Unveiling personalized and gamification-based cybersecurity risks within financial institutions

Quality assessment criteria

The following are the criteria used to assess the quality of the selected primary studies. This quality assessment was done on the following basis:

• The study focuses on the Integration and Analysis of the data, and the possible answers were: Yes (1), No (0)

• Assessment: 2021, 2022, 2023, 2024 = (3), 2018, 2019–2020 (2), 2016, 2017 (1), before 2015 (0.5)

• The study is published in a prestigious venue and assessed based on the CORE ranking for conferences (A, B, and C) and the Scientific Journal Ranking (SJR) for journals, letters, and scientific reports, categorized into Q1, Q2, Q3, and Q4. articles in the Q1/Core A category receive a score of 3, Q2/Core B category articles score 2, Q3/Core C category articles are rated at 1, and Q4 articles receive a score of 0.5.

• The articles are cited more than 200 (3), 200–150 (2.5), 149–100 (2), 99–50 (1.5), 49–1 (1).

The evaluation criteria outlined in the aforementioned bullet points incorporate the analysis of data (W), yearly disruption of articles (X), articles’ ranking (Y), and citation frequency (Z), as detailed in Table 6. This table offers a comprehensive overview of the quality assessment conducted for each article, specifying their titles and sources, including journals (J), conferences (C), books (B), ArXiv (A), or reports (R). The major aim is to assess the credibility of the included articles, which reflects various quality indicators like methodological consistency, theoretical framework, and alignment with research objectives. Through meticulous scrutiny, Table 6 aims to provide readers with insights into the reliability and validity of the findings presented in each article.

Table 7 presents an overview of the quality assessment of the articles’ scores for focusing on game-based cyber threats in financial institutions. The scores range from 9, which is the highest, to 2.5, the lowest. This evaluation is also necessary to ensure the rigor and reliability of the studies addressing game-based cyber threats in financial institutions. Each score is assigned by a list of references corresponding to the articles evaluated. The scores are derived from rigorous criteria, where the score is multiplied by the total number of articles evaluated under the scoring criteria.

Scoring criteria score * Number of articles.

This systematic assessment provides relative quality and distribution of research contributions in this domain.

RQ2: What is the classification of game-based and non-game-based cyber threats aimed at financial institutions?

The research question aims to classify cyber threats into game-based and non-game-based categories, specifically focusing on those targeting financial institutions. It pursues to understand various types of threats and their respective impacts on financial systems and institutions. This classification helps to identify specific vulnerabilities and develop targeted strategies for mitigating cyber risks in financial institutions.

Advanced persistent threats

In the domain of gamification, where persistent cyber-attacks continue to increase effective defence mechanisms to ensure the continuous operation of networks are becoming increasingly pressing. Luh et al. (2020) introduced PenQuest, an innovative gamified attacker/defender metamodel designed for the workings of cyber-attacks. The framework also brings awareness initiatives, thorough risk evaluation protocols, and the utilization of serious games like PenQuest to replicate authentic attack scenarios. Also, PenQuest integrates industry standards to incorporate APT campaigns, providing a valuable tool for risk assessment actions and giving educational resources in multiple situations. The study also highlights PenQuest’s potential for rigorous connections between security protocols and realistic defence strategies, thus improving the overall cybersecurity platform (Luh et al., 2022).

Social engineering

Similarly, cyber-attack responsibility often requires human involvement through unintentional misconfigurations or a lack of awareness among users (Sharma & Thapa, 2023; Fatokun Faith, Long & Hamid, 2024; Fachkha, 2023; Yasin et al., 2019) explained tactics like eavesdropping and shoulder surfing, shedding light on the challenges individuals face in discriminating against these threats, which impact both game-based and non-game-based cyber vulnerabilities in financial institutions. Additionally, the study advocates for game-based analyses to enhance understanding of these attacks from a gaming perspective, underscoring the urgent need to enhance cybersecurity education within the financial sector’s gaming platform (Luh et al., 2020). The gaming environment activities raise awareness regarding cyber threats to lessen human negligence, offering educational resources and guidance in this domain.

Phishing attacks

Non-game-based threats, illustrated in studies like Hale, Gamble & Gamble (2015), Kävrestad et al. (2022) involve various phishing techniques to deceive individuals into disclosing personal information or installing malware. For instance, Chattopadhyay et al. (2023) highlighted widespread cyber security risks intrinsic to gaming platforms, like data and identity theft, phishing exploits, and malware intrusions, highlighting the financial consequences for affected players. These sorts of attacks exploit human psychology and due to a lack of digital awareness, often lead to data breaches or unauthorized access that looks like it is from a legitimate channel (Yasin et al., 2024).

Malware infections

In addition to phishing attacks, malicious actors posed a significant threat in non-game-based contexts by exploiting vulnerabilities to compromise systems and sensitive data (Yasin et al., 2024). This attack incorporates harmful software elements designed to deceive users and facilitate unauthorized access to confidential information, as demonstrated by relevant research studies explaining non-game-based cybersecurity threats. Further, the incorporation of gamification techniques into non-gaming sectors, like financial institutions engaging in credit card rewards systems, is intended to enhance user engagement. But this integration also brings forth security concerns restricting potential vulnerabilities that cybercriminals may exploit to achieve their motives (Scholefield & Shepherd, 2019). Additionally, gamification software development in e-banking systems highlights the role of users in testing and improving software, with findings indicating design, appearance, functionality, rules, and objectives in the development of the software (Chattopadhyay et al., 2023).

Therefore, the intersection of digitalization and gamification within the financial sector presents various challenges in efficiently impeding the way of cyber threats (Sharma & Thapa, 2023). Game-based threats highlight strategic complexities, while non-game-based attacks exploit vulnerabilities in security infrastructure and human factors. Incorporating gamification in financial institutions aims to improve customer engagement and bring out security vulnerabilities. Table 8 headings offer a comprehensive overview of cyber-attacks within the gamification environment because it covers the source of research, the nature of attacks, parameters outlining both game and non-game contexts, research goals, notable findings, and study limitations.

The studies collectively examine the impact of gamification in the cybersecurity and banking sector, aiming to enhance user engagement, behavior, and awareness level, though each faces specific limitations. Scholefield & Shepherd (2019) found that gamification increased customer satisfaction but did not meaningfully influence customer intent, with limitations due to a small sample size and participants’ lack of knowledge about the gamification environment. Hale, Gamble & Gamble (2015) developed game-based strategies for phishing prevention but faced various challenges with test-based techniques and ethical issues in the wild studies, where participant consent and data exposure were concerns. Yasin et al. (2019) used game-based simulations to raise awareness of social engineering attacks, but the results were hard to generalize due to the absence of long-term assessments. Moreover, Luh et al. (2020) introduced the PenQuest model for cybersecurity training, combining threat intelligence with gamified learning, though its reliance on external data sources risked using outdated attack patterns. Kävrestad et al. (2022) explored game-based phishing detection training, showing improvements in user behavior, but the small sample size limited the study’s broader applicability. Similarly, Chattopadhyay et al. (2023) highlighted cyber-attacks in gaming and banking, though it lacked coverage of mobile gaming threats and emerging cyber risks. Rodrigues et al. (2021) explored users’ design preferences for gamified e-banking software, emphasizing the importance of usability, transparency, and regulatory standards in building trust and loyalty, but noted that the findings were influenced by cultural factors, which may limit generalization across different populations.

RQ3: What are the best practices for detecting and preventing cyber threats within financial institutions’ game-based environments, and how can these practices be articulated skillfully?

The advent of gamification within financial institutions presents novel challenges for ideal cybersecurity protocols. It demands a multilayered approach that merges technological innovations with comprehensive employee training. Gamification platforms can reinforce institutions’ defensive strategies by addressing cybersecurity threats.

Training and awareness of technological solutions

The cybersecurity platform is crucial to adopt holistic strategies that effectively struggle against evolving threats. In gamified simulations, financial institutions can conduct regular security assessments, providing huge experience to evaluate and enhance their defences by utilizing multi-layered defence strategies by combining technological solutions like endpoint and network security measures, penetration testing, and threat intelligence feeds (Luh et al., 2020). Additionally, integrating game-based training modules like Context-Based Micro-Training (CBMT) authorizes users with interactive learning experiences, development of awareness levels, and proactive responses against phishing attacks (Kävrestad et al., 2022). Furthermore, Chowdhury & Gkioulos (2023) discussed the development of personalized learning theory-based models to customize cybersecurity training exercises to individual requirements, maximizing effectiveness and ensuring a strong defence that hinders the way of cyber threats.

Crisis management and incident response

In the environment of an organization, an effective strategy includes taking training and awareness initiatives to train individuals with the required skills to utilize technological solutions appropriately. This involves differentiating potential cybersecurity threats and expertly responding to them in adverse incidents. To reinforce preparedness, it is essential to construct comprehensive incident response plans completed by scenario-based training methodologies (Angafor, Yevseyeva & He, 2020). Additionally, Chattopadhyay et al. (2023) advocated for fostering collaboration between game developers and cybersecurity experts to stay updated on evolving risks that ensure a proactive approach to cybersecurity in gaming platforms. These plans ensure efficient and effective responses to security breaches, minimizing the impact on financial institutions and enabling timely responses to protect sensitive data and information.

Regulatory compliance and vendor management

Crisis management and incident response domains are fundamentally interconnected with regulatory compliance, forming a holistic platform that expertly navigates cyber threats while addressing regulatory requirements. Kävrestad et al. (2022) emphasized using gamified training modules to ensure regulatory compliance and employee compliance with standards in financial institutions. Integrating gamification enhances engagement and retention of compliance rules among employees. This proactive approach reinforces cybersecurity, safeguarding financial data and operations against potential threats. These prevention measures highlight the importance of a multi-layered approach merging technological solutions, employee training, crisis management, and regulatory compliance to mitigate cyber threats in financial institutions successfully.

Regular security assessments

Regular security assessments, including gamified simulations, are crucial for financial institutions to detect and mitigate cyber threats successfully. These assessments provide essential feedback loops, allowing institutions to defend against emerging threats and improve security. By simulating real-world attack scenarios and incorporating gamification elements, like scoring systems, organizations can engage security teams, identify weaknesses, and initiate a culture of continuous improvement in cybersecurity practices (Luh et al., 2020).

Monitoring and incident response plans

The platform of regular security assessments informs the development of monitoring and incident response plans to ensure organizations can detect and respond effectively to combat cybersecurity threats on time. Employing continuous system monitoring along with the utilization of threat intelligence efficiently identifies any suspicious and irregular activities or patterns of cyber threats, as proposed by Luh et al. (2020). In parallel, organizations should develop comprehensive incident response plans, incorporating scenario-based training (Angafor, Yevseyeva & He, 2020). These measures are essential to protecting effective detection and response to cyber incidents, thus enhancing institutions’ overall cybersecurity.

User training and awareness

User training and awareness strengthen monitoring and incident response plans by equipping individuals with the skills to recognize irregularities and report incidents perfectly. Chowdhury & Gkioulos (2023) developed a personalized learning theory-based model for cybersecurity training, utilizing game-based scenarios like Cyber CIEGE, enhancing bank employees’ skills and decision-making abilities against cyber threats. Chattopadhyay et al. (2023) emphasized the importance of cybersecurity in gaming, advocating for prevention strategies, user education, and collaboration between game developers and cybersecurity experts to enhance a safer gaming environment. “The Simulated Critical Infrastructure Protection Scenarios (SCIPS) gamified environment effectively raises awareness among senior executives about cyber-attacks on critical infrastructure, motivation discussions on cybersecurity investment prioritization, enhancing understanding of threats, and encouraging proactive measures (Cook et al., 2016). These initiatives emphasize the significance of proactive training, collaboration, and awareness-building in mitigating cyber threats across various sectors. Prioritize user awareness training through interactive modules and educate employees about potential cyber threats as well as how to identify them (Chowdhury & Gkioulos, 2023; Kävrestad et al., 2022).

Phishing detection

User training and awareness play a critical role in preventing and detecting phishing attacks, as educated users are better equipped to recognize phishing attempts, understand the risks involved, and respond appropriately, thereby reducing the impact of such attacks. Chowdhury & Gkioulos (2023) developed a personalized learning theory-based model based on cybersecurity training that integrates and incorporates game-based situations like Cyber CIEGE, offering an engaging platform for bank employees to develop their cybersecurity skills and emphasizing cybersecurity’s significance in gaming platforms, highlighting serious games like Anti-Phishing Phil for user training. Similarly, Hale, Gamble & Gamble (2015) presented CyberPhishing, a game-based platform on the most trending phishing awareness testing, demonstrating its effectiveness through three testing phases to refine and implement game-based phishing training strategies. These initiatives highlight the importance of gamification in detecting and mitigating phishing attacks within financial institutions, emphasizing the need for innovative approaches to cybersecurity training in simulated environments. These detection measures aim to proactively identify and mitigate game-based cyber threats within financial institutions, ensuring the security of sensitive data and operations. Table 9 explains the research sources, focuses on prevention/detection, and delineates game-based parameters, research objectives, key findings, and limitations, offering a holistic perspective on cybersecurity and gamification studies.

RQ4: How and which AI tools be strategically integrated to enhance cybersecurity measures and mitigate cyber threats within gaming platforms in the financial sector?

Gamification significantly boosts AI tools for cybersecurity by integrating elements of game design into training, behavioral analysis, encouraging security practices, and incident response, thus enhancing their effectiveness (Zeadally et al., 2020). As machine learning is the subfield of AI and the intersection of machine learning and gamification, highlighting their potential cooperative relationship and varied application (Swacha & Gracel, 2023).

Machine learning algorithms

The best AI tools for cybersecurity often depend on machine learning algorithms to improve threat detection, incident response, and overall security features. Machine learning algorithms are critical in strengthening cybersecurity measures from various perceptions, including gaming platforms in the financial sector. Zeadally et al. (2020) discussed integrating AI tools with ML techniques like naïve Bayes, which handles diverse attributes and data classification, while decision trees help in classification and outcome prediction phenomena. Support vector machines (SVMs) enhance security through classification tasks, and k-nearest neighbor (k-NN) facilitates data classification and anomaly detection. Moreover, artificial neural networks (ANNs) enable complex pattern recognition parameters, and self-organizing maps (SOMs) are applied to cluster and visualize cybersecurity data. Deep neural networks (DNNs) detect offensive language and behavior in gaming platforms, and generative adversarial networks (GANs) generate synthetic data to strengthen cybersecurity defenses. These algorithms collectively contribute to the robustness of cybersecurity measures, enabling effective threat detection and response in gamification environments within the financial sector.

Reinforcement learning

In AI, machine learning algorithms and reinforcement learning are closely related to this versatile platform. Tao, Akhtar & Jiayuan (2021) discussed that AI tools greatly assist in applying game theory to cybersecurity by analyzing complex decision-making scenarios and powering the process for defenders in security games. Reinforcement learning algorithms, particularly Q-learning—where agents learn optimal actions by maximizing rewards through trial and error—play a crucial role in enhancing cybersecurity by allowing defenders to learn the best strategies within security games, even with limited or little knowledge about adversaries’ intentions. As highlighted by Tao, these AI tools automate decision-making processes, optimize strategies, and enhance compliance with evolving threats by analyzing vast amounts of data to predict adversaries’ behavior. Further, Zysman, Nitzberg & On (2020) shed light on the context of AI governance and game theory, where the strategic deployment of AI tools, particularly reinforcement learning algorithms, is crucial for understanding decision-making dynamics, enhancing security, and facilitating informed decision-making in governance and regulatory compliance in game theory contexts. This empowers defenders to respond proactively to cyber threats, ultimately enhancing cybersecurity defense effectiveness and safeguarding against anomalies.

Natural language processing

AI also plays a crucial role in natural language processing (NLP), closely associated with ML. ML algorithms, RL, and NLP are interconnected fields that often collaborate to develop advanced AI systems capable of understanding, generating, and interacting with human language. Rawindaran, Jayal & Prakash (2021) contributed to the field of NLP gamification platforms by highlighting the importance of natural language processing algorithms in enhancing fraud detection capabilities within gaming platforms in the financial sector. By analyzing user interactions, NLP algorithms can enable real-time threat response and mitigation strategies, thus safeguarding sensitive data and transactions against emerging cyber threats. This integration of AI-driven solutions, like NLP, reinforces the effectiveness of gamification platforms in detecting and preventing fraud, ultimately ensuring comprehensive protection of financial assets and customer information in the dynamic paradigm of online gaming and financial transactions. Employed to analyze user interactions within gaming platforms and enhance fraud detection capabilities to avoid anomalies.

Adversarial sandbox adaptive serious game approach

The adversarial Sandbox Adaptive Serious Game approach integrates the features of ML, RL, and NLP techniques into an interconnected cybersecurity training and defense framework. Integrates AI-driven non-player character (NPC) interactivity based on player responses to enhance cybersecurity education and skill development for better results. The study by Mittal et al. (2021) contributes to adversarial sandbox environments by proposing integrating AI tools within a game-based learning environment for cybersecurity education in blockchain technology to make networks efficient and secure. By employing an adversarial sandbox adaptive serious game approach coupled with AI-driven NPC interactivity based on player responses, the study proposes to address barriers to adopting blockchain technology. The serious game facilitates cybersecurity skill development and knowledge acquisition by continuously adapting NPC behaviors and gameplay dynamics informed by player responses.

Moreover, integrating AI tools with gamification strategies offers a comprehensive solution for enhancing cybersecurity in the financial sector, enabling organizations to reinforce threat detection and incident response mechanisms. Collaborative efforts are essential to establish standardized cybersecurity protocols, fostering proactive measures against evolving cyber threats. Table 10 provides a comprehensive summary of the integration of AI tools into gamification strategies for mitigating cyber threats. It highlights the effectiveness of various AI tools, presents key findings from relevant studies, and identifies limitations associated with each approach in cybersecurity applications. This structured overview serves to illustrate how these tools contribute to enhancing security measures within gaming platforms in the financial sector while also acknowledging the challenges that need to be addressed for optimal implementation.