A systematic mapping study on gamification within information security awareness programs.

Information security awareness (ISA) has become a vital issue for organizations, as security breaches are usually attributed to human errors. ISP programs are effective ways to educate employees and enhance their information security knowledge. Gamification is a new concept in the area of ISA programs and it has been proven to be one of the most effective and proper ISA methods in both the private and public sectors. Despite a growing interest in employing gamification as an ISP program in recent years, there is a lack of study to provide a comprehensive overview of gamification within ISA programs and identify trends, patterns, and research gaps in this area in order to direct future research. To bridge this gap, a systematic mapping study is adopted as a research methodology. A total of 69 papers were selected and classified by document type, year of publication, research type, research contribution, gamification type, gamification in terms of adaptivity based on the target group, and gamification in terms of the use of artificial intelligence (AI) in order to make it user-tailored. The mapping study revealed that the published papers in this area were split between journals and conference papers with a higher proportion published in conference proceedings. Regarding the publication trend, from 2015 to 2022, gamification within ISA programs has come across to researchers' attention. The identified two main research types were evaluation research and validation research and the vast majority of the contribution type was tools. Moreover, content gamification has been used more commonly in ISA programs than structural gamification. Furthermore, the finding indicated that there were clear gaps in employing adaptive gamification, dynamic adaptive gamification and AI-based adaptive gamification, which makes these areas significant for future research.