UX Case Study

Escape the Bunker

Escape the Bunker was a learning gamification project that produced an interactive escape-room experience to teach essential password security principles, such as recognising strong passwords, identifying phishing attempts, and understanding the risks of password reuse. Using design thinking, the project emphasised evaluation over concept generation, aiming to test whether this format could effectively enhance understanding of cybersecurity behaviour.

The brief required two simultaneous objectives. Firstly, the experience needed to be engaging and coherent as a game, capable of maintaining player interest for 30 to 60 minutes for those familiar with puzzles and escape rooms. Secondly, it needed to demonstrate measurable learning outcomes using both formative and summative evaluation methods, rather than relying solely on participant self-reporting.

This created a design tension that shaped the project. As immersive playfulness increased, ensuring that learning objectives remained clear and memorable became more challenging. The team integrated learning into gameplay and used various techniques to measure efficacy.

The final product was a hybrid physical-digital escape game supported by structured testing, observational analysis and post-session assessment. This project revealed the difficulty of striking a balance between engagement and concept retention, highlighting how easily learning goals can be overshadowed when play becomes the primary focus.

The project included five team members. The teamwork aspect was enjoyable and exceeded expectations. Each team member contributed unique skills, adding value wherever possible. The project pushed everyone beyond their individual capabilities, fostering a collaborative environment with output greater than the sum of its parts.

Research and discovery

The research phase focused on understanding how and why people engage with time-based exchange systems, and where existing platforms fall short.

The research showed that people rarely join these platforms for purely economic reasons. Participation is driven more by social connection, learning, and a desire to contribute meaningfully. At the same time, many users feel hesitant about asking for help, offering services, or engaging publicly.

The research clarified that successful participation depends less on features and more on trust, clarity, and social comfort. This shaped every design decision that followed.

Key inputs included

Analysis of published time-banking studies
Review of existing community exchange platforms
Examination of user motivations and barriers to participation
Synthesis of behavioural patterns across user groups

Foundational empathy

The project began by exploring how people perceive cybersecurity training and why it often fails to change behaviour. Initial research involved desk research, a short survey and an interview with a CREST-accredited cybersecurity professional.

Key points:

Explored how people perceive cybersecurity training in practice.
Looked at why existing approaches struggle to change behaviour.
Compared user attitudes with real-world security habits.
Examined how training tools balance engagement and learning.
Identified behavioural patterns that undermine traditional instruction.

The survey revealed a recurring pattern. Participants generally rated their understanding of password security as high, but admitted to poor practices such as password reuse, predictable structures, and insecure storage. This suggested that a lack of information wasn’t the main issue. Instead, users believed they understood the risks and therefore disengaged from conventional training.

Limitations of existing training approaches

A review of existing cybersecurity training tools and escape-room-style learning experiences revealed a tendency towards either oversimplification or excessive complexity. Many focused on entertainment without verifying learning, while others prioritised instruction at the expense of engagement.

Behavioural reality and design constraints

The expert interview reinforced the tension. Real-world breaches, especially in small organisations, were rarely caused by advanced attacks. They were usually due to basic behaviours such as weak passwords, reusing passwords across services, and misunderstanding authentication processes.

This phase established a key constraint for the project. Any solution relying on lectures, instructions or self-directed learning would likely reproduce the same disengagement patterns seen in traditional training.

Defining the problem

This research reframed the problem from “teaching cybersecurity” to designing an experience that exposes and challenges false confidence.

The central question became: how can we create a game-like experience that forces players to confront their assumptions about password security?

Several design requirements emerged:

The experience needed to be lengthy and complex enough to discourage shortcuts and guessing.
Learning should be embedded in interaction rather than simply delivered as information.
Success should be measurable beyond completion or enjoyment.
The game should support observing player behaviour, not just outcomes.

Reframing success criteria

Consequently, the project was framed as both a design and an evaluation exercise. The team redefined success not as “players enjoyed the game,” but as whether players demonstrated understanding of password principles after completing the game.

Narrowing scope for depth

This framing also influenced the project’s scope. Rather than covering cybersecurity broadly, it focused narrowly on password behaviour, allowing for depth rather than superficial coverage.

Ideation

The team explored various formats before settling on a hybrid escape-room structure blending physical artefacts with a digital interface.

This format was chosen for specific reasons. Physical artefacts foster collaboration and discussion, while a digital layer enables controlled progression, feedback, and data collection. The escape-room structure naturally supports time-pressure sequencing and problem dependency – both of which are valuable for testing decision-making under constraint.

A locked-down research bunker narrative was developed to provide a believable context for restricted-access passwords and system locks. Rather than serving as mere storytelling, it served as scaffolding for the puzzles' logic.

Each puzzle was explicitly mapped to a password-related concept, including:

Password strength and predictability.
Reuse across systems.
Exposure through poor storage.
Multi-factor authentication.
The risks of overconfidence.

Structuring the experience

Before constructing any artefacts, the team storyboarded the entire experience using flow diagrams to test if information introduced in one stage would be needed later. This approach helped avoid common escape-room issues where puzzles feel disconnected or arbitrary.

Enforcing learning through progression

The key design decision at this stage was to ensure progression was impossible without engaging with the intended concept. Guessing or bypassing a puzzle blocked the game, ensuring interaction and learning were tightly coupled.

Prototyping

Prototyping was aimed at making the experience testable as early as possible. The initial version combined a physical “lost and found” box containing clues with a web-based interface accessed via a QR code.

Early testing revealed several key issues:

Players often misunderstood puzzle solutions.
Visual cues were misinterpreted.
Misinterpretation confusion carried over, affecting later performance.

Rather than simplifying puzzles, the team focused on clarifying affordances and reducing ambiguity. For example, visual elements suggesting scanning were removed when they led players astray. Instructions were refined to guide attention without revealing answers.

The prototype underwent multiple iterations. For comparison, each was tested using:

Time-on-task.
Think-aloud protocols.
Error frequency.
Observed player discussions.

Stalled moments were particularly scrutinised, revealing mismatches between the designer's intent and players' interpretations.

This stage highlighted a crucial distinction: puzzle difficulty and learning difficulty are not the same. A puzzle could be challenging yet still fail to convey its intended lesson.

Testing

Batches of participants tested the final game across multiple sessions. The focus was on engagement, completion and learning. Throughout the session, players were observed, and data was gathered via post-game questionnaires and a short knowledge assessment. Completion time averaged just under an hour, meeting the design target.

Tested engagement, completion time, and learning outcomes.
Observed player behaviour throughout the session.
Collected post-game feedback and knowledge responses.
Found strong engagement but uneven learning retention.
Identified clearer recall for action-based concepts.
Noted limitations in how learning was measured.

Engagement levels were consistently high. Participants enjoyed the experience and found it immersive. Collaboration naturally arose without any facilitation. However, learning outcomes were more variable.

Learning retention patterns

While most participants could recall general password advice after the session, their performance on more specific questions, such as those related to multi-factor authentication and password management, was weaker. This revealed a key limitation: concepts directly tied to actions were retained more reliably than abstract ones.

Limitations of the evaluation approach

The evaluation also highlighted a measurement issue. Some incorrect answers stemmed from ambiguity in the test questions rather than a misunderstanding of the content. This underlined the difficulty of designing fair assessments for interactive, experience-led learning.

Summary

This project demonstrates the complexity of designing engaging and verifiable educational experiences. The escape-room format sustained attention and encouraged collaboration, but also created challenges around clarity, pacing, and learning transfer.

The most significant insight was that engagement and understanding do not scale together automatically. The learning outcomes—such as grasping password strength, avoiding reuse, proper storage, and multi-factor authentication—must be intentionally linked to player actions. A well-designed game can still fail to communicate these core lessons if they are not tightly integrated into gameplay.

In summary, the project demonstrated that achieving genuine learning in game-based experiences demands intentional alignment of engagement, clarity, and measurement. Only by purposefully integrating learning objectives with player actions and rigorously evaluating outcomes can such formats reliably improve real-world understanding.

Lessons learned

Learning must be designed as deliberately as interaction.
Puzzle difficulty and concept clarity are not the same thing.
Observation reveals issues that surveys cannot.
Evaluation tools need as much design care as the product itself.
Engagement alone is not evidence of understanding.