Game-Based Experiential Social Engineering Scenarios with Virtual Agents to Improve Undergraduate Cybersecurity Learning

This project aims to serve the national interest by improving undergraduate cybersecurity education through interactive practice with realistic social engineering risks. Social engineering attacks exploit human behavior, organizational routines, and policy gaps, yet undergraduate cybersecurity courses often provide limited opportunities for students to practice recognizing and responding to these risks in realistic settings. The importance of this IUSE: EDU Engaged Student Learning project lies in helping students develop the socio-technical awareness, evidence-based reasoning, policy-design skills, and professional responsibility needed for modern cybersecurity practice. The project plans to develop a course-embedded, game-based simulation in which undergraduate students interact with campus-based scenarios involving virtual agents, identify suspicious behaviors, document evidence, report concerns, and design organizational policies that reduce risk while preserving legitimate work. The project intends to support repeated practice through instructor-configured scenario variants, allowing students to learn from feedback without relying on rote repetition. Expected outcomes include improved student learning about social engineering, stronger reasoning about security and workflow tradeoffs, and reusable instructional materials that can support adoption in other undergraduate cybersecurity courses. The goals of the project are to develop and evaluate a single-player cybersecurity learning module, investigate conditions under which game-based experiential learning improves students’ recognition and mitigation of social engineering vulnerabilities, and advance understanding of how instructor-controlled scenario variation can support targeted practice. The project plans to use predefined social engineering scenario templates validated by cybersecurity experts, an optimization-based scenario configuration engine, virtual agents, structured evidence prompts, policy design activities, replay cycles, and feedback on missed vulnerabilities, false positives, and trade-offs. The project plans to assess learning through pre- and post-assessments, in-simulation performance logs, rubric-scored policy proposals, written reflections, and exploratory measures of self-efficacy, resilience, and social responsibility. The project also plans to examine whether changes in scenario objective targets produce variants that emphasize different learning objectives and lead to measurable differences in student practice. Expected contributions include new knowledge about experiential cybersecurity learning, design principles for using virtual-agent scenarios in undergraduate instruction, and reusable resources such as scenario templates, instructor guides, grading rubrics, and open-source software artifacts. The NSF IUSE: EDU Program supports research and development projects to improve the effectiveness of STEM education for all students. Through the Engaged Student Learning track, the program supports the creation, exploration, and implementation of promising practices and tools. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.