We Got Hacked! – A training simulator for learning cybersecurity incident response
Keywords:
Cybersecurity, Incident Response, Security Operations Center (SOC), Educational Games, Gamification, Simulation, Cybersecurity Training, Hackers do BemSynopsis
The growing number of cyber incidents underscores the need for effective methodologies to train incident response teams. Given the shortage of educational games in Portuguese that simulate the daily routine of a Security Operations Center (SOC), We Got Hacked! was developed to support the training of students and professionals. This article summarizes the game’s development process and reports the results of an external evaluation conducted in 2026, focusing on participants’ experience. The findings indicate: (i) high ratings for relevance, enjoyment, and satisfaction; and (ii) opportunities for improvement, particularly the implementation of a progress-saving feature.
Downloads
References
ANGAFOR, G.; YEVSEYEVA, I.; MAGLARAS, L. MalAware: A tabletop exercise for malware security awareness education and incident response training. Internet of Things and Cyber-Physical Systems, Elsevier, 2024.
ANGAFOR, G. N.; YEVSEYEVA, I.; MAGLARAS, L. Scenario-based incident response training: lessons learnt from conducting an experiential learning virtual incident response tabletop exercise. Information & Computer Security, Emerald Publishing Limited, v. 31, n. 4, 2023.
CAMINGUE, J.; CARSTENSDOTTIR, E.; MELCER, E. F. What is a visual novel? Proceedings of the ACM on Human-Computer Interaction, ACM New York, NY, USA, v. 5, n. CHI PLAY, p. 1–18, 2021.
CHECK POINT. Global Cyber Attacks Rise in January 2026 Amid Increasing Ransomware Activity and Expanding GenAI Risks. 2026. Acesso em 14-jul-2026. Disponível em: [link].
HATZIVASILIS, G. et al. The threat-arrest cyber range platform. In: IEEE. 2021 IEEE International Conference on Cyber Security and Resilience (CSR). [S.l.], 2021.
IBM. Cost of a Data Breach Report 2025. 2025. Acesso em 13-jul-2026. Disponível em: [link].
ISACA. State of Cybersecurity 2023 report. 2023. Acesso em 30-jun-2025. Disponível em: [link].
KATSANTONIS, M. N.; MAVRIDIS, I.; GRITZALIS, D. Design and evaluation of cofelet-based approaches for cyber security learning and training. Computers & Security, Elsevier, v. 105, 2021.
KHANDO, K. et al. Enhancing employees information security awareness in private and public organisations: A systematic literature review. Computers & Security, v. 106, 2021.
KITCHENHAM, B. A.; BUDGEN, D.; BRERETON, P. Evidence-based software engineering and systematic reviews. [S.l.]: CRC press, 2015. v. 4.
O’CONNOR, S. et al. SCIPS: A serious game using a guidance mechanic to scaffold effective training for cyber security. Information Sciences, Elsevier, v. 580, 2021.
PÉREZ, J.; CASTRO,M.; LÓPEZ, G. Serious games and AI: Challenges and opportunities for computational social science. IEEE Access, IEEE, v. 11, 2023.
PETRI, G.; WANGENHEIM, C. G. V.; BORGATTO, A. F. MEEGA+: Um modelo para a avaliação de jogos educacionais para o ensino de computação. Revista Brasileira de Informática na Educação, v. 27, 2019.
PIRTA-DREIMANE, R. et al. Try to esCAPE from cybersecurity incidents! A technology-enhanced educational approach. Technology, Knowledge and Learning, Springer, 2024.
STEIGLEDER, R. et al. Análise da percepção de estudantes sobre um jogo educacional de resposta a incidentes cibernéticos. In: SBC. Escola Regional de Redes de Computadores (ERRC). [S.l.], 2025. p. 95–101.
THAROT, K. et al. A cybersecurity training concept for cyber-physical manufacturing systems. Procedia CIRP, Elsevier, v. 120, 2023.
VIDENOVIK, M.; FILIPOSKA, S.; TRAJKOVIK, V. A novel methodological approach for learning cybersecurity topics in primary schools. Multimedia Tools and Applications, Springer, 2024.
