  With the rising number of cyberattacks, such as ransomware attacks and cyber
espionage, educating non-cybersecurity professionals to recognize threats has
become more important than ever before. However, traditional training methods,
such as phishing awareness campaigns, training videos and assessments have
proven to be less effective over time. Therefore, it is time to rethink the
approach on how to train cyber awareness. In this paper we suggest an
alternative approach -- a serious game -- to educate awareness for common
cyberattacks. While many serious games for cybersecurity education exist, all
follow a very similar approach: showing people the effects of a cyber attack on
their own system or company network. For example, one of the main tasks in
these games is to sort out phishing mails. We developed and evaluated a new
type of cybersecurity game: an attack simulator, which shows the entire setting
from a different perspective. Instead of sorting out phishing mails the players
should write phishing mails to trick potential victims and use other forms of
cyberattacks. Our game explains the intention of each attack and shows the
consequences of a successful attack. This way, we hope, players will get a
better understanding on how to detect cyberattacks.
