Cyber security training in an immersive virtual space

Investing in security technology is not enough to keep cyber attacks out. Employees also need to know how to avoid incidents and how to respond when one happens. In a recent study, 80% of organisations said that security awareness training had reduced their staff's susceptibility to phishing attacks.

We discussed how to make that training more effective in a LinkedIn Live session, "Cyber Security Training In Metaverse: Employee Training Solutions". The panel was:

• Utsav Mathur, Founder and CEO, GMetriXR
• Col. (Dr.) Inderjeet Singh, Chief Cyber Officer, Vara
• Vikas Dua, HR Head, Weber Shandwick

Why cyber security training matters

Cybercrime costs were forecast to see a 15% increase over five years, reaching 10.5 trillion by 2025. A report by IBM found that in 2021 the average time to identify a data breach was 212 days, and the average organisation took 286 days to identify and contain one.

People are the weak point. 95% of cyber security breaches are attributed to human error, such as clicking a malicious link or falling for a phishing scam. Good training helps in three ways:

• Protection against threats: employees learn to defend against malware, phishing, ransomware and data breaches, and to spot vulnerabilities.
• Data protection: they understand how to handle sensitive and confidential data, which reduces the risk of leaks.
• Awareness: they recognise and avoid the common traps that lead to breaches.

Why train in an immersive virtual space

Slide decks and annual e-learning modules are easy to forget. People tend to forget 70% of training content within 24 hours, and after a month they have retained only 10%. An immersive environment changes how the training is experienced.

• Realistic simulations: employees experience and respond to simulated attacks, which builds practical skills and better decisions.
• Gamification: leaderboards, achievements and rewards make learning more enjoyable and motivating.
• Immersive learning: sessions are more engaging, which improves retention.
• Remote access: employees can join from anywhere, so dispersed teams get the same training.
• Collaboration: employees solve problems together and learn from one another.
• Lower cost: less spending on travel, venues and printed material.
• Scale: more participants can be added without logistical limits.
• Tracking and analytics: performance data shows where more training is needed.

What the training looks like

In GMetriXR's cyber security training space, employees are welcomed by AI-based avatars. They can talk to these avatars to learn about the organisation's privacy policies. The space is designed to be easy to navigate, the content is personalised to each organisation, and leaderboards, rewards and weekly challenges keep employees engaged.

What the research says about immersive training

A 2022 PwC survey found that VR-trained employees had four times higher confidence and a 3.75 times higher retention rate, and completed training four times faster than with traditional methods. It also found that VR training helps employees build soft skills such as leadership, teamwork and empathy more efficiently.

How to apply it in your organisation

1. Identify the threats your people meet most often, such as phishing emails or unsafe handling of data.
2. Turn them into realistic scenarios where employees must spot and respond to the threat.
3. Add gamified elements such as weekly challenges and a leaderboard to keep people coming back.
4. Use the analytics to find teams or topics that need more attention, and refresh the scenarios as threats change.

Next step

If you want to explore immersive or gamified training for cyber security or other compliance topics, talk to our team and we will connect you with the right people.

First published on the Metaverse911 blog.