The “Big Heist Challenge” is an innovative assessment method used in an undergraduate course at the University of Galway, the objective of which is to teach business and law students about the human-centred aspects of cybersecurity. Delivered through a gamified, role-play format, the challenge enhances students’ understanding of cyber threats and defenses by immersing them in realistic scenarios. Working in teams, students first act as attackers by devising a hypothetical cyberattack (Phase 1) against a fictitious organisation, then switch roles to become defenders, developing a strategy to counter an assigned attack plan (Phase 2). This active learning approach fosters key skills including problem-solving, analysis, teamwork, planning, critical thinking, and research.
The pedagogical approach draws on principles of active authentic learning and gamification. Whitton (2018) emphasises the importance of creating “safe” playful spaces that support learning from failure, risk-taking, creativity, and innovation. Brown & Leigh (2018) advocate for integrating creative and playful approaches into higher education research to foster deeper engagement and diverse perspectives. Additionally, literature on ethical hacking pedagogy (Hartley, 2015; Pike, 2013; Al-Tawil, 2024) underscores the necessity of teaching offensive cybersecurity skills within an ethical framework to prepare students for real-world challenges.
Quantitative data from a questionnaire covering two academic years (n=168) indicates that the majority of students found the “Big Heist Challenge” to be a valuable, engaging, and innovative learning experience. It helped them develop various skills, including problem-solving (90.5% agreement), analytic skills (86.9% agreement), teamwork (87.8% agreement), planning (88.7% agreement), critical thinking (91.7% agreement), and research skills (93.5% agreement). Students also appreciated the collaborative aspect, noting that working in groups allowed for diverse perspectives and efficient task delegation. The assignment facilitated interaction among classmates (83.3% agreement), promoted mutual support (75.6% agreement), and brought authenticity to their learning (90.8% agreement).
Qualitative feedback further supports these findings, with students highlighting the practical, hands-on nature of the assignment and its relevance to realistic cybersecurity scenarios. They appreciated the creative freedom, clear structure, and effective resources provided. However, some students indicated that while they enjoyed the experience overall, it was not entirely pleasant as they felt uncomfortable contemplating the use of devious social engineering tactics during the attack phase.
Overall, the “Big Heist Challenge” has proven to be a very successful pedagogical approach that combines active learning, gamification, and ethical hacking principles to enhance students’ understanding of cybersecurity. It fosters skill development, collaboration, and critical thinking, preparing students for real-world cybersecurity challenges. Future iterations could benefit from incorporating more detailed guidance and feedback mechanisms to further support student learning and engagement.