon, 2012. URL: https://www.powtoon.com, [Online, Last access April 8th, 2024]. [39] U.S. Department of Homeland Security, Comic-BEE, 2003. URL: http://securedecisions.com/ comicbee, [Online, Last access April 8th, 2024]. [40] Gramener, Comicgen, 2021. URL: https://gramener.com/comicgen, [Online, Last access April 8th, 2024]. [41] Adobe, Adobe creative suite, 2012. [42] GameSalad, Gamesalad creator, 2016. URL: https://creator.gamesalad.com, [Online, Last access
April 8th, 2024]. [43] S. Suh, S. Lamorea, E. Law, L. Zhang-Kennedy, PrivacyToon, 2020. URL: https://privacytoon.
uwaterloo.ca, [Online, Last access April 8th, 2024]. [44] Capterra, Storyboard That, 2012. URL: https://www.storyboardthat.com, [Online, Last access April 8th, 2024]. [45] Fraunhofer IGD, RouterJoyVis, 2020. URL: https://routerjoyvis.visperience.igd.fraunhofer.de, [Not working in April 8th, 2024]. [46] Fraunhofer IGD, YourNetStory, 2020. URL: https://yournetstory.visperience.igd.fraunhofer.de, [Not working in April 8th, 2024]. [47] ASUS, Zenbo, 2017. [48] C.-m. Hsiung, The efectiveness of cooperative learning, Journal of engineering Education 101 (2012) 119–137. [49] L. Zhang-Kennedy, S. Chiasson, A systematic review of multimedia tools for cybersecurity awareness and education, ACM Computing Surveys (CSUR) 54 (2021) 1–39. [50] F. Alotaibi, S. Furnell, I. Stengel, M. Papadaki, A review of using gaming technology for cybersecurity awareness, International Journal of Information Security (IJISR) 6 (2016) 660–666.