Abstract for:Results from the cyber-security game: decision makers may have difficulties in appreciating dynamic complex systems

This paper is about the development of a new system dynamics game in the field of cyber-security. Games provide a realistic and secure approach to learning and experimenting, which in turn can be used to build security awareness among participants. This game goes beyond traditional attacker-defender interaction and includes business operations, finance and decision making. 

The game has been played in sixteen sessions with 132 cyber-security specialists and managers. Game data analysis indicates that the defender ability to learn from attacks has a significant impact on resilience and financial performance. Similar to the Beer Game, players have great difficulty in appreciating multiple feedback loops, time delays and nonlinearities in the system. Our reflections resulted in further game improvements and recommendations for further research.