Abstract

Gamified cybersecurity education techniques, especially Capture The Flag (CTF) games, have become a growing example of alternative to conventional compliance-based awareness initiatives in business settings. Although they have been increasingly popular, little has been studied on their long-term return on investment (ROI) in actual organizational contexts. In this paper, the impact of CTF-based training relative to traditional cybersecurity training is assessed based on such key performance indicators as knowledge retention, behavioural change, and financial outcomes. To synthesize the existing evidence on training effectiveness and ROI-related measures, a systematic review of 22 peer‑reviewed sources published within the period of 2021-2026 was developed. The results show that CTF based consistently outperforms, such as better knowledge retention, better engagement and reduced vulnerability to phishing attacks. Moreover, gamified training strategies show possible economic advantages in the form of a decrease in security attacks and a higher level of employee readiness. Longitudinal research in corporate sittings, however, is not abundant, especially where full-time employees are studied and the duration of evaluation is more than twelve months. To fill this gap, this paper suggests the use of a multidimensional ROI evaluation system that incorporates pre and post training evaluations, behavioural monitoring, incident monitoring and post training follow ups at 3, 6 and 12 months. The framework proposed provides a viable methodology that would assist the organizations to determine the success of the training conducted in CTF and enable them to make informed decisions concerning cybersecurity investment.