Applied Fiction: Training That Engages The Team

Chris from Meta Mythic and Lisa from Arizona Public Service present their initiative to transform cybersecurity training through applied fiction—a methodology that makes learners the heroes of interactive narratives rather than passive recipients of compliance content.

**The Problem:** Arizona Public Service faced regulatory pressure from NERC CIP grid regulations to train 2,000 employees in cybersecurity for the first time. Traditional training methods—binders of procedures, 40-50 slide PowerPoint presentations, and 10-question quizzes—produced severe disengagement: 36% actively disengaged (intentionally avoiding training), 60% not engaged (clicking through minimized windows), and only 4% genuinely engaged.

**The Core Insight:** Humans are integral parts of security systems and require meaningful development, not dismissal as "stupid users." The speakers advocate upgrading the "wetware" (human knowledge) alongside technological improvements, drawing on the timeless power of storytelling—fables and parables have taught truth for centuries through fictional narratives.

**Applied Fiction Methodology:** The approach preserves three critical training elements: an instructor presence, immersive learning environment, and real-world simulation. Security professionals become the "sage" (Obi-Wan Kenobi figure) enabling employees as "heroes" (Luke Skywalker). Fictional enemy characters represent attack vectors blended with actual security threats.

**Technical Implementation:** Training opens with an immersive security checkpoint scenario (quarantine/access denial) immediately capturing attention. Employees personalize experiences by selecting call signs and choosing facilities to defend (substations, plants, control centers). They encounter approximately 12 attack scenarios—both physical (badge readers, eye scanners, body sensors) and cyber (USB drives, firewall packet inspection)—explained through narrative and humor. Learning occurs across 40+ decision points with point accumulation. Crucially, no pass/fail threshold was imposed, removing fear barriers and enabling continuous reinforcement based on detailed performance data by employee group and location.

**Results:** After training 1,800 employees, engagement metrics dramatically shifted: disengaged dropped to 4%, not engaged to 13%, and engaged reached 83%—far exceeding the speaker's initial 40% target. Employees voluntarily adopted the "defender" identity, reporting it as the best training they'd experienced. Even senior executives sent unsolicited positive messages.

**Takeaways:** The speakers emphasize three lessons: (1) systems include people—upgrade human knowledge as rigorously as technology; (2) storytelling is inherently human and proven effective for learning; and (3) security professionals must enable employees as heroes, not lecture them as failures. They invite listeners to join "the learning rebellion" and offer free access to training samples online.