Exploring Multi-Opposing-Role Play, Narrative-Based Simulations, and In-Game Feedback in Cybersecurity Education: Insights From “The XSS Game”

Cybersecurity education often struggles to engage learners while effectively conveying complex web vulnerabilities. This challenge is particularly evident in topics such as cross-site scripting (XSS), where understanding requires both technical knowledge and an appreciation of attacker, defender, and user perspectives. To address this, The XSS Game (TXG), a web-based multi-opposing-role-playing game, was developed and iteratively refined to support experiential learning of XSS concepts through gameplay. Using a design-based research approach, two versions of TXG were designed and evaluated, incorporating scenario-based tasks, a Simulation Zone, and structured in-game feedback, including confirmatory, explanatory, affirming, and personalized feedback, delivered through a player statboard to support reflection and self-regulation. Evaluation with undergraduate students combined pre- and post-game surveys, in-game behavioral metrics, and exploratory interviews. The study was guided by the Kirkpatrick Model, Kiili&#x2019;s Experiential Gaming Model, and NASA-TLX to capture learning outcomes, engagement, and perceived cognitive load. Results indicate statistically significant improvements in XSS knowledge (Wilcoxon signed-rank test, <inline-formula> <tex-math notation="LaTeX">$p \lt.001$ </tex-math></inline-formula>), with a large effect size observed in TXG V2 (<inline-formula> <tex-math notation="LaTeX">$r = 0.55$ </tex-math></inline-formula>). Multi-opposing-role gameplay was rated as supporting learning from multiple perspectives by 82&#x2013;85% of participants, while engagement with narrative-based simulations increased from 22% in TXG V1 to 71% in TXG V2. Structured in-game feedback was reported to help identify mistakes and improve understanding by 74% of learners. Overall, the findings demonstrate that integrating multi-opposing-role gameplay, narrative-based simulations, and structured feedback can effectively enhance learning, engagement, and motivation in cybersecurity education, providing a reusable framework for educational game design.