Designing for Decision-Making: The Hidden Challenge in Cybersecurity Training

Dia Valencia
May 26
3 min read

When I started building Cyber Smart, a scenario-based e-learning module for corporate employees, I knew the stakes were high—cybersecurity isn’t just about information; it’s about behavior. But there was one instructional design challenge I didn’t expect:

How do you design a course that doesn’t just teach, but helps people make better decisions under pressure?

That question took me beyond ADDIE and into deeper territory—cognitive load, branching logic, and authentic simulation. I wasn’t just designing for engagement—I was designing for real-world application.

Designing for Real Risk, Not Just Right Answers

Most e-learning modules stop at knowledge checks: multiple-choice questions, quick tips, and “did-you-know” popups. But in the real world, phishing emails don’t come with quiz options—they come with consequences. I needed learners to practice noticing, not just knowing.

So instead of static instruction, I created interactive simulations where learners opened their inbox, scanned a realistic (and suspicious) email, and had to decide: report it or respond? The system tracked their decision—not just whether they got it “right,” but how they got there.

In one of the branching scenarios, if a user clicked the link in the phishing email—even if they stopped midway and didn’t submit their information—the module still registered the risk. It guided them down a different path that explained how clicking alone could compromise security.

This design choice mattered. It sent the message that intent doesn’t cancel impact, and it made the experience feel less like a test and more like a consequence-based simulation. The learning wasn’t passive—it responded to users’ actions, even in those “gray areas” where most trainings offer no feedback.

Behavior Mapping Through Branching Logic

I used branching logic not just to offer alternate paths, but to mirror how decisions unfold in real time. One seemingly small action—clicking a link, hesitating before reporting, or dismissing an update—led to meaningful consequences and personalized feedback.

This wasn’t gamification for novelty’s sake. It was a way to reflect the mental models and pressure points employees face in real digital environments, where cybersecurity threats often hide behind ordinary-looking decisions.

Designing for the Right Audience

And yes—I know this module isn’t hyper-technical. It wasn’t meant to be. Cyber Smart is the first in a foundational mini-series, designed to take employees from basic awareness to applied confidence. The target audience includes beginners with no prior cybersecurity knowledge and newer employees still learning safe digital habits.

This wasn’t about impressing IT professionals—it was about empowering the people most likely to be targeted, and least likely to recognize a threat. It’s intentionally approachable, because good security starts with behavior, not buzzwords.

Insights from the Field

One of the biggest wins came from user feedback. Learners described feeling like they were “in a real office scenario,” and several noted they’d started second-guessing sketchy emails in their actual inboxes. That told me I’d succeeded—not because they remembered a statistic, but because they’d internalized a new habit of slow thinking in fast moments.

💡 What I Learned

Instructional design isn’t always about tools or templates—it’s about precision thinking.

“What specific moment am I trying to prepare them for?”“What do I want them to do, not just know?”

With Cyber Smart, I learned that designing for behavior means designing for decisions—messy, contextual, human decisions. And that’s where instructional design becomes transformational: not in teaching the facts, but in shaping the response.

...but I'll let you decide! Check it out here and don't forget to let me know what you think by answering the quick poll below:

(there's an in depth survey embedded into the module but who has time for that?)

Overall Rating