Evaluating the impact of immersive virtual reality in cybersecurity education for user empowerment against cyber threats

The sophisticated and highly evolving nature of cyber threats, along with their substantial social and financial impact, requires business and government organizations to adopt proactive measures to sustain robust cybersecurity defenses. Employees act as the first line of defense against cyber-attacks, ensuring their cybersecurity awareness is of vital importance. Conventional training techniques, comprising textual content and passive lectures, fall short in providing sustained user engagement, behavioral adaptations, long-lasting knowledge retention, and other key outcomes required to equip humans with efficient cyber defense skills. So, there is a critical need for innovative educational approaches that can deal with such issues. This study presents a novel cybersecurity educational framework designed to empower users to identify and thwart cyberattacks through immersive Virtual Reality (VR) training systems. This study proposes and evaluates two distinct VR learning environments: a desktop VR setup employing Leap Motion hand gesture-based interaction and an immersive VR (IVR) system utilizing head-mounted displays and hand controllers to enhance cybersecurity learning, engagement, and knowledge retention. These VR systems are meticulously compared to traditional textbook and video tutorial-based learning methods based on learning effectiveness, engagement, and retention, and evaluated for improved usability and spatial presence. Experiments demonstrate significant results for both VR systems against video and textbook learning techniques regarding comprehension of cybersecurity concepts, user engagement, and ease of use. Particularly, the IVR system outperformed in knowledge retention, followed by Desktop VR, video tutorial, and textbook learning, respectively. Usability assessments result in excellent user satisfaction for both VR setups, while spatial presence was significantly stronger in the IVR system. These findings affirm that the proposed VR systems offer an effective and engaging solution for cybersecurity training in educational and potentially organizational situations. Specifically, the use of Desktop VR offers a more cost-effective and accessible alternative, suggesting a pathway toward greater scalability.