Why D&D Works: The Design Theory Behind Gamified Security Awareness
2026-04-15
I have over 1,000 hours in Baldur’s Gate 3. I still haven’t finished it.
I say this upfront because I want you to understand that when I built a D&D-flavored security awareness program for my school district, it wasn’t just because I’m obsessed with the game. It was because I genuinely believed the mechanics would work on adult learners in a way that traditional training doesn’t.
Turns out I was right. Turns out there’s a whole body of research that explains exactly why.
This is that post.
The Problem Isn’t Engagement. It’s Learning Science.
Here’s the thing about mandatory compliance training: it’s not bad because it’s boring. It’s bad because it’s built on a fundamentally broken model of how adults actually learn.
Passive video training assumes that information transfer equals behavior change. Watch the video, take the quiz, check the box. But Malcolm Knowles’ framework of andragogy — his theory of adult learning developed in the 1970s — has been telling us for decades that adults don’t want to be told what to do, and they want the freedom to choose how, when, and what they learn. eLearning Industry Adults aren’t motivated by completing things to make reminder emails stop. They’re motivated by relevance, autonomy, and immediate application.
A 25-minute annual video ticks none of those boxes. Adult learners are resistant to the tactics of traditional pedagogy like drills, quizzes, fact-laden lectures, and rote memorization. Ijrar They need applicable knowledge they can use right now, not hypothetically.
Gamification, when it’s done well, actually delivers that.
What Game Design Does To Your Brain
Let’s talk about what’s happening psychologically when a game mechanic lands right.
Autonomy, competence, and relatedness.
Psychologists Edward Deci and Richard Ryan spent decades developing Self-Determination Theory, which identifies three core psychological needs that drive genuine, lasting motivation: autonomy — feeling that one’s actions are self-chosen; competence — the feeling of mastering a challenge; and relatedness — a sense of connection with other people. Springer
A student who studies because she finds biology fascinating will outperform, outcreate, and outlast a student who studies because her parents threatened to take away her phone, even if both put in the same hours. Yu-kai Chou The same principle applies to security training. Mandatory compliance hits none of the three needs. You’re told to watch. You pass or fail a quiz. You do it alone.
Games, by design, hit all three. You choose to play. You get better at something measurable. You play alongside or against other people. Workplace research grounded in SDT demonstrates that employees whose needs for autonomy, competence, and relatedness are met show higher engagement, greater creativity, lower burnout, and reduced turnover. Yu-kai Chou
The leaderboard question.
Leaderboards are controversial in gamification research — and honestly, for good reason. Leaderboards can be viewed as a source of recognition of one’s capabilities and an avenue for competition, but reward systems can also cause a downfall in the process of self-regulation and the development of intrinsic interest if participants consider them instruments of external control. Egarp
So why did the leaderboard in the Security Guild work? Because my champions asked for it. Nobody imposed it. That distinction matters enormously. Autonomy-supportive environments — where participants feel in control of their choices — dramatically change how game mechanics land. The same leaderboard that feels controlling in a mandatory context feels exciting when you opted in.
Peer influence is the hidden mechanic.
Here’s the one that often gets left out of gamification conversations entirely: the social layer is doing more work than the points are.
Research published in the Journal of Applied Psychology found that when you push initiatives through managers, you may get immediate change with the top-down approach — but to create sustained change, you need to also rely on peer-to-peer exchanges. Maryland Smith When peers reinforce a behavior, it sticks. When a policy email from IT tells you to change your password, it doesn’t.
My champions are calling each other to talk trash about XP standings. That’s peer reinforcement doing exactly what the research says it should. I didn’t engineer that. The social structure of the program made space for it to happen naturally.
Why D&D Specifically
Generic gamification — points, badges, leaderboards slapped on top of existing training — has gotten mixed results in research, and there’s a reason for that. The majority of gamification designs follow the behaviorist approach, which highlights the compliance driven by rewards instead of the engagement driven by autonomy. Egarp Badges on a boring thing make a boring thing with badges. That’s not what I built.
D&D works for different reasons.
Narrative arc. A campaign has a beginning, a middle, and an end. There are stakes. There’s a boss battle. That structure creates investment over time that a simple points system can’t replicate. My champions know we’re building toward something — a tabletop incident response exercise in the final week. That’s not just a carrot. It’s a story they’re living inside.
Player agency. In D&D, you make choices that matter. The Security Guild’s quests are opt-in and stackable — champions choose which ones to pursue, in what order, for what XP. Not every quest is right for every person. Some champions are naturally drawn to the social quests. Some prefer the solo technical ones. Both paths are valid. Both build the same habits. You don’t have to complete every side quest, as long as you’re still on the main. That autonomy is doing serious psychological work.
The DM/Champion model. This is the piece I’m most proud of structurally. In D&D, the DM doesn’t play the game for the players — the DM creates the conditions for the players to do interesting things. Security Champions aren’t just learners. They’re the people their colleagues trust. The ones who’ll say “hey, did you verify that email?” without it feeling like a lecture from IT. That’s the social proof layer built directly into the architecture of the program.
The Evidence So Far
I’m six weeks into a 12-week program. I don’t have final data yet.
What I have: champions who asked for a leaderboard. Champions who are calling each other. Champions who’ve come to me a little stressed about falling behind — which honestly tells me they care, and caring is the whole point.
A meta-analysis of 35 gamification studies found an overall significant effect favoring gamified learning over non-gamified learning, with particularly strong positive effects on participants’ perceptions of autonomy and relatedness. Springer That tracks with what I’m seeing. The XP is almost secondary. The social layer — the belonging, the competition, the shared vocabulary of the Guild — is where the real engagement lives.
Full debrief is coming after week 12. Results, data, what I’d do differently. And yes, I’m working on packaging this as a toolkit for other solo IT folks to run. Not quite ready. But coming.
The Takeaway
The quests aren’t a gimmick. The XP isn’t decoration. The D&D framing isn’t just a cute hook for people who like fantasy.
Every mechanic in the Security Guild is doing specific psychological work — backed by decades of research on how adults actually learn, how motivation actually works, and how culture actually changes. I built it intuitively first, because I know what works on my own brain. The research was there waiting to confirm it.
If you’re in security awareness, IT, or education and you’re exhausted watching people click through compliance videos to make the reminder emails stop: the problem isn’t your audience. It’s the design.
Build a campaign. Not a course.
Liz Gore is a Director of IT, SANS Cyber Academy graduate (GFACT, GSEC, GCIH), and a person who apparently has strong opinions about adult learning theory now. Find her at lizgore.com.