When Interactive Graphic Storytelling Fails

TL;DR

This study explored the use of interactive graphic vignettes for cybersecurity awareness training but found that participants preferred text-only materials and the comics did not meet the intended educational requirements.

Contribution

It investigates the effectiveness of interactive graphic storytelling for cybersecurity education and highlights challenges in engaging professionals through visual narratives.

Findings

Participants found images distracting and preferred text-only content.

The comics did not fulfill the educational requirements in a CTF context.

Interactive comics may not be effective for cybersecurity training.

Abstract

Many people are unaware of the digital dangers that lie around each cyber-corner. Teaching people how to recognize dangerous situations is crucial, especially for those who work on or with computers. We postulated that interactive graphic vignettes could be a great way to expose professionals to dangerous situations and demonstrate the effects of their choices in these situations. In that way, we aimed to inoculate employees against cybersecurity threats. We used the Comic-BEE platform to create interactive security awareness vignettes and evaluated for how employees of a major industrial company perceived them. For analysing the potential of these comics, we ran an evaluation study as part of a capture-the-flag (CTF) event, an interactive exercise for hacking vulnerable software. We evaluated whether the comics fulfilled our requirements based on the responses of the participants. We showed the comics, on various cybersecurity concepts, to 20 volunteers. In the context of a CTF event, our requirements were not fulfilled. Most participants considered the images distracting, stating a preference for text-only material.