From CTF to Competence: UX-Driven and Didactic Foundations for Gamified Cybersecurity Training Platforms

Abstract

This study presents a Systematic Literature Review (SLR) of gamified platforms for cybersecurity education and training, with a particular focus on environments that incorporate attack–defence simulation. The review examines how the literature addresses gamification, User eXperience (UX), didactics, platform design, and sustainability-related deployment conditions across higher education as the primary reference context, while also considering adjacent applied training contexts when they provide transferable evidence for platform design, deployment, or evaluation, including online learning. We analysed 172 studies published between 1 January 2015 and 8 March 2026. The findings show that the field combines authentic hands-on practice with challenge-based learning, feedback-rich progression, and diverse technical formats, including cyber range environments, serious games, CTF-oriented platforms, cloud-based infrastructures, and modular training systems. The review also indicates that the educational value of these approaches depends on the alignment between pedagogical structure, interaction design, and technical architecture, as well as on safe experimentation, adaptability, governance, and long-term maintainability. The review contributes an evidence-based taxonomy and configurational synthesis of recurrent design patterns across UX, didactics, gamification, architecture, and sustainability, and it identifies implications for future empirical research and for the design of sustainable, learner-centred cybersecurity teaching platforms.

1. Introduction

Contemporary cybersecurity education must both prepare students for technically complex and adversarial environments and employ pedagogical models that are coherent, operationally viable, and sustainable. This challenge is especially pronounced in higher education, where cybersecurity competencies extend beyond declarative knowledge, but it also extends to adjacent applied training contexts in which practical and transferable cybersecurity capabilities must be developed under realistic conditions. The NICE Workforce Framework, for instance, highlights that cybersecurity capability comprises tasks, knowledge, and skills developed in authentic professional contexts, emphasising the need for learning experiences that go beyond passive instruction [1]. The growing use of cyber ranges, capture-the-flag (CTF) environments, serious games, and other gamified simulation platforms reflects a broader shift toward practical and situated learning in cybersecurity.

The effectiveness of these platforms is contingent upon the structuring of action, feedback, progression, collaboration, and reflection within the learning environment. The educational value of gamified cybersecurity teaching platforms is determined by the didactic logic and user experience (UX) principles embedded in their interaction design. This systematic literature review (SLR) examines this critical intersection.

Although the literature on cybersecurity education, cyber ranges, serious games, and gamification has expanded considerably, existing contributions remain dispersed across technical, pedagogical, and sector-specific strands. This makes it difficult for higher education institutions (HEIs) to identify which design principles, instructional structures, architectural choices, and governance conditions support effective and sustainable practice-oriented learning. A focused synthesis of gamified attack–defence teaching platforms is therefore needed to integrate these dimensions into a single evidence-based perspective.

Despite significant growth in the literature on cybersecurity training platforms, the field remains fragmented. As a result, there is no integrated synthesis regarding the design of gamified cybersecurity teaching platforms as learning environments, their operationalization of pedagogy, and how their interaction principles support or constrain practical learning. This review employs the PRISMA guideline for literature reviews to consolidate this fragmented landscape into a coherent body of evidence [2].

Identifying how existing studies approach didactics and UX by design provides a foundation for proposing practical cybersecurity teaching solutions that are flexible in instructional mechanics and adaptable in design and technological implementation. Effective higher education requires coherent alignment among intended learning outcomes, learning activities, and assessment, centred on what learners are expected to accomplish and demonstrate [3]. Experiential learning demonstrates that durable learning arises when concrete experience and active experimentation are configured as a meaningful cycle [4]. Additionally, problem-based learning supports the rationale that engaging with complex problems fosters not only problem-solving but also self-directed learning and student collaboration [5].

Within gamified cybersecurity teaching platforms, UX serves as a design stance influencing elements such as learnability, interaction clarity, or cognitive manageability. Poor implementation of these principles can make even technically advanced platforms difficult to adopt, while effective integration facilitates more accessible, motivating, and effective hands-on cybersecurity learning.

Sustainability constitutes a critical dimension, encompassing the long-term educational viability of platforms, their accessibility, maintainability, curricular integration, reusability across cohorts, and capacity to serve institutions with varying technical and financial resources. UNESCO underscores that education for sustainable development requires pedagogical approaches and course designs that enable institutions to establish more just and resilient educational systems [6,7]. This principle is especially pertinent to cybersecurity teaching platforms, which are engaging but difficult to maintain, challenging to integrate into curricula, inaccessible to certain learners, or lacking in governance and safeguards, and cannot make a sustainable contribution to higher education.

To address these gaps, this SLR focuses on attack–defence simulation platforms, analysing publications indexed in Scopus, Web of Science, IEEE Xplore, and ScienceDirect and published between 1 January 2015 and 8 March 2026. After the study selection process, 172 articles were retained for detailed analysis. Although higher education remains the main interpretive frame of the review, we did not exclude adjacent applied training studies when they offered transferable evidence on platform design, didactic structure, gamification, architecture, governance, or sustainability relevant to university teaching.

The review is structured around five research questions examining the field from complementary perspectives: (i) UX-oriented design and interaction principles, (ii) didactic approaches and learning activity structures, (iii) gamification mechanisms and their educational purposes, (iv) platform formats and architectures and their suitability for university teaching, and (v) ethical and security safeguards, including sustainability in deployment and operation.

The contribution of this work is to offer an evidence-based taxonomy across five analytical dimensions and a configurational synthesis of recurrent design patterns in gamified cybersecurity teaching and training platforms. On this basis, the review identifies implications for future empirical research and for the design, selection, and deployment of sustainable learner-centred platforms in higher education and adjacent applied training contexts.

2. Theoretical Background

2.1. User eXperience

User experience (UX) refers to “the person’s perceptions and responses resulting from the use and/or anticipated use of a product, system or service”. In contemporary human-centred design, UX encompasses affective, cognitive, sensory, and contextual dimensions that shape how people interpret and experience their interactions with technology [8,9,10]. From this perspective, UX is especially relevant in digital learning environments because students do more than merely access content; they engage with goals, feedback, rules, representations, and social cues that shape their motivation, confidence, and comprehension, and thereby affect their persistence. In higher education, this means that the quality of interaction becomes part of the educational process itself instead of a secondary technical attribute. Didactics reinforces this view by highlighting that educational effectiveness depends on how learning situations are structured and experienced by both the teachers and students [11].

Regarding gamified platforms, UX acquires a significant strategic role. Gamification has been defined as the use of game design elements in non-game contexts [12]. Accordingly, in a gamified cybersecurity platform, UX is expressed through the clarity of tasks, the perceived fairness of challenges, the balance between difficulty and competence, the visibility of progress, and the extent to which feedback helps learners remain engaged without becoming overloaded or disoriented.

Platforms may therefore be technically robust and still offer a weak educational experience if their interaction logic is confusing, cognitively fragmented, or emotionally frustrating. For this reason, UX in gamified educational systems should be addressed as a design principle that supports learning and engagement, even in domains such as cybersecurity [9,10,12].

This perspective becomes particularly important in serious games, where games are intentionally designed to achieve outcomes beyond amusement. Their educational value depends on how well game and learning mechanics align to support meaningful learning [13]. In this sense, UX in serious games, especially in cybersecurity, should be understood as the experiential layer through which pedagogical intent becomes actionable in this domain; it mediates how learners perceive elements such as risk, decision-making, and consequences, while remaining oriented within complex simulated environments.

In this review, UX is treated as a platform-centred construct concerned with how learners experience interaction with the system itself, particularly through clarity, feedback, progression, and cognitive manageability. This understanding is consistent with human-centred and interaction-oriented views of UX [8,9,10] and with its application to gamified environments [12,13]. Accordingly, UX is distinguished here from Student eXperience (SX), which refers to the broader educational experience surrounding platform use, and from didactics, which refers to the pedagogical organization of learning activities and assessment.

2.2. Student eXperience

SX may be understood as the set of perceptions and responses that students construct through their interactions with the educational, social, and service environments of HEIs [14]. This perspective is consistent with earlier work, which treats student experience as a multidimensional phenomenon that extends beyond the classroom and includes institutional processes, expectations, and support structures [15,16].

In gamified platforms and serious games, SX complements UX by broadening the analytical focus from interface interaction to the student’s experience as a whole within the educational system. A cybersecurity platform may be usable and engaging, yet still provide a weak student experience if it does not foster educational value or continuity in the learning process. This broader lens aligns with Kuh’s argument that student success depends on educational conditions that enable meaningful involvement in learning [17]. Because of this, SX is useful in our study, as it helps frame gamified cybersecurity platforms as both technical artifacts and student-facing educational services whose value is co-constructed.

In this study, SX is treated as a complementary interpretive lens that helps situate platform use within the wider student-facing educational experience. This is consistent with the multidimensional view of student experience in HEIs [14,15,16,17] and with recent work that incorporates cultural sensitivity into SX analysis [18,19,20]. In this sense, SX differs from UX because it extends beyond interaction with the platform, and it differs from didactics because it does not primarily describe the intentional structuring of learning.

2.3. Didactics

Didactics could be understood as the field that gives educational direction to teaching and learning by organising knowledge and methods into coherent instructional action. In this sense, it is not limited to the transmission of content, but concerns how subject matter is transformed into meaningful learning situations for specific learners and contexts [11]. Within the European educational tradition, teaching is understood as an act of pedagogical judgment. Hopmann argues that its core lies in restrained teaching, where the educator guides learning without reducing the learner to the passive execution of prescribed steps [21]. This view examines how subject matter gains educational significance while preserving the learner’s independence, a perspective especially relevant in fields that require interpretation and judgment and support gradual autonomy [22].

In the context of gamified platforms and serious games, didactics helps us explain why game elements should be addressed seriously. Their pedagogical value depends on how they organize challenge, sequencing, feedback, and, especially, progression in ways that support intended learning outcomes. From this perspective, gamified cybersecurity platforms are didactically meaningful when they guide learners in interpreting security problems and justifying decisions. This is consistent with constructive alignment, which holds that learning outcomes, teaching activities, and assessment should be coherently linked so that the learner’s actions within the environment directly support the educational aims of the courses [3]. In this review, we treat didactics as the pedagogical logic that structures how gamified and serious game platforms turn cybersecurity content into a guided, practice-oriented, meaningful learning experience.

For the purposes of this study, didactics refers to the pedagogical logic that structures intended learning outcomes, learning activities, guidance, and assessment. This understanding is aligned with the view of didactics as coherent instructional action [11] and with the European tradition that frames teaching as pedagogical judgment rather than mere transmission [21,22].

2.4. Gamification and Serious Games

Gamification and serious games are educational strategies that incorporate game-based structures to support goals beyond mere entertainment, such as learning, training, awareness, and skill development. In cybersecurity education, their relevance lies in their ability to turn abstract—and often highly technical—content into interactive experiences. Some literature indicates that these approaches can improve performance and strengthen students’ perception of learning when compared with more passive instructional formats [23,24,25,26].

Evidence suggests that their value does not derive solely from novelty; their educational contribution depends on how well mechanics, such as missions, competition, cooperation, narrative, and iterative feedback, align with intended learning outcomes. This is especially important in cybersecurity, where students must connect conceptual understanding with situated action under constrained conditions. The same body of work also warns that game-based approaches can fail when difficulty is poorly calibrated, since excessive early complexity may discourage novices and reduce persistence [27].

Consequently, in this SLR, gamification and serious games are understood as pedagogical design approaches that can structure participation, sustain engagement, and create meaningful pathways for students’ practical cybersecurity learning.

2.5. Cybersecurity

Cybersecurity could be understood as the discipline concerned with protecting digital systems, networks, services, and information assets from threats that are technically complex and adaptive, and increasingly intertwined with human behaviour. In educational terms, this makes cybersecurity difficult to teach through exposition alone, as meaningful learning requires specialized environments where students can engage with realistic technical situations. Cybersecurity education is progressively moving toward challenge-based and inquiry-based models in which learners act more actively within controlled environments, supported by infrastructures that approximate professional practice [28,29]. This need for realism also extends to the quality of the technical substrate; the literature highlights the importance of some elements such as authentic datasets, reusable experimental environments, and interoperable simulation ecosystems. This requires an infrastructure capable of reproducing the complexity of real incidents without exposing institutions to unacceptable operational risk [30,31,32].

Current discussions suggest that the field is broadening toward cognitive security, where defence is conceived as a domain shaped by human cognition and adaptive intelligence [33]. For that reason, we analyse cybersecurity as a practice-oriented educational domain that requires a realistic, scalable, and pedagogically structured learning ecosystem to support sustainable professional preparation.

3. Research Methodology

This SLR was designed and executed in accordance with Kitchenham’s framework for literature reviews. We structured the process into three main phases: (i) planning the review, (ii) conducting the review, and (iii) reporting the review [34]. To strengthen transparency and methodological rigor, the review process was also aligned with the PRISMA checklist and reporting guidelines (Supplementary Materials) [2,35].

3.1. Research Questions

We structured our review around five complementary analytical dimensions related to gamified cybersecurity teaching and training platforms, interpreted primarily through higher education while also considering adjacent applied training contexts when they provide transferable evidence on design, deployment, pedagogy, governance, or sustainability.

We selected these dimensions to examine the field from pedagogical, experiential, technical, and operational perspectives, with particular attention to the design of practical teaching environments for cybersecurity. Table 1 presents the five research questions that guided our review.

Table 1. SLR Research Questions (RQ).

ID	Research Questions (RQ)
RQ1	What UX-oriented design and interaction principles are embedded in gamified cybersecurity teaching and training platforms for higher education and adjacent applied training contexts?
RQ2	What didactic approaches are implemented in gamified cybersecurity teaching and training platforms, and how are learning activities structured?
RQ3	Which gamification mechanisms are used in gamified cybersecurity teaching platforms, and what educational purpose do they serve?
RQ4	What platform formats and architectures characterize gamified cybersecurity teaching and training platforms, and how do they affect suitability for higher education and adjacent applied training contexts?
RQ5	What ethical and security safeguards are incorporated in gamified cybersecurity teaching and training platforms, and how is sustainability addressed in deployment and operation?

3.2. Literature Search

We conducted the literature search across four databases: ScienceDirect, Scopus, Web of Science, and IEEE Xplore. A common conceptual search logic was applied across all sources and adapted to the syntax, indexing logic, searchable fields, and retrieval options supported by each database. The search strategy combined terms related to cybersecurity or security, education or training, and gamification, serious games, cyber ranges, CTF, or simulation. Searches were executed up to 8 March 2026, and the eligible publication window for inclusion ranged from 1 January 2015 to 8 March 2026. Table 2 summarizes the database-specific search strategy, the searched fields, the temporal filters, and the number of records retrieved from each source.

Table 2. Database-specific search strategy, searched fields, temporal filters, source-type filters, and retrieved records.

ID	Database	Search Strategy	Search Field	Temporal Screen	Records Retrieved
SS1	ScienceDirect	(cybersecurity OR security) AND (education OR training) AND (gamification OR “serious game” OR “cyber range” OR CTF OR simulation)	Title, Abstract, Keywords	1 January 2015 to 8 March 2026	437
SS2	Scopus	TITLE-ABS-KEY((cybersecurity OR security OR “information security”) AND (education OR training OR teaching) AND (gamification OR gamified OR game OR “serious game”) AND (“cyber range” OR CTF OR simulation)) AND PUBYEAR > 2014	Title, Abstract, Keywords	1 January 2015 to 8 March 2026	402
SS3	Web of Science	(cybersecurity OR security) AND (education OR training) AND (gamification OR “serious game” OR “cyber range” OR CTF OR simulation)	Title, Abstract, Keywords	1 January 2015 to 8 March 2026	2512
SS4	IEEE Xplore	((((“Document Title”:cybersecurity OR “Document Title”:security) AND (“Document Title”:education OR “Document Title”:training) AND (“Document Title”:gamification OR “Document Title”:“serious game” OR “Document Title”:“cyber range” OR “Document Title”:CTF OR “Document Title”:simulation)) OR ((“Abstract”:cybersecurity OR “Abstract”:security) AND (“Abstract”:education OR “Abstract”:training) AND (“Abstract”:gamification OR “Abstract”:“serious game” OR “Abstract”:“cyber range” OR “Abstract”:CTF OR “Abstract”:simulation))))	Title, Abstract *	1 January 2015 to 8 March 2026	1482

* Note: In IEEE Xplore, retrieval was additionally restricted to conference papers, journal articles, and books.

Because the selected databases differ in syntax, indexing structure, search interfaces, and available metadata fields, the common conceptual query was operationalised separately in each source while preserving the same retrieval logic. After retrieval, all records were consolidated and deduplicated using DOI matching. When DOI information was unavailable, duplicate detection was supported through a bibliographic fingerprint based on normalized title, publication year, and first author. Table 3 presents the distribution of studies by source coverage after consolidation.

Table 3. SLR results by database.

Source	Number of Studies	% of Studies
Only in Web of Science	1427	39.0%
Only in IEEE Xplore	683	18.7%
Only in Scopus	265	7.2%
Only in ScienceDirect	162	4.4%
In 2+ databases (overlap)	1121	30.6%
Total	3658	100%

3.3. Study Selection

The inclusion and exclusion criteria are presented in Table 4.

Table 4. SLR inclusion and exclusion criteria.

ID	Category	Criteria
IN1	Inclusion	Articles published between 1 January 2015 and 8 March 2026
IN2	Inclusion	Studies addressing at least one of the five analytical dimensions of the review in gamified cybersecurity education or training platforms, including higher education and adjacent applied training contexts with transferable relevance to university teaching.
IN3	Inclusion	Eligible scholarly publication types indexed in the selected databases, including journal articles, conference or proceedings papers, review articles, and book chapters when relevant to the review scope.
EX1	Exclusion	Duplicated Studies
EX2	Exclusion	Non-eligible or non-scholarly publication types.

We identified a total of 4833 records through database searches. After removing duplicate records across sources, 3658 records remained for title screening. At this stage, 3238 records were excluded because they corresponded to non-eligible publication types, fell outside the scope of the review, or did not address any of the research questions. The remaining 420 records proceeded to abstract screening and full-text eligibility assessment. After this stage, 248 records were excluded because they were not sufficiently relevant to RQ1–RQ5 or remained outside the scope of the review. This process resulted in a final corpus of 172 studies included in the qualitative synthesis.

The screening process was carried out by two investigators working cooperatively throughout the title, abstract, and full-text review stages in order to strengthen methodological consistency and reduce subjective bias in study selection. Eligibility decisions were discussed jointly across the screening stages, and any disagreements regarding inclusion, exclusion, or relevance to the review scope were resolved through discussion until consensus was reached. Because the screening process was conducted cooperatively rather than as a fully independent parallel review, no formal inter-rater coefficient was calculated.

Higher education remained the primary interpretive frame of the review. However, studies situated in adjacent applied training contexts were retained when they provided transferable evidence on platform design, pedagogy, gamification, architecture, governance, or sustainability that could inform the design and deployment of gamified cybersecurity teaching platforms in university settings. Transferability was judged when a study, even if situated outside higher education, reported platform-level evidence on one or more of the analytical dimensions of the review—UX, didactics, gamification, architecture, governance, or sustainability—in ways that could inform the design, deployment, evaluation, or institutional use of cybersecurity teaching platforms in university settings.

3.4. Quality Appraisal and Data Extraction

To strengthen the interpretive robustness of the review, we conducted a qualitative appraisal of the included studies before the final synthesis. The appraisal considered the clarity of the study purpose, the transparency of the methodological description, the presence of empirical evaluation or analytical support, the relevance of the study to the review scope, and the extent to which the contribution provided usable evidence for one or more of the research questions. This appraisal was used to support a more cautious and informed interpretation of the evidence across heterogeneous study types, including empirical studies, design proposals, framework papers, and review articles. Studies with stronger empirical grounding and clearer methodological reporting were given greater interpretive weight in the synthesis, whereas conceptual, framework-oriented, and review-level contributions were used more cautiously to support configurational interpretation and to identify emerging directions.

A structured data extraction and coding procedure was then applied to all included studies in order to support cross-study comparison. For each article, we extracted bibliographic information, publication type, educational or professional context, learner population when identifiable, platform type, gamification mechanisms, UX-related design principles, didactic approach, architectural or infrastructural characteristics, ethical or governance-related safeguards, sustainability-related considerations, and the study’s relevance to the analytical dimensions of the review. This structured extraction process supported the development of the synthesis tables and the cross-sectional interpretation presented in Section 4, Section 5 and Section 6 (see Figure 1).

Figure 1. PRISMA-aligned flow chart of records retrieved, deduplicated, screened, assessed for eligibility, and included in the qualitative synthesis across databases.

3.5. Coding and Assignment to Research Questions

Studies were assigned to one or more research questions through non-mutually exclusive coding based on explicit evidence contained in the full text of each article. A study was mapped to RQ1 when it addressed UX-related design or interaction principles, to RQ2 when it described the pedagogical structuring of learning activities or didactic logic, to RQ3 when it reported gamification mechanisms and their intended educational function, to RQ4 when it described platform formats, delivery models, or architectural characteristics, and to RQ5 when it addressed ethical safeguards, security controls, privacy, governance, or sustainability in deployment and operation. Because many studies contributed to more than one analytical dimension, multi-assignment was permitted whenever the article provided substantive evidence relevant to several research questions.

Because the included studies vary substantially in research design, platform type, learner population, and reported outcomes, the synthesis presented in Section 5 is qualitative and configurational rather than effect-size-based. Accordingly, the review identifies recurring patterns, areas of comparatively stronger support, and tensions across studies, instead of attempting a meta-analytic aggregation of results.

4. Data Synthesis

In this section, we present two descriptive layers of the review. First, we characterize the broader deduplicated search corpus in order to provide a general overview of publication trends, database coverage, and keyword concentration across the retrieved literature. Second, we distinguish this descriptive layer from the final qualitative synthesis, which is based exclusively on the 172 studies included after screening and eligibility assessment.

4.1. Year of Publication

Figure 2 shows the annual distribution of the deduplicated records retained after duplicate removal between 2015 and 2026. Overall, the results suggest a progressive increase in scholarly attention to gamified cybersecurity teaching platforms, particularly in the most recent years of the period analysed. This upward trend could indicate a growing interest in practical, simulation-based, and pedagogically structured approaches for cybersecurity education. It should also be noted that the information corresponding to 2026 must be interpreted with caution, since the review was conducted before the end of that year (March), and the final number of publications for that period is likely to be much higher.

Figure 2. Annual distribution of the deduplicated records retained after duplicate removal, 2015–2026 (n = 3658).

4.2. Selected Studies by Database

A multi-database search yielded 4833 records before deduplication. After this consolidation process, the dataset was reduced to 3658 unique studies (Figure 3). This means that 1175 records corresponded to duplicates consolidated into unique items, while 2553 records had at least one match in another database.

Figure 3. Distribution of deduplicated records by database coverage, showing unique-source records and cross-database overlap after duplicate removal (n = 3658; percentages rounded to one decimal place).

We observed that 69.4% of unique studies are indexed in only one database, and 30.6% are indexed in two or more databases. A more detailed breakdown of the single-database share shows that unique coverage is dominated by WoS, followed by IEEE Xplore, with smaller unique contributions from Scopus and ScienceDirect.

4.3. Document Type

Figure 4 presents the distribution of document types in the analysed corpus. Most of the selected studies are journal articles, accounting for 51.7% of the final dataset. Conference and proceedings papers also represent a substantial proportion, reaching 43.8%, which reflects the active dissemination of research on gamified cybersecurity teaching platforms through venues commonly associated with emerging and rapidly evolving topics. In contrast, review articles and other document types account for only a minor share, at 1.8% and 1.6%, respectively.

Figure 4. Distribution of document types among the studies included in the qualitative synthesis.

4.4. Study Topics

Table 5 presents the 20 most frequent author keywords in the deduplicated search corpus. The predominance of terms such as cybersecurity, gamification, cyber range, simulation, education, and serious games shows the corpus centers on the intersection of cybersecurity, practical learning, and game-based educational approaches. Terms like machine learning, federated learning, and blockchain reflect the broader technological context of many studies.

Table 5. Top 20 author keywords in the deduplicated search corpus (n = 3658).

Rank	Keyword	Occurrences	Percentage
1	Cybersecurity	383	2.09%
2	Federated learning	294	1.61%
3	Security	224	1.22%
4	Machine learning	181	0.99%
5	Gamification	171	0.93%
6	Deep learning	169	0.92%
7	Blockchain	152	0.83%
8	Internet of Things	136	0.74%
9	Cyber range	127	0.69%
10	Simulation	125	0.68%
11	Education	121	0.66%
12	Serious games	113	0.62%
13	Training	104	0.57%
14	Artificial intelligence	95	0.52%
15	Cybersecurity education	81	0.44%
16	Intrusion detection	75	0.41%
17	Reinforcement learning	73	0.40%
18	Anomaly detection	71	0.39%
19	Model	66	0.36%
20	Deep reinforcement learning	64	0.35%

Figure 5 visually summarizes the 50 most frequent author keywords in the deduplicated corpus. Some of the largest bubbles correspond to cybersecurity, security, gamification, cyber range, and serious games, confirming the thematic concentration of the reviewed literature. The figure also highlights the coexistence of educational and technical topics within the field.

Figure 5. Packed-bubble visualisation of the 50 most frequent author keywords in the deduplicated records retained after duplicate removal (n = 3658).

Table 6 presents the 20 most frequent author keywords aligned with the review’s research questions. The results indicate a strong concentration around RQ2, RQ3, and RQ4, particularly through terms such as education, training/learning, serious games, cyber range, and simulation.

Table 6. Top 20 RQ-aligned author keywords in the deduplicated search corpus (n = 3658).

Rank	Keyword	Occurrences	Percentage	Relevant RQ
1	Gamification	171	0.93%	RQ3
2	Cyber range	127	0.69%	RQ3, RQ4
3	Simulation	125	0.68%	RQ2, RQ4
4	Education	121	0.66%	RQ2
5	Serious games	113	0.62%	RQ2, RQ3
6	Training	104	0.57%	RQ2
7	Cybersecurity education	81	0.44%	RQ2
8	CTF	55	0.30%	RQ3, RQ4
9	Virtual reality	52	0.28%	RQ1, RQ4
10	Privacy	48	0.26%	RQ5
11	Design	43	0.24%	RQ1, RQ4
12	Framework	40	0.22%	RQ2, RQ4
13	Cybersecurity training	36	0.20%	RQ2
14	Augmented reality	27	0.15%	RQ1, RQ4
15	Data privacy	27	0.15%	RQ5
16	Privacy-preserving	26	0.14%	RQ5
17	Game-based learning	25	0.14%	RQ2, RQ3
18	Differential privacy	21	0.11%	RQ5
19	Experiential learning	19	0.10%	RQ2
20	Security training	19	0.10%	RQ2

5. Answering the Research Questions

Although higher education remains the main interpretive reference of this review, the following synthesis also incorporates adjacent applied training studies when they provide transferable evidence relevant to the design, evaluation, or sustainability of gamified cybersecurity teaching platforms.

5.1. RQ1: About UX Design Principles

To answer RQ1, we grouped the reviewed studies into six UX-oriented approaches (Table 7): immersive and authentic experiential interaction; guided learnability and formative feedback; motivational challenge and progression; gameful reinforcement; collaborative and social interaction; adaptive, personalized, and context-aware interaction; and learning analytics and progress visibility. In this work, we treated UX as a design and interaction concern. This perspective is supported by ISO 9241-110 [8], Nielsen’s usability framework [36], and self-determination theory [37]. Some UX-oriented principles are explicitly articulated in the primary studies, whereas others are identified here by interpreting reported interaction structures, feedback logic, learner support mechanisms, and evaluation criteria.

Table 7. Dominant UX-oriented approach per paper.

Approach	Dominant UX-Oriented Design Principles	Studies
Immersive and authentic experiential interaction	Realism, situated practice, embodied interaction, safe hands-on experimentation, theory-to-practice transfer	[38,39,40,41,42,43,44,45,46,47,48,49,50]
Guided learnability and formative feedback	Learnability, self-descriptiveness, scaffolding, immediate feedback, clarity of interaction, error recovery, low-friction use	[51,52,53,54,55,56,57,58,59,60,61,62,63,64,65]
Motivational challenge, progression, and gameful reinforcement	Challenge-skill balance, progression, reward, competition, badges, narrative motivation, sustained engagement	[26,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84]
Collaborative and social interaction	Relatedness, teamwork, peer coordination, communication, social engagement, and role interaction	[85,86,87,88,89,90,91,92,93,94,95,96]
Adaptive, personalized, and context-aware interaction	Individualization, adaptive difficulty, user profiling, personalized pathways, contextual tailoring, dynamic response to user actions	[97,98,99,100,101,102,103,104,105,106,107,108]
Learning analytics and progress visibility	Visibility of system status, dashboards, activity traces, progress monitoring, scoring transparency, and after-action reflection	[109,110,111,112,113,114,115]

The approach of immersive and authentic experiential interaction is reflected in studies that situate learning in realistic, practice-oriented environments. Muulmann et al. [38] and Hasan et al. [39] show how immersive or game-based settings can make cybersecurity tasks more concrete and experientially grounded. It is also shown that safe hands-on experimentation and applied practice are central to this UX logic [40,41,42,43], with security treated not only as a learning objective, but also as a defining attribute of the interaction environment. Pirta-Dreimane et al. [44] and Saito et al. [45] reinforce this pattern by structuring interaction around simulated incidents and control-system scenarios, so that learners engage with cybersecurity as situated practice. The same orientation is further supported by studies that connect simulation and serious game environments with theory-to-practice transfer [46,47,48,49,50].

The approach of guided learnability and formative feedback is reflected in studies that foreground learnability, scaffolding, immediate feedback, interaction clarity, error recovery, and/or reduced-friction use. Almasre [51], Keller et al. [52], and Katsantonis and Mavridis [53] make this pattern visible through clearly structured interactions that help learners understand what to do and how to progress. Kim et al. [54] and Cruz et al. [55] add a stronger guidance component by emphasising progressive exploration and support in complex cybersecurity tasks. Micallef and Arachchilage [56] and Goeke et al. [57] further reinforce this approach by showing the value of timely feedback and corrective support in security education. The same UX concern is also present in studies that organize training through structured progression and accessible learning conditions [58,59,60,61,62,63,64,65].

The approach of motivational challenge and progression, and gameful reinforcement, is reflected in studies that address UX through challenge–skill balance, progression, rewards, competition, badges, narrative motivation, or sustained engagement. It is shown that competitive and game-structured environments can sustain user participation by combining challenge with reinforcement [26,66,67,68,69,70]. A related pattern appears in serious game and narrative-driven designs where engagement is maintained through evolving tasks and motivational continuity [71,72,73,74,75,76]. It is also observed that gameful mechanisms such as rewards and progression can support persistence and continued participation in cybersecurity learning and awareness contexts [77,78,79,80,81,82,83]. Chaskos et al. [84] give additional support to this approach by identifying recurrent gamification mechanisms across cybersecurity training platforms.

The approach of collaborative and social interaction is reflected in studies that frame UX through teamwork, peer coordination, communication, social engagement, and role-based participation. Putter and Henrico [85], Mzanywa et al. [86], and Stals et al. [87] show that the learner experience is shaped not only by the task itself but also by socially mediated participation. Pozza et al. [88], Holton et al. [89], and Francis et al. [90] similarly point to the importance of interaction among participants as part of the learning experience. It is also shown that team-based and multi-participant settings reinforce this UX pattern [91,92,93,94,95,96].

The approach of adaptive personalized and context-aware interaction is reflected in studies that address UX through individualization, adaptive difficulty, user profiling, personalized pathways, contextual tailoring, and dynamic responses to learner actions. It is shown that forms of adaptation and personalization are used to better align platform behaviour with learner needs and progression [97,98,99,100,101]. A similar orientation appears in studies that emphasize tailored interaction conditions rather than uniform learning experiences for all users [102,103,104,105,106]. Bekesiene and Vasiliauskas [107] and Castillo et al. [108] reinforce this logic by highlighting context-sensitive, dynamically adjusted learning environments.

The approach of learning analytics and progress visibility is reflected in studies that address UX through dashboards, activity traces, progress monitoring, scoring transparency, and analytics-supported reflection. Gwenhure and Nam [109] and Hsu [110] demonstrate that learners’ experience can be strengthened when participation, performance, or engagement becomes more visible over time. Nespoli et al. [111] and Gañán et al. [112] similarly highlight the importance of analytics-supported environments in which learners and instructors can access structured information about actions and outcomes. It is also shown that tracking, scoring, and feedback-related mechanisms contribute to making performance more transparent and interpretable during or after cybersecurity exercises [113,114,115].

The gathered studies suggest that UX in gamified cybersecurity teaching platforms is a core condition of educational effectiveness. We observed that the strongest contributions converge around six recurrent patterns: (i) authentic and practice-oriented interaction, (ii) guided learnability, (iii) motivational progression, (iv) socially mediated participation, (v) adaptive support, and (vi) progress visibility through analytics.

Across these patterns, the most consistently supported contributions are those that combine authentic hands-on practice with guided learnability and formative feedback, since these features recur across cyber ranges, serious games, and simulation-based platforms. By contrast, adaptive and analytics-supported interaction appears as a promising but more context-dependent layer, typically tied to specific platforms or more specialized implementations.

The most recurrent and directly evaluated support is concentrated around authentic practice, guided learnability, and formative feedback (particularly in cyber ranges, serious games, and simulation-based platforms) that report usability, engagement, or task-performance-related outcomes. By contrast, adaptation and analytics appear as promising but more specialized layers, and are more often presented as platform capabilities or design extensions than as consistently evaluated determinants of learning transfer or long-term retention.

These patterns could indicate that learners benefit most when technically realistic environments are structured to reduce ambiguity and sustain engagement over time. In this sense, the literature suggests that effective UX design in cybersecurity education depends on integrating realism and progression (considering student feedback) into a coherent interaction model capable of supporting technical practice and meaningful learning.

5.2. RQ2: About Didactic Approaches

To answer RQ2, we grouped the reviewed studies into seven didactic approaches (Table 8): experiential and situated simulation-based learning; problem-based and challenge-based learning; competency-based and constructively aligned design; formative assessment and feedback-driven learning; scaffolded and adaptive guided learning; collaborative and social constructivist learning; and blended and self-directed online learning. This classification treats didactics as a structuring principle for learning activities rather than as a secondary layer added to gamification. Its rationale is supported by constructive alignment, which helps interpret the coherence between learning outcomes, activities, and assessment [3], experiential learning, which grounds simulation-based and practice-oriented designs [4], problem-based learning, which supports challenge-centred instructional structures [5], cooperative learning, which explains socially mediated and team-based activity organization [116], scaffolding theory, which informs guided and adaptive support [117], formative assessment, which underpins feedback-driven learning processes [118], and self-regulated learning, which provides a basis for blended and self-directed approaches [119].

Table 8. Didactic design patterns across gamified cybersecurity teaching platforms.

Approach	Studies	Pedagogical Basis	Typical Learning Activity Structure
Experiential and situated simulation-based learning	[38,40,41,42,46,47,50,60,64,80,86,92,98,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152]	Experiential learning; situated learning; authentic practice	Briefing Scenario execution Observation/Decision-making Debrief
Problem-based and challenge-based learning	[25,39,43,44,48,52,53,56,67,68,71,72,73,74,75,76,90,93,96,109,113,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168]	Problem-based learning; challenge-based learning; escape-room pedagogy	Problem/challenge brief Task solving Submission/Verification Reflection
Competency-based and constructively aligned design	[51,91,101,111,169,170,171,172,173,174,175,176,177]	Constructive alignment; competency-based education; outcomes-based design	Learning outcomes Aligned activities Aligned assessment Competence validation
Formative assessment and feedback-driven learning	[66,110,112,113,114,178,179,180,181]	Formative assessment; mastery-oriented feedback	Diagnosis Practice Automated/Instructor feedback Revision Reattempt
Scaffolded and adaptive guided learning	[54,55,63,88,97,99,100,104,115,182,183,184,185]	Scaffolding; cognitive apprenticeship; adaptive instruction	Guided entry Hints/Coaching Progressive difficulty Fading support
Collaborative and social constructivist learning	[26,69,70,87,186,187,188,189]	Social constructivism; cooperative learning; team-based learning	Shared task Role allocation Collaboration/Negotiation Joint solution Group reflection
Blended and self-directed online learning	[49,59,61,94,107,190,191,192]	Blended learning; self-regulated learning; online learning design	Asynchronous preparation Online practice Platform-supported interaction Independent consolidation

The approach of experiential and situated simulation-based learning is reflected in studies that organize cybersecurity teaching around authentic practice, realistic environments, and context-sensitive action. Martucci et al. [40] and Selikow et al. [41] make this logic especially visible by treating cyber ranges and sandboxed infrastructures as spaces for safe but realistic hands-on engagement. The same didactic orientation extends across simulated platforms, virtualized environments, and applied cyber range settings that move learners from abstract explanation to action-based practice [38,40,41,46,50,98,120,121,122,123,124,125,126,127,128], and into domain-specific contexts such as smart grids, cyber-physical systems, Internet of Things environments, healthcare, industrial control systems, maritime systems, and critical infrastructure settings [42,80,129,130,131,132,133,134,135,136,137,138,139,140]. Reviews, comparative studies, and conceptual contributions further reinforce these environments as vehicles for authentic practice, practical capacity building, and experience-based cybersecurity learning [47,60,64,86,92,141,142,143,144,145,146,147,148,149,150,151,152].

The problem-based and challenge-based learning approach is reflected in studies that structure learning through challenge briefs, problem-solving, solution verification, and subsequent reflection. This pattern is especially clear in CTF platforms, cyber competitions, and challenge-based practical tasks, where learners are expected to solve progressively framed problems and demonstrate performance through concrete outputs [25,43,67,68,93,113,153,154,155,156,157,158,159]. We observed that a similar didactic orientation appears in escape rooms, narrative scenarios, detective-style games, and simulation-based activities that organize learning around the resolution of situated challenges, in contrast to mere content delivery [39,44,52,71,75,160,161,162,163,164]. It is further shown that social engineering, phishing, awareness, and hacking-simulation studies use concrete and interpretable problems as the central driver of the learning sequence [53,56,72,73,74]. This same approach is reinforced by framework and design-oriented studies that explicitly treat gamified and serious game environments as means of structuring challenge-centred cybersecurity learning [48,76,90,96,109,165,166,167,168].

The approach of competency-based, constructively aligned design is reflected in studies that link learning outcomes with aligned activities, assessments, and competence validation. Almasre [51] explicitly connects training design with constructive alignment principles, while Karagiannis et al. [91] reduce ambiguity in learning outcomes through NICE-based scenario design. Sanchez et al. [169] and Katsantonis et al. [170] further reinforce this orientation by framing cybersecurity learning through certification pathways, structured design frameworks, and explicit evaluation logics. At the same time, related work extends this concern to occupational profiles and outcomes-based design [51,91,169,170,171]. It is also shown that several studies map competency domains, certification objectives, and workforce readiness targets to educational activities and assessment structures [101,172,173,174,175,176,177]. In this field, the didactic issue is not only whether learners participate, but whether the platform can support interpretable evidence of skill development and alignment with recognized training goals. Nespoli et al. [111] reinforce this approach by foregrounding cybersecurity competencies in the comparative analysis of training platforms.

The approach of formative assessment and feedback-driven learning is reflected in studies that organize learning through iterative cycles of diagnosis, practice, feedback, revision, and reattempt. Hsu [110] makes this pattern particularly visible by combining pre- and post-testing, behavioural learning management system data, and learner perceptions to examine how engagement and learning evolve in a gamified blended course. Svabensky et al. [113] and Gañán et al. [112] similarly treat feedback as part of the instructional process itself, while Workman et al. [178] make the sequence explicit through a Present–Test–Practice–Assess structure. More broadly, assessment-centred studies show that learner performance is most visible during activity rather than only at the end [66,110,112,113,178]. A related concern arises in work on scoring quality, hands-on assessment, and fairness in practical exercises, where balanced scoring, transparent evaluation, and effective detection of problematic behaviours are incorporated into the didactic design [114,179,180]. Carle et al. [66] and Jensen et al. [181] further support this approach by showing how repeated performance checks and outcome-sensitive feedback can sustain improvement over time.

The approach of scaffolded and adaptive guided learning is reflected in studies that structure learning through guided entry, hints, coaching, progressive difficulty, and gradual reduction in support. Several studies show that the learning process is framed as an adaptive trajectory that differs across learners [97,99,100,104,182,183,184]. O’Connor et al. [185] make this logic especially explicit by proposing a serious game with a guidance mechanic and an intelligence scaffolding practice. Kim et al. [54] and Loftus and Narman [115] reinforce the same approach through detailed feedback, staged progression, and corrective support during practice. A closely related orientation is also visible in studies that emphasize guided exploration, user-centred support, and staged awareness-building for diverse learners [55,63,88].

The approach of collaborative and social constructivist learning is reflected in studies that organize learning around shared tasks, role allocation, coordinated participation, joint solution building, and collective reflection. We observed that team-centric, collaboratively structured learning is a central feature across several contributions [26,69,87,186,187,188]. Katsantonis et al. [188] are especially relevant here because they describe a team-centric framework articulated through collaborative phases of planning, acting, and reflecting on achievements. Shirmohammadi and Ladani [186] reinforce this didactic logic by proposing collaborative cyber range scenarios in which different trainees follow distinct tasks and routes, so that progress depends on coordination rather than just an isolated completion. Pirta-Dreimane et al. [187] and Graham et al. [26] also support this view by foregrounding communication, teamwork, and collective problem solving in practical cybersecurity activities. This wide social orientation is further extended by studies that connect gamification with social sustainability, collaborative participation, or coordinated action among distributed actors [70,189].

The approach of blended and self-directed online learning is evidenced in studies that organize learning through asynchronous preparation, online practice, digital interaction, and independent consolidation. Ahmed et al. [59] make this pattern especially clear by showing that online cybersecurity courses frequently combine learner-centred approaches, active learning, practical applications, collaborative tasks, simulations, and project-based assessment. Beuran et al. [190] reinforce this didactic logic by presenting CyLMS as an integration layer between cybersecurity training and learning management systems via standard interfaces, SCORM-based content packaging, and automated activity management. Su [191] extends this orientation through a web-based hands-on environment that supports self-paced practice with customized exercises, progressive hints, automatic grading, and portfolio analysis. More broadly, it is shown that online and digitally mediated cybersecurity learning environments support learner autonomy, continuity, and platform-based practical activity beyond the physical classroom [49,59,61,94,107,190]. Karagiannis and Magkos [49], Bekesiene and Vasiliauskas [107], and Grigoras [61] further reinforce this approach by linking virtual learning environments, distance learning systems, and online learning tendencies with gamification, analytics, and practice-oriented cybersecurity instruction. We observed that a more indirect but still relevant contribution is provided by Conceicao and Sayin [192], whose work on large language models points toward new forms of digitally mediated support that can be incorporated into self-directed online learning environments.

The didactic approaches identified across the studies show that gamified cybersecurity teaching platforms become pedagogically meaningful when they are organised as a structured practice.

We observed that the literature is dominated by experiential and situated simulation, challenge-based problem solving, competence-aligned task design, collaborative learning, and blended or self-directed online activity. The strongest and most recurrent didactic support is concentrated in experiential or simulation-based and challenge-based approaches, which appear across cyber ranges, CTF environments, escape rooms, and domain-specific training settings and are often linked to practical performance or engagement outcomes. By contrast, blended or self-directed online learning and scaffolded adaptive guidance are clearly relevant, but they are reported in more targeted or delivery-specific contexts and are less often linked to directly comparable learning outcomes.

These patterns could suggest that cybersecurity learning is strengthened when activities and assessment are aligned with explicit educational purposes and sequenced in ways that connect students’ actions with competence development. From this perspective, the literature indicates that didactic coherence is one of the main conditions under which gamified environments move from being technically engaging to becoming educationally effective.

5.3. RQ3: About Gamification Mechanisms

To answer RQ3, we grouped the reviewed studies into seven gamification approaches (Table 9): competitive challenge and CTF-based gamification; reward progression and incentive mechanics; narrative role-play and thematic immersion; collaborative and team-based social gamification; adaptive, personalized, and AI-assisted gamification; feedback assessment, analytics, and coaching; and multi-mechanic or framework-oriented gamification. This classification treats gamification as a structured design layer that shapes how learners engage with tasks, goals, feedback, participation, and progression. Its rationale is supported by Deterding et al., who define gamification through the use of game design elements in non-game contexts [12], by the MDA perspective proposed by Hunicke et al. [193], which helps distinguish mechanics from their experiential and educational effects, by Werbach and Hunter, who frame game thinking as an organised system of goals, rules, rewards, and participation [194], by Arnab et al., who connect game mechanics with learning mechanics in serious games [13], by Kapp, who interprets gamification as an instructional strategy for motivating and sustaining learning [195], and by self-determination theory, which helps explain why challenge, competence, autonomy, and relatedness are central to learner engagement in gamified environments [37].

Table 9. Dominant gamification mechanisms detected.

Approach	Studies	Representative Mechanism Bundle	Dominant Educational Purpose
Competitive challenge and CTF-based gamification	[25,38,43,49,58,65,67,68,91,93,113,142,153,154,155,157,158,159,172,177,179,196,197,198]	Flags, timed challenges, team competition, rankings, scoreboards, tournament structure, attack–defence rounds	Deliberate practice, technical problem solving, pressure-based engagement, skill transfer to realistic attack–defence contexts
Reward, progression, and incentive mechanics	[56,62,66,74,77,78,79,80,81,83,104,105,173,181,199,200,201,202,203]	Points, badges, levels, medals, rewards, progress markers, repeated-practice incentives, loss framing	Sustain participation, reinforce desired behaviours, improve awareness and compliance, encourage repeated engagement
Narrative, role-play, and thematic immersion	[26,39,44,48,52,57,71,72,75,76,95,96,132,160,161,162,164,165,167,168,187,204,205,206,207]	Story-driven scenarios, escape rooms, detective themes, attacker/defender roles, missions, fictional worlds, scenario progression	Increase meaning, contextualization, immersion, ethical reflection, and transfer from abstract concepts to situated decisions
Collaborative and team-based social gamification	[69,70,87,90,94,135,186,188,189]	Multiplayer play, shared goals, role allocation, collaborative rounds, team reflection, communication-rich play	Foster teamwork, communication, peer learning, shared problem solving, and social construction of knowledge
Adaptive, personalized, and AI-assisted gamification	[51,63,82,99,100,101,102,103,106,115,134,138,182,183,184,208]	Adaptive difficulty, personalization, AI/chatbot support, user profiling, recommender logic, context-aware adjustment	Keep learners in an optimal challenge zone, personalize support, reduce disengagement, and accommodate learner variability
Feedback, assessment, analytics, and coaching	[53,54,84,88,110,111,112,113,114,137,171,178,180,185,190]	Immediate feedback, hints, formative assessment, dashboards, learning analytics, fine-grained scoring, coaching, anti-cheat monitoring	Make progress visible, support self-regulation, enable targeted remediation, and improve mastery through informed iteration
Multi-mechanic/framework-oriented gamification	[40,41,42,47,50,55,59,61,64,73,85,86,89,109,123,124,125,129,131,136,140,145,147,156,163,166,169,171,174,175,176,191,192,209,210]	Explicit combination, comparison, or synthesis of several gamification elements rather than one dominant mechanic	Provide design guidance, mechanism integration logic, platform-level implementation patterns, and comparative synthesis

The approach of competitive challenge and CTF-based gamification is reflected in studies that organize learning around flags, timed challenges, rankings, scoreboards, tournament-like progression, and, in some cases, attack–defence rounds. We observed this pattern especially in studies that use CTF environments as the core instructional format, where progress depends on solving technical tasks and verifying performance through flag submission and comparative scoring [38,43,49,67,68,154,155,157,158,179,196]. A related gamification logic also appears in studies that frame cyber competitions more broadly as mechanisms for identifying aptitude, comparing performance, and supporting workforce-oriented preparation [25,93,113,153,159,172,177]. The same approach is reinforced in studies that connect competitive challenge structures with formal university teaching, secure coding exercises, exploit-oriented tasks, and domain-specific technical education, showing that competition is used not only to increase engagement but also to structure deliberate practice and skill transfer in realistic contexts [58,65,91,142,197,198].

The approach of reward progression and incentive mechanics is reflected in studies that organize gamification around points, badges, levels, medals, rewards, progress markers, repeated-practice incentives, and loss framing, among others. This mechanism bundle is clearly addressed in awareness and training studies that use reward-based or progression-based structures to make learning more tangible and to sustain participation over time [62,77,79,81,104,199,200]. Carle et al. [66] make this pattern especially visible by comparing loss aversion and fixed rewards across two point-based cybersecurity training applications, showing that reward logic can shape both knowledge outcomes and engagement. Jensen et al. [181] similarly examine incentives in a phishing-reporting setting and show how validation attribution and public presentation can influence desired security behaviour. Micallef and Arachchilage [56] and Abu-Amara et al. [62] reinforce this approach by linking intrinsic rewards, staged progression, and repeated practice to stronger learner persistence. A much broader reinforcement-oriented use of gamification also appears in studies that focus on compliance, security behaviour, and awareness building, where points, rewards, and progression are used to support continued participation and behavioural improvement [74,78,80,83,105,173,201,202,203]. Silic and Lowry [202] are especially relevant because they connect gamification with appropriate challenge and intrinsic motivation, while Bitrián et al. [203] show how gamified e-training can improve self-efficacy and information security behaviour.

The approach of narrative role-play and thematic immersion is reflected in studies that organize gamification around story-driven scenarios, escape rooms, detective themes, attacker or defender roles, missions, fictional worlds, and scenario progression. We observed that this mechanism bundle is especially visible in works whose titles and structures explicitly foreground thematic framing, including narrative-driven teaching, detective-style serious games, cyber escape rooms, digital educational escape rooms, and serious games against social engineering attacks [39,44,52,57,71,75]. In these studies, immersion functions as a central mechanism for contextualising technical decisions and making abstract cybersecurity content more meaningful.

We found related patterns in studies that connect thematic framing with social engineering training, incident simulation, hybrid work awareness, and serious games for attack and defence modeling [48,72,76,95,167,168,187]. A similar approach is extended to domains such as governance and policy, MITRE ATT&CK-based training, social media cybersecurity skills, extensible educational game design, computer games in higher education, cyber-physical systems teaching, and awareness-oriented serious game environments [26,96,132,160,161,162,164,165,204,205,206,207].

The collaborative, team-based approach to social gamification is reflected in studies that organize learning around multiplayer play, shared goals, role allocation, collaborative rounds, team reflection, and communication-rich interaction. This pattern is addressed in studies that frame cybersecurity training as a coordinated activity among multiple participants [26,69,87,186,188]. Katsantonis et al. [188] are especially relevant here because they propose a team-centric online learning and training framework in which shared phases and collective progression are central to the gamified experience. Shirmohammadi and Ladani [186] reinforce the same logic through collaborative cyber range scenarios in which multiple trainees follow distinct tasks and routes, so that progress depends on coordinated participation. A mechanism bundle similar to this is also evident in Diakoumakos et al. [69], where gamification is implemented across a federation of cyber ranges, and in Graham et al. [26], where team-based interaction is integral to the serious game format. A broader social orientation is also present in studies that connect gamification with collaborative participation, distributed actors, social sustainability, and socially situated cybersecurity learning [70,90,94,135,189].

The approach of adaptive personalized and AI-assisted gamification is reflected in studies that organize gamified learning around adaptive difficulty, personalization, AI or chatbot support, user profiling, recommender logic, and context-aware adjustment. Explicit use of adaptive or personalized mechanisms is addressed in studies on adaptive cyber range modules, recommender systems and chatbots, multimodal adaptive gamified systems, learning-style-sensitive gamification, tailored training paths, and context-aware awareness models [99,100,102,103,104,182,183]. Leung et al. [99] are especially relevant because they explicitly combine gamification with a recommender system and chatbot, while Gizelis et al. [102] frame adaptation through AI-based cyber range modules. A related mechanism bundle also appears in studies that use generative AI, digital twins, machine learning, computational intelligence, explainable security, and user behaviour modeling to better align training conditions with learner progression or platform responsiveness [51,63,115,134,138,184]. This logic is further extended by work on certification-oriented platforms, chatbot-mediated behavioural support, and design-level reflections on cybersecurity games that incorporate adaptation and personalization into the learning experience [82,101,106,208].

The approach of feedback, assessment, analytics, and coaching is reflected in studies that use immediate feedback, hints, formative assessment, dashboards, learning analytics, coaching, fine-grained scoring, and anti-cheat monitoring to make learner progress more visible and instruction more responsive. This pattern is especially evident in studies that rely on platform data, dashboards, or analytics to support learner monitoring and reflection [110,111,112,171,190]. Hsu [110], Nespoli et al. [111], and Gañán et al. [112] are particularly representative because they connect analytics with learner engagement, competency tracking, and web-based assessment. A second cluster emphasizes coaching and corrective support, as shown by Švábenský et al. [113], Kim et al. [54], and O’Connor et al. [185], while related awareness and platform evaluation studies keep support and interaction quality at the centre of the learner experience [53,88]. The assessment layer is further reinforced by work on balanced scoring, staged assessment, cheating detection, generated training events, and review-level synthesis [84,114,137,178,180].

The multi-mechanic or framework-oriented approach to gamification is reflected in studies that treat it as an explicit combination or synthesis of several game elements. We observed that this logic is especially evident in studies that propose broad pedagogical, organizational, or certification-oriented frameworks for cybersecurity teaching and training, where gamification is discussed as an integrated design layer that supports challenge progression, assessment, and practical alignment [59,64,85,86,109,140,166,169,171,174,175,176]. A related orientation also appears in studies centred on cyber ranges, virtual training environments, and platform architectures, as these works focus on how multiple elements are assembled within a single environment, including guided interaction scenario management, assessment flows, analytics randomization, and deployment structure [40,41,47,50,55,123,124,125,129,131,136,147,209]. This approach is further reinforced in studies that adapt CTF environments or serious game designs into broader virtual learning settings, or that combine awareness practice and digitally mediated support at the platform level [42,61,73,89,145,156,163,191,192,210].

The literature suggests that cybersecurity teaching platforms function most effectively when a set of gamification elements are articulated that can enhance each other; we observed that competitive challenge structures, reward and progression systems, narrative immersion, collaborative play, adaptive personalization, coaching, and analytics serve different but complementary educational purposes, including deliberate practice, sustained engagement, contextual understanding, teamwork, and self-regulation.

Across the reviewed studies, the clearest empirical support is found in studies where gamification is tied to progression, feedback, and repeated practice rather than to isolated mechanics alone. In university contexts, gamification has been shown to improve information security awareness knowledge, but not necessarily attitudes, intentions, or willingness for continued learning. In workforce-oriented settings, by contrast, gamified training has been associated with improved self-efficacy and measurable phishing-related behaviour change, including reduced click rates and increased reporting. Our findings suggest a recurrent tension between engagement and deeper attitudinal or behavioural transfer: some mechanisms support knowledge gain and participation more consistently than long-term psychological or behavioural change.

The literature therefore indicates that the educational value of gamification lies in how carefully its mechanisms are aligned with learner needs and intended outcomes. In this respect, the reviewed studies support a view of gamification as a pedagogical design layer that should reinforce progression, meaning, and feedback. This reinforces the view that gamification contributes educational value when it is aligned with learner needs, supports meaningful progression, and strengthens the coherence of the learning experience.

5.4. RQ4: About Platform Formats and Architectures

To answer RQ4, we grouped the reviewed studies into seven platform-format and architectural approaches (Table 10): reference frameworks, taxonomies, and capability models; general cyber range and sandbox platforms; cloud-native, containerized, and orchestrated platforms; federated, distributed, and multi-range infrastructures; LMS-, web-, and online-learning-integrated platforms; domain-specific and verticalized training environments; and serious game and immersive gamified platforms. This classification treats architecture as both a technical implementation issue and a structural condition that shapes deployment, scalability, interoperability, pedagogical integration, and overall suitability for university teaching. Its rationale is supported by Yamin et al., who frame cyber ranges through scenarios, functions, tools, and architectural logic [168], by Beuran et al., who show how cybersecurity training environments can be integrated with learning management systems and broader educational workflows [190], by the NIST cloud computing reference architecture, which provides a basis for interpreting service-layer modularity and cloud-oriented deployment models [211], and by Total Learning Architecture (Gordon et al., 2020), which helps interpret digital learning environments as interoperable, data-enabled platform ecosystems [212].

Table 10. Dominant platform formats and architectures identified.

Approach	Studies	Architectural Focus
Reference frameworks, taxonomies, and capability models	[42,50,58,60,64,84,88,92,108,114,141,143,144,147,150,166,169,171,176,192,209]	Conceptual, layered, comparative, or taxonomy-driven descriptions of training platforms and cyber ranges
General cyber range and sandbox platforms	[40,46,51,86,91,111,113,121,127,128,148,172,183]	Full-fledged or semi-full-fledged training platforms centred on sandboxed hands-on environments
Cloud-native, containerized, and orchestrated platforms	[41,97,98,99,106,107,115,124,126,131,146,151,152,182,210]	Docker/Kubernetes/OpenStack/IaC, automated provisioning, orchestration, adaptive or AI-assisted scenario deployment
Federated, distributed, and multi-range infrastructures	[69,70,120,123,170,175,186,188]	Federation of ranges, multi-technology infrastructures, collaborative scenario languages, team-centric distributed architectures
LMS-, web-, and online learning-integrated platforms	[49,53,59,61,112,113,153,154,155,177,178,179,190,191,196,197]	SCORM/Moodle/LMS integration, browser-based delivery, e-assessment, online hands-on environments, web-first access
Domain-specific and verticalized training environments	[45,55,102,122,125,129,130,132,133,134,135,136,137,138,139,149,159,198,213]	Specialized architectures for IoT, ICS/SCADA, 5G, OT/ICT, healthcare, maritime, smart grid, cyber-physical domains
Serious games and immersive gamified platforms	[26,39,44,48,52,54,57,68,72,76,80,93,95,96,105,160,161,167,168,173,181,184,185,189,190,191,192,193,194,195,196,197,198,199,200,202,203,204,205,206,207,208]	Standalone serious games, escape rooms, immersive game worlds, narrative environments, coaching-rich gamified systems

The approach of reference frameworks, taxonomies, and capability models is reflected in studies that describe cybersecurity teaching platforms and cyber ranges through conceptual, layered, comparative, or taxonomy-driven lenses. This is especially evident in studies that classify the field through taxonomies, comparative analyses, capability assessment, accessibility reviews, and broad architectural proposals [84,114,141,143,147,150,166,171]. In these works, the architectural concern is to identify recurring platform function maturity criteria, structural dimensions, and comparison variables that make training environments intelligible as a design space and not as isolated artifacts. We observed that a closely related orientation appears in studies that treat the platform as an organised training ecosystem, with reference models, certification alignment, layered capacity, or scenario management logic [50,60,64,88,92,169,176]. This approach is reinforced by studies that extend the conceptual discussion to artificial intelligence-enhanced cyber ranges, virtual learning environments, digital twin perspectives, and authentic cyber range evaluation [42,58,108,144,192,209].

The approach of general-purpose cyber ranges and sandbox platforms is reflected in studies that treat these platforms as complete or semi-complete training environments focused on sandboxed hands-on practice instead of narrowly scoped tools. This architectural focus is especially clear in studies that present concrete cyber range systems with defined deployment, logic, environment instantiation, scenario execution, learner access, and operational components for repeated training use [40,46,111,127,128,148]. In these works, the platform is conceived as an integrated practice environment where learners interact with isolated infrastructures, simulated networks, or controlled attack–defence settings, supported by automation, scalability, or service orchestration. We found a related architectural orientation in studies that emphasize modular scenario development, structured design procedures, and pedagogically aligned training environments [51,91,121]. The same approach is further reinforced by studies that frame tailored training paths, practical hands-on development, and competition-oriented settings as part of a broader range-like infrastructure for skill building and operational preparation [86,113,172,183].

The approach of cloud-native, containerized, and orchestrated platforms is reflected in studies that frame platform architecture around Docker, Kubernetes, OpenStack, and infrastructure-as-code deployment models, together with automated provisioning, orchestration, and, in several cases, adaptive or AI-assisted scenario management. This architectural focus is especially evident in studies that explicitly describe container-based and orchestrated training environments, including Kubernetes-driven sandboxes, containerized cyber ranges, OpenStack-based deployment scenarios, randomization, and cloud game-based architectures [41,124,126,146,152,210]. Selikow et al. [41] are particularly relevant because they present an on-demand cybersecurity sandbox framework powered by Kubernetes and organised through modular internal components. Chouliaras et al. [146] similarly describe a lightweight platform built on OpenStack, Docker, and infrastructure-as-code principles, while Nakata and Otsuka [124] emphasize a high-performance container-based cyber range with scenario randomization. A closely related orientation also appears in studies that center on architecture for automated scenario deployment, AI-based exercise management, lifecycle-based customization, and generative support for cyber-range scenarios [97,98,131,151]. This approach is also reinforced by studies that add adaptive or user-centred orchestration layers, including multimodal adaptive gamified integration recommender systems, chatbot components, and platform designs that seek to personalize the environment while preserving technical modularity [99,182]. Additional work extends this architectural family through data-driven distance learning systems, chatbot-based support, machine learning-supported interaction, and digital twin or explainable security settings [106,107,115,138].

The approach to federated, distributed, and multi-range infrastructures is reflected in studies that frame platform architecture around federations of multi-technology infrastructures, collaborative scenario languages, and team-centric distributed configurations. This architectural focus is especially explicit in studies that directly address the interconnection of multiple cyber range instances, distributed exercise management, and multi-range deployment logic [69,120,123,186]. Diakoumakos et al. [69] make this logic especially clear by situating gamification within a federation of cyber ranges, while Park et al. [123] focus on the design and implementation of a multi-cyber range, and Lates et al. [120] discuss a multi-technology infrastructure for advanced training and testing. Shirmohammadi and Ladani [186] reinforce the same architectural pattern through a scenario description language for collaborative security training in cyber ranges, underscoring the need for shared coordination across distributed elements. A related orientation is also present in studies that foreground team-centric online learning coordinated design frameworks and capacity-building perspectives that implicitly rely on distributed orchestration instead of solely stand-alone deployment [170,175,188]. Albaseer et al. [70] add a broader distributed systems perspective through a collaborative, incentivized architecture for smart grid security, further supporting the relevance of interconnected actors and coordinated infrastructures.

The approach of LMS- and online learning-integrated platforms is reflected in studies that frame platform architecture around SCORM- or Moodle-based integration, browser-delivered access, web-based e-assessment, online hands-on environments, and web-first interaction models. This architectural focus is especially evident in studies that explicitly address online cybersecurity delivery, learning management system integration, and web-based practical training environments [59,112,154,155,190,191]. Beuran et al. [190] make the integration logic particularly clear through CyLMS, which integrates cybersecurity training into LMS workflows via standard interfaces, SCORM-compatible packaging, automatic activity management, and Moodle-based access. Gañán et al. [112] reinforce the same orientation by presenting ICT-FLAG as a web-based e-assessment platform that combines learning analytics with gamification. In the same way, Su [191] foregrounds a web-based, hands-on learning environment for web application security that features guided exercises, online assistance, automatic grading, and portfolio-oriented tracking. A closely related architectural pattern also appears in studies that position browser-accessible competition systems, virtual learning environments, and online serious game platforms as central vehicles for cybersecurity teaching [49,53,153,179,196]. The same family of formats is extended by studies that connect digitally mediated platforms with certification pathways, feedback-rich online assessment, and data-supported learning monitoring [61,113,177,178,197].

The approach of domain-specific, verticalized training environments is reflected in studies that frame platform architecture around specialized environments for technologies and sectors such as IoT, industrial control systems, supervisory control and data acquisition (SCADA), 5G, operational technology, healthcare, maritime security, smart grids, and other cyber-physical domains. This architectural focus is especially clear in studies that explicitly design training environments for sector-bounded infrastructures or domain-constrained operational contexts, where the platform is tailored to the assets, protocols, risks, and tasks of specific fields [45,102,122,125,129,130,132,133,134,135]. Correia et al. [130] are particularly relevant because they propose a framework for Internet of Medical Things scenarios in maritime navigation security, while Frati et al. [133] and Fernandez-Tarraga et al. [132] address healthcare-oriented cybersecurity training. Hamza et al. [122] present an integrated framework for 5G cybersecurity training, and Mozo et al. [134] situate defensive exercises in a 5G cyber range. Nock et al. [125] focus on the Internet of Things, Saito et al. [45] target control systems through virtual commissioning, and Sen et al. [129] model multi-stage attack and defence mechanisms in smart grids. A related verticalization logic is also addressed in studies that emphasize cyber-physical or industrial specialization through domain-specific event generation scenario generators, digital twins, or critical-infrastructure-oriented adaptive modules [137,138,139,149]. The same approach is further reinforced by studies that foreground operational technology and the integration of information and communication technology in maritime settings, sector-targeted training, and competition-based vertical applications [159,198,213].

The approach of serious games and immersive gamified platforms is reflected in studies that treat the platform itself as the primary training environment and not a secondary layer added to a generic cyber range or an external learning system. This architectural focus is especially visible in standalone serious games, escape rooms, immersive game worlds, and narrative environments, where the training experience is packaged as a self-contained game structure with its own missions, progression rules, thematic framing, and interaction logic [39,44,48,52,57,68,72,95,96,160,161,167,168,206,207]. A closely related orientation is also addressed in studies that organize the platform as an immersive or team-oriented game world in which role adoption, competitive interaction, and situated action become part of the environment’s architecture [26,93,204,205]. Kim et al. [54], O’Connor et al. [185], and Chandrashekar et al. [184] reinforce this approach through coaching-rich, guidance-intensive systems, showing that some gamified platforms are architected not only for immersion but also for embedded support, corrective interaction, and user-sensitive progression within the game space. The same platform family is further reinforced by studies that connect serious games or immersive gamified systems with awareness, workforce development, organizational behaviour, and repeated engagement, while keeping the game layer as the main interface through which training is delivered [80,105,173,181,189,199,200,202,203,208].

The literature shows that platform format and architecture should consider technical implementation choices and also the structural conditions that shape educational suitability. We identified a heterogeneous ecosystem that includes elements such as conceptual frameworks, cyber ranges, cloud-native and containerized infrastructures, federated environments, LMS-integrated platforms, domain-specific training systems, and standalone serious games.

Despite this diversity, a consistent pattern across the literature is that educational viability is strengthened mainly by modularity, reproducibility, scalable deployment, and accessible delivery. We therefore observed that architecture plays an important pedagogical role, because it conditions how safely or sustainably learners can participate in practical cybersecurity training.

5.5. RQ5: About Ethical Safeguards and Sustainability

To answer RQ5, we grouped the reviewed studies into six approaches (Table 11): (i) contained and safe training operation, (ii) scalable, modular, and automatable deployment sustainability, (iii) privacy, ethical governance, and trustworthy analytics, (iv) accessibility, continuity, and inclusive delivery, (v) critical infrastructure and sector resilience orientation, and (vi) assurance, standards alignment, and capacity-building roadmaps. These approaches operationalize RQ5 by examining ethics, safety, governance, and sustainability as interrelated conditions of platform deployment and educational use.

Table 11. Security safeguards, governance, and sustainability patterns detected.

Approach	Articles	Patterns
Contained and safe training operation	[40,41,45,47,52,67,91,125,129,136,179,213]	Isolation, sandboxing, safe experimentation, controlled emulation, protected hands-on practice
Scalable, modular, and automatable deployment sustainability	[50,69,98,111,120,121,122,123,126,134,139,147,152,183,186,210]	Reproducibility, orchestration, modularity, automation, maintainability, cloud/container scalability
Privacy, ethical governance, and trustworthy analytics	[63,72,103,107,133,182]	Privacy, consent, data governance, ethical monitoring, trustworthy analytics, sensitive-context safeguards
Accessibility, continuity, and inclusive delivery	[38,48,58,71,78,86,94,141,162,163,167,201,204]	Accessibility, continuity, remote access, broader reach, adaptation across learner groups, and long-term educational viability
Critical-infrastructure and sector-resilience orientation	[42,70,92,130,135,140,173,205]	Sector-specific resilience, mission-critical readiness, workforce preparedness, and organizational continuity
Assurance, standards alignment, and capacity-building roadmaps	[25,49,60,109,168,209]	Standards alignment, maturity/capacity growth, structured design guidance, long-term institutionalization

Its rationale is supported by NIST [214], which frames cyber ranges in terms of use cases, features, and also types for education, certification, and training, and by the ECSO checklist [215], which organizes common features and terminology for selecting and specifying cyber range platforms. It is further grounded in EU legislation [216], which establishes the protection of personal data as a central requirement for platform governance, in ISO/IEC TR 20748-1 [217], which provides a reference model for learning analytics interoperability, in ISO 31000 [218], which positions risk management as an organizational guideline, and in ISO 22301 [219], which formalizes continuity and resilience requirements for sustained operation.

In the first approach, contained and safe training operation, the literature frames practical cybersecurity learning as legitimate only when it takes place under controlled conditions. Several studies highlight game-based scenarios and challenges, such as CTF exercises, virtual and non-virtual reality simulations, and structured competitions, as safe vehicles for practical cybersecurity learning [41,45,47,52,67,129,156]. A recurring concern in this group is the need to monitor participants’ actions, behaviours, and perceptions in order to maintain pedagogical control and reduce the risks associated with hands-on offensive practice [40,41,67,157,179]. Across these studies, experimentation is deliberately displaced from real operational systems into isolated and reproducible infrastructures. This pattern is especially visible in simulation frameworks for critical infrastructures, which allow complex attacks and defensive strategies to be rehearsed in bounded settings [91,129,136,213], and in cyber range designs for Internet of Things and industrial systems, where concurrent, customizable, and scalable scenarios remain separated from production environments [125].

Pedagogical and interaction-oriented safeguards further reinforce this approach; educational adaptations of CTF environments use guided progression, contextualized scenarios, and learner monitoring to reduce the risk of inappropriate application of acquired knowledge, a logic reinforced by proposals that recommend selecting challenges according to prior skills and preferences [156] and by systems that incorporate guided paths, scaffolding, and problem-oriented support for novice learners [67]. These gamified environments also allow learners to assume offensive and defensive roles within virtual settings without affecting real systems [157]. From a UX and usability perspective, additional safeguards include reducing cognitive load, improving ease of use, and preserving contextual relevance [52]. At the technical level, these protections are operationalised through isolation, sandboxing, controlled emulation, and protected practice, together with controls such as zone segmentation, firewall hierarchies, access control, intrusion detection system sensors, and ATT&CK- and D3FEND-based analytical frameworks, as illustrated by Cyber Range Lite [40] and EDURange Cloud [41].

In the second approach, sustainability is understood as the operational capacity to deploy, reset, extend, and reuse training environments at scale, rather than merely as the long-term availability of a platform. Several studies frame this through model-driven and federation-oriented architectures in which scenario logic, organizational conditions, and security requirements are translated into deployable cyber range instances, thereby reducing manual configuration effort and improving consistency across repeated iterations [50,69,121,123]. This same rationale appears in modular cloud and container-based platforms such as SCORPION [111] and CyberScratch [210], as well as in infrastructure proposals based on infrastructure-as-code, Terraform, Ansible, Docker, or Kubernetes [120], where controlled automation becomes essential not only for operational governance but also for their safe and replicable pedagogical delivery. Cyber5Gym makes this especially visible by combining Open5GS, UERANSIM, Docker, and scripted orchestration to reproduce 5G security exercises in the cloud with centralized control and repeatable deployment [122]. Other studies reinforce the same orientation through reusable service layers, interoperable multi-domain infrastructures, and scalable modular architectures that support repeated execution across different technical and institutional contexts [126,139]. Reproducibility is further strengthened by approaches that formalize scenario description and transform it into deployable artifacts, as seen in collaborative scenario deployment models [186], model-driven simulation and emulation workflows [50], and exercise-oriented serious game proposals that map gameplay decisions into emulated infrastructures through DSL-based orchestration [147]. A complementary line extends sustainability toward adaptive evolution. ASCERT introduces dynamically generated AI-based scenarios [98]. At the same time, other contributions in this cluster emphasize context-aware adaptation, extensible authoring, and platform evolution as necessary conditions for maintaining relevance without rebuilding the environment from scratch [134,152,183]. Overall, the studies grouped in this approach suggest that scalable deployment sustainability depends on modularity, traceable orchestration, interoperable design, reusable assets, and controlled automation as core safeguards of both technical continuity and educational viability [98,111,139,147].

The approach to privacy, ethical governance, and trustworthy analytics is reflected in studies that treat monitoring, adaptation, and data use as governance-sensitive dimensions of gamified cybersecurity teaching platforms. A first line of work centers on trustworthy analytics in systems that collect rich learner traces to support personalization, automated feedback, and intelligent educational decision-making. Reddy et al. [63] are especially relevant because they frame AI-enabled educational environments through governance and stewardship, transparency of data and algorithms, accountability, privacy, security, inclusion, and human oversight, which place analytical reliability within an institutional ethics framework. A related concern is evident in Albaladejo-González et al. [182], where a multimodal, adaptive, gamified training system relies on heterogeneous data inputs to improve cybersecurity competence development, making the legitimacy of data capture, the protection of learner information, and the interpretability of adaptive decisions central conditions for trustworthy deployment. A second line of work foregrounds sensitive context safeguards in domains where weak governance could affect mission-critical or highly regulated settings. Bekesiene and Vasiliauskas [107] connect data-driven decision-making in resilient distance military education with explicit concerns about data governance, privacy, ethics, early warning, and the protection of sensitive information, showing that analytical monitoring must be constrained by clear institutional rules and accountability structures. Frati et al. [133] extend this governance logic to healthcare-oriented cybersecurity training, where the surrounding environment is closely tied to critical operational systems and sensitive data practices, so secure interoperability, protected access, and careful management of training information become especially important. A third line of work addresses privacy and ethical legitimacy through awareness interventions that target behaviour, trust, and contextual differences. Yasin et al. [72] examine social engineering through games and simulations, with an explicit emphasis on trust and awareness, suggesting that consent, proportionality, and user trust are essential when training environments reproduce manipulative attack patterns for educational purposes. Al-Shammari [103] similarly ties awareness design to cultural context, reinforcing the need for context-sensitive safeguards so that behavioural influence, monitoring, and persuasive design do not neglect fairness or appropriateness across learner populations.

In the fourth approach, Accessibility, continuity, and inclusive delivery emerge in these studies as a substantive sustainability pattern because the educational value of a gamified cybersecurity platform depends on what it teaches but also on whether it can be accessed under safe conditions, reused across time, and adapted to learners with very different levels of preparation and professional contexts. Steininger et al. [141] are especially central in this regard, since their survey on the accessibility, capabilities, and technology stack of cyber ranges moves the discussion toward infrastructural conditions of use and makes visible that long-term educational viability is closely tied to how training environments are provisioned, maintained, and made reachable to users through digitally mediated access. A closely related contribution is provided by Lazarov et al. [58], whose lessons learned from using cyber ranges at different levels of education indicate that continuity is strengthened when the same platform can accommodate varied degrees of expertise and remain pedagogically useful across heterogeneous cohorts, which directly connects sustainable deployment with curricular flexibility and progressive adaptation. Strussenberg et al. [167] deepen the same line of argument from another angle, because their work on the digitalization of a serious game suggests that moving from a paper-based activity to a digital format supports elements such as repeatability, broader circulation, and easier institutional redeployment, all of which are highly relevant when cybersecurity awareness initiatives are expected to persist beyond a single intervention. Carreiro et al. [78] make the inclusive dimension particularly visible through a gamified awareness approach aimed at healthcare professionals, showing that broader reach depends on translating cybersecurity content into formats that can be meaningfully adopted outside specialist computing environments. This widening of the audience is reinforced by Alghamdi and Younis [204], who discuss computer games for cybersecurity teaching in higher education, and by Rossano et al. [48], who connect simulation-based learning with Industry 4.0 skill acquisition, both of which suggest that sustainable educational operation benefits when technical content is delivered through recognizable, transferable, and domain-sensitive game structures. Muulmann et al. [38] add a further layer through the integration of virtual reality and CTF competition in advanced education, while Weijsenfeld and Sarmah [71] show that narrative-driven design can support engagement and long-term knowledge retention, which is important when continuity is understood as durable learning over time and not only as repeated platform availability. A similarly relevant contribution comes from Rieb and Lechner [162] and Rieb et al. [163], whose Operation Digital Chameleon studies frame serious game delivery as a guided, accessible route for awareness training and for exploring cybercrime-related reasoning, involving cross-functional participants. At the review level, Chaskos et al. [84], Saglam et al. [94], and Prümmer et al. [201] reinforce this overall pattern by showing that gamified cybersecurity training remains educationally sustainable when platform design, game mechanics, and delivery conditions are aligned to preserve safe participation, extend remote or digitally supported access, and keep the learning environment reusable for diverse learner groups across time.

The approach to critical infrastructure and sector resilience orientation is reflected in studies that place gamified and simulation-based cybersecurity education inside operational domains where service disruption has strategic, economic, or societal consequences, thereby linking learning design to sector-specific resilience and to the preparation demands of mission-critical environments. A first cluster concentrates on contexts such as smart manufacturing, smart grids, maritime logistics, and interconnected cyber-physical ecosystems, where the educational objective is not limited to generic security awareness but is instead aligned with the distinctive constraints, threat models, and continuity requirements of each sector [42,70,130,135]. In this sense, the review on digital twins and virtual learning environments in smart manufacturing connects educational technology with future workforce needs in industrial settings [42], the smart grid contribution underscores defensive capability in a highly sensitive infrastructure domain [70], the IoMT framework extends cyber defence scenarios across civilian and military settings with implications for global maritime navigation security [130], and the CyberMar study frames cybersecurity soundness as a prerequisite for resilient maritime logistics operations [135]. A second study cluster is oriented toward mission-critical readiness, as it emphasizes training environments where participants can rehearse crisis response, coordinated defence, and cyber-physical disruption management under realistic yet protected conditions [92,130,205]. This tendency is especially visible in work on cyber crisis management exercises, where preparedness is developed through structured rehearsal for severe cyber events [92], and in gamified approaches to teaching cybersecurity in cyber-physical systems, where the relevance of training derives from the tight coupling between digital compromise and operational failure in Industrial Internet settings [205]. A third cluster addresses workforce preparedness and organizational continuity by treating cybersecurity education as a sustained capability-building process for personnel responsible for keeping essential services functioning under pressure [42,140,173,205]. Here, the scoping review on operational technology personnel in critical infrastructure identifies both competencies and persistent gaps, while associating preparedness with stronger self-efficacy [140], and the study on gamification for workforce development in critical infrastructure highlights its capacity to strengthen the ICS cybersecurity workforce [173].

The approach to Assurance, standards alignment, and capacity-building roadmaps is reflected in studies that treat gamified cybersecurity training as a capability to be organised, scaffolded, and progressively consolidated, instead of a collection of isolated learning activities. One study cluster contributes structured design guidance by mapping the forms, tools, and pedagogical logics through which competitions, computer games, and serious game scenarios can be connected to cybersecurity learning outcomes, thereby supporting more consistent and comparable training design [25,49,168]. In this line, a survey by Balon and Baggili [25] is relevant because it systematizes cyber competitions, tools, and educational support systems, helping clarify the design space from which institutions can select and align training formats. Karagiannis and Magkos [49] reinforce this structured orientation by presenting digital game-based learning as a virtual learning environment for basic cybersecurity concepts, with emphasis on student engagement and skill acquisition, while Yamin et al. [168] show that serious games can be used to model attack and defence scenarios in a way that gives exercise design greater coherence and repeatability. A second cluster centers on maturity and capacity growth, where the concern is no longer only the immediate learning effect but also the gradual development of institutional training capability and the conditions required for its sustained evolution [60,109,209]. Moore et al. [60] are especially important here because their layered model frames cyber defence training capacity as something that can be built through successive levels of development and informed by technical, human, and socio-behavioural factors, which provides the literature with a clearer roadmap. Gwenhure and Nam [109] add a complementary perspective by examining the trends, limits, and lessons of gamified cybersecurity initiatives, explicitly tying sustainability to the recognition of design constraints and the need for practices that support effective, long-term awareness-building. Glas et al. [209] extend this discussion into the organizational domain by identifying both the potential and the open challenges of cyber range exercises, particularly the importance of comparability when validating competence development, which directly strengthens the assurance dimension of this approach.

The articles analysed for RQ5 show that ethics, security, and sustainability are closely linked in the design and operation of gamified cybersecurity teaching platforms. We observed recurring attention to safe training environments, modular and automatable infrastructures, privacy-aware governance, inclusive access, sector-oriented resilience, and structured capacity-building.

Together, these patterns show that sustainability goes beyond technical persistence and long-term availability. It depends on protected experimentation, trustworthy monitoring, institutional reuse, and meaningful adaptation across learner groups and operational contexts.

6. Discussion

Overall, our SLR indicates that gamified cybersecurity teaching platforms should be understood as learning systems in which the interaction quality, didactic structure, game mechanics, deployment architecture, and governance safeguards work in combination. The synthesis across the reviewed studies suggests that successful platforms do not depend on gamification alone, as they also depend on the alignment among guided and usable interaction, scenario-based and hands-on learning, meaningful progression mechanisms, and infrastructures capable of supporting safe, reusable, and pedagogically coherent practice. In this way, our results show a progression from isolated game elements toward more integrated ecosystems. The findings also reinforce the idea that sustainability must be treated as a design condition of the platforms, since long-term educational value is strengthened when interaction design, didactic structure, platform architecture, and governance safeguards are considered together. Accordingly, the integrative value of the review lies in articulating these dimensions into an evidence-based taxonomy and configurational synthesis.

A further implication of the review is that the inclusion of studies situated outside strictly university-focused gamified education was analytically valuable for understanding transferable design and deployment conditions. In this review, transferability was understood as the analytical usefulness of design, pedagogical, architectural, governance, or sustainability conditions that could reasonably inform higher education implementation.

Although some contributions were developed in critical infrastructure, enterprise, and military contexts, they highlight conditions that are highly relevant for HEIs because universities increasingly seek articulation with those sectors through workforce preparation, applied research, professional upskilling, and simulation-based collaboration, among other elements. Our study shows that cybersecurity training is already being delivered across academia, organizations, healthcare, and critical infrastructure, while advanced simulation is especially associated with expert and mission-oriented preparation. From a sustainability perspective, this broader inclusion is therefore justified because it supports an educational logic based on transferability, interoperability, and long-term relevance, helping academic platforms remain connected to the environments in which graduates will eventually operate.

At the same time, the reviewed literature still shows important limitations. The evidence remains heterogeneous in research design, learner population, platform maturity, and reported outcomes, which makes direct comparison difficult. Stronger empirical support is concentrated in some recurring patterns, whereas other contributions remain primarily conceptual, framework-oriented, or prototype-based. This indicates a need for more consistent evaluation criteria, clearer reporting of learning, usability, engagement, retention, and transfer outcomes, and more explicit comparative validation across platforms and contexts.

7. Conclusions and Future Work

Our SLR shows that gamified cybersecurity teaching platforms can provide substantial educational value when they are conceived as sustainable socio-technical systems. The literature emphasizes protected practice through contained and safe training environments where offensive and defensive activities are moved into isolated and reproducible infrastructures. In this respect, studies on cyber ranges and containerized environments make clear that safe experimentation is both a technical convenience and a pedagogical and ethical requirement for legitimate cybersecurity training. We observe that long-term viability depends on architectures that can be deployed, reset, extended, and reused with limited friction. Our review identified strong support for modular and automatable infrastructures, including cloud and container-based environments, because they improve repeatability, maintainability, and institutional continuity over time. We also observed that several studies show that sustainability depends not only on technical architecture but also on governance conditions.

Beyond the educational setting narrowly defined, the literature on critical infrastructures, industrial environments, maritime systems, healthcare, and operational technology suggests that cybersecurity education becomes more sustainable when it is connected to sector-specific resilience, workforce preparedness, and continuity of essential services. At the same time, the review identifies a persistent need for more consistent evaluation criteria and clearer reporting of educational outcomes. These findings indicate that future research should examine how UX, didactic design, and platform configuration can be aligned more coherently under real educational conditions, particularly in environments intended for long-term institutional use and constructive alignment with learning outcomes [3,60].

A promising next step is to empirically evaluate attack–defence training platforms that incorporate the most recurrent patterns identified in this review, particularly guided interaction, challenge-based practice, modular deployment, and safe experimentation. Such work could examine how these design conditions perform across different educational contexts and learner profiles, including differences related to educational level and cultural background [18]. This would help assess the transferability, inclusiveness, and long-term educational viability of gamified cybersecurity platforms without moving beyond the evidence-based scope established by the present review [3,60].

For HEIs, the review suggests four practical priorities when selecting or designing gamified cybersecurity teaching platforms. First, prioritizing safe experimentation through isolated and controlled environments; second, aligning gamification mechanisms with explicit learning outcomes and didactic structure rather than treating them as stand-alone motivational add-ons; third, favouring modular, reusable, and scalable architectures that support continuity across cohorts and courses; and fourth, embedding governance, privacy, accessibility, and sustainability considerations from the outset of platform deployment. These priorities should help HEIs adopt cybersecurity training platforms that are pedagogically coherent, institutionally viable, and sustainable over time.