Cybersecurity Volume 4: Designing the Game with Tanja Schaetz-Kruft

You have had quite the career at SAP. Can you tell us a bit about your journey over the past 20 years?

I started as an SAP consultant and after that a Development Manager at SAP Accessibility Competence Center. In 2011, I took over the role of Dean at SAP's Development University, where I had the opportunity to build and lead an international team and to manage large training programs. In this role, I gained deep insight into innovative learning approaches for the first time as the first gamification projects at SAP began in addition to traditional learning strategies.

Although employees know that security is important, it is often considered to be boring, and they are not really motivated to deal with this topic.

You were there at the beginning of it all. Can you briefly describe the role you are in now?

In my team, we are responsible for the security awareness education of all SAP employees. Although employees know that security is important, it is often considered to be boring, and they are not really motivated to deal with this topic. My specific responsibility is our mandatory security training – traditional eLearning approaches and also creating game-based learning assets. These trainings provide employees all the important information about the most common security threats, how to recognize them, and how to prevent them.

As a child, was there a game you always liked to play?

When I was young there was a board game called Dungeon!, which I played for days with my siblings. You had to slip into the role of a wizard, a hero, an elf, or a fairy. You were in an old castle with secret doors and hidden treasure, protected by dragons and monsters, and you had to find the treasures, and fight against the monsters. Another kind of game which I loved, and still love to play are ones where I can challenge my brain, like chess and Clue. In my spare time now, I also enjoy escape rooms.

How has your love for games influenced your work now?

What’s funny, when I think about it, is what we offer today in our escape game trainings is more or less a combination of both my childhood game choices. We often create new fantasy roles and a story with secrets and riddles that the players have to solve. In the past years, we have had games about a Horror Hospital, Pharaoh Ramses – this was after I was in an escape room about ancient Egypt – Sherlock Holmes, and Dracula, just to name a few.

Do you use specific games to target certain security topics?

We have smaller games which are really topic specific. For example, we have one that is called the “Clean Desk.” This is about workplace security and here there are only questions and challenges about what to do to keep your work secure. But then of course, we also have the more complex games, like the escape games which I mentioned, and here we try to cover many security topics. They take around 45 minutes to one hour to really solve the challenge.

With COVID-19 have most of your trainings been able to take place online?

In the past, we had some of the escape games in person. For example, the Horror Hospital and Pharaoh Ramses games. We had physical rooms which were fantastic, but now, with Corona, all our games are online. In ways it was challenging, but, on the one hand, it has become a great way to stay connected. We have games for single players, and we also have games for teams. Our employees really love to play these team games – sometimes they even use them for team building events.

What is the most difficult/challenging aspect of trainings?

What's really challenging is to reach all employees with our activities. At the moment, we are more than 100,000 people in the company. Our perception is that employees are being flooded with too much information. They get tons of emails and newsletters about all kinds of topics, HR information, updates from departments, information about upcoming events, etc. It's simply too much, and if we send emails about a new game or security campaigns, then many employees won't even read it and in some cases, even if they read it, they don't have the time to participate.

If you teach using game like elements, it improves the retention rates to 75% compared to 5% with traditional learning methods.

How effective is game-based learning?

It has very big potential, and this is shown in various studies. While interacting with games, learners really enjoy and are more engaged with the content. If you teach using game like elements, it improves the retention rates to 75% compared to 5% with traditional learning methods. In total, more than 20,000 SAP employees have already participated in our games, and we receive very good feedback from the players.

That’s a significant difference!

What we learn from this is that we must make learning fun, and there are also statistics, for example, from the German Game Federation that show gamified trainings are not perceived as training activities and the acceptance to participate is higher. For example, the average completion rate for gamified trainings is 94% whereas for classical eLearning it is only 25%.

Do you have a favorite training game?

Mine is Dracula, which we created last year. In this escape room, you slip into the role of the famous vampire hunter, Professor Van Helsing, and the game takes place in Dracula's castle in Transylvania. You have heard about a manuscript Dracula found which will give him even more power and make him the lord of life and death. The mission is to kill him, find this manuscript, and destroy it. Every little detail in this escape game is important and some things are also funny. For instance, when you enter the kitchen, you find blood bags with different blood types instead of real food. There is a lot of attention to detail, which makes this one so special to me.

What tips would you give for creating a successful training game?

1. Include good game mechanics; They are the building blocks of gamification. Having rules and rewards really create an engaging experience and make gamification challenging and fun.
2. Good game design. This means you have to know your users. There are different kinds of players, and they have different preferences – killers (competitive players), achievers, explorers, and socializers.
3. Make it challenging. But it shouldn't be extremely difficult either. The key is to increase the difficulty while playing.
4. Create both team games and single player games. There are players who love to play in a team, but there are also players who prefer to play alone. We offer both options to reach our target audience.
5. Make a real competition. We announce our games as part of events and then also the winning teams receive prizes, and their pictures and names are published internally on our channel pages.

Your advice for young girls interested in pursuing a career in STEM?

Women can do and achieve everything they wish. They just have to be confident in their abilities. The important thing is that you set a goal, strive for it with consistency, and do not let yourself be discouraged by setbacks. If you fall, get up again. There is a quote from the Swedish writer Astrid Lindgren that says it all. She says: “Don't let them get you down. Be cheeky and wild and wonderful!"