Cyberbit is a Cyber-learning platform combining security labs with hyper-realistic attack simulations creating a “zero to hero” learning and readiness process for SOC teams. Over the last year, we transitioned our platform from a simulation-focused system to a learning-focused experience, leveraging the concepts behind behavioral sciences. The motivation-centric features came to fruition after long months of planning and researching hopefully serving to inspire behavioral supported thinking for other product managers.

Learning environments are effective, according to behavioral science, because they remove the fear of failure. In real life, failure is the ultimate de-motivator, sowing fear, and paralyzing decisions. In the SOC, this paralysis can be even more harmful given the data we are trying to protect. Thus, creating an environment where a cyber attack is taking place without the consequence of failure provides SOC professionals and hopefuls with the perfect place to develop and hone their cyber skills.

Therefore, we decided to create a learning experience that is supported by behavioral sciences theories. One which will push our learners to make progress even when it’s hard and failure seems imminent because failure is the first step in learning. Our pursuit for a better learning experience has provided tremendous influence to our user experience within our learning units and our platform as a whole.

Give them a nudge

As a learning and experience-building platform, we cannot solely rely on supervisory recognition as the sole source and core motivation to learn how to defend your organization from the consequences of a cyber-attack. After developing the trainee profile and manager dashboards we decided to focus on removing the thorns currently discouraging learning and, using behavioral sciences theories, create new sources of motivation.

Before a Training Session

Shareable certifications

SOC team members uncovering an attack feels like the kings/queens of the hill, especially when receiving the gratitude of their team, manager, and the general public of their organization. To convince our trainees to begin a training session we wanted to nurture the same feelings within our platform, even when not in a live situation. To create clear motivation, we built our internal Cyberbit certifications system, based upon the completion of “learning paths”. Our system has hundreds of labs and real-life scenarios, which we have grouped by professional role or topics, creating a coherent and linear set of training content increasing in difficulty as skills are developed.

Upon completion, users will receive a certificate, shareable on their social media (e.g. Linkedin) and visible to their superiors on the Manager Dashboard. Recognition is a driving motivator for our users. Thus, self-recognition by receiving a reward for their efforts, supervisory recognition by highlighting their success to their manager, and community recognition by giving them the ability to share their achievements provide multiple motivating factors for users to begin and continue skills development.

The creation of our certification system is supported by the Expectancy Theory, which in essence dictates that the motivation of behavior selection is determined by the desirability of the outcome. By creating a fixed Reinforcement Schedule that divides our learning options into learning blocks with pre-determined rewards, we can strengthen internal motivations both to begin learning and to continue cyber skills development on Cyberbit while achieving visible and attainable goals. 

Still, while certifications are a crucial motivator when deciding to start or complete a learning path, they are not always enough to get users through the ups and downs of learning, often mixing with confusion and occasional mistakes. We realized we need to embed learning motivators within and throughout training sessions as well.

During the Training Session

Direct feedback

Feedback is highly important to human beings while learning. helping us understand if we are headed in the right or wrong direction. In real cyber investigations, SOC teams only receive vague clues when looking for attack vectors or behaviors indicating a live attack. When struggling to find a clue, motivation will decrease and the feeling of fear of failure will increase. Luckily, the drive to mitigate a live-fire attack is a larger motivator, keeping trainees engaged through attack resolution.

However, those same feelings of confusion and fear which occur in a simulated attack without the adrenaline rush of a real-life scenario might lead to the demotivation of a trainee. Thus, we broke down the questionnaire following our labs into smaller mid-lab quizzes, allowing our learners to receive feedback after each question, and ensuring they are focused in the right direction. When mistaken, instead of “reducing points” without an explanation at the end of the session, we guide them back to the correct response, explaining their mistake and providing the solution. Using these techniques, we reduce demotivation and increase engagement with the learning materials.

This strengthens our Reinforcement Schedule, creating small reinforcements events (quizzes), acting as stepping stones to our long-term goals. Creating a positive, visible effect in case of success, and avoiding the natural temptation to visualize failure (reducing score or a buzzing sound), and instead helping them to build upon their mistakes. Combining this with Variable Scheduling, providing unexpected positive reinforcements that originate based on user activity, arouses internal motivation towards learning and practicing. 

Be their parachute 

Receiving help from the platform can be paralleled as giving up and admitting failure. Our learners might feel insecure facing the real events which are hiding just around the corner. From a learning platform perspective, the ultimate choice when struggling to find the answer is to lean on the help provided during the session. This will give our learners the option to still find the right answer themselves. In order to create an ultimate choice we relied on the theory of “Choice Architecture.”

Choice architecture is the art of design, a choice that will lead a person to select a specific option. The theory considers the wording of each option as well as the options provided. When struggling to find the right answer, our users mainly deal with 2 options:

1. Go with their gut and choose their instinct-based response

2. Receive help and make a more informed decision

Diving into the statistics: To make one option the undoubtable choice for human beings who naturally hate risk (and hate losing twice as much as winning), a higher expectation rate applies with a lower risk rate. Looking at option 1, the exception stands at 25%, while the risk is high. While choosing option 2, the risk is already reduced because our help increases the likelihood of a correct answer by 70% due to the information provided. Thus, reducing your provided “points” on the quiz while increasing the likelihood of achieving those points should make the 2^nd option the logical decision. Moreover, when looking at the wording of our hints, we decided to select verbiage which indicates the gains rather than losses in each question even if he/she uses our help.

Learning should be a rewarding process, laced with motivation throughout the learning experience. The environment included within the Cyberbit platform keeps learning motivation high, ensuring better knowledge retention, engagement, and ultimately, performance. We continuously seek to optimize our learning experience, providing an easy way for learners to commit and continue their pursuit of knowledge and skill development, ensuring a strong SOC team, appropriately prepared for live attacks in production.