Search papers, labs, and topics across Lattice.
This paper introduces TrainShield, an innovative interaction paradigm for contextual cybersecurity training that integrates real-time risk detection with personalized micro-learning interventions within user workflows. By transforming security incidents into immediate learning opportunities, TrainShield enhances user awareness and decision-making through adaptive learning tailored to individual contexts. Preliminary findings indicate that this approach is preferred over traditional training methods, significantly improving risk awareness while also revealing challenges in content alignment with user expectations.
Embedding real-time cybersecurity training within user workflows transforms security incidents into immediate learning opportunities, significantly enhancing risk awareness.
In recent years, cybersecurity threats have increasingly exploited human behaviour rather than purely technical vulnerabilities, exposing the limits of traditional awareness programmes delivered outside real-world contexts. To bridge this gap, we introduce TrainShield, an interaction paradigm for contextual cybersecurity training that embeds adaptive learning interventions directly within user workflows. The system integrates real-time risk detection (e.g., phishing and data loss prevention) with event-triggered hypermedia overlays that dynamically connect users to context-specific learning nodes embedded within their browsing workflow to deliver personalised micro-learning content and structured feedback tailored to the user's knowledge level and current context. This approach operationalises behavioural theories by transforming security incidents into immediate learning opportunities, shifting users from automatic to reflective decision-making at critical moments. We further formalise a design model that maps detected events to adaptive training instances, combining user modelling, context extraction, and large language model (LLM)-based content generation. A preliminary study indicates that the approach is perceived as useful in increasing risk awareness and is preferred over lengthy and asynchronous traditional training formats, while also highlighting challenges in aligning generated content with user expectations. Overall, the results suggest that embedding contextual, event-driven training within everyday interactions is a promising direction for behaviour-oriented cybersecurity education.
