Abstract
Serious games are increasingly being used in cybersecurity education to engage and educate users. Several studies with cybersecurity serious games have shown that they are successful in educating users and the users also find them both fun and engaging. Meanwhile, several studies have also reported issues in identifying real life effects of the game and even the long-term effects that they have. Based on our experience with enterprise cybersecurity games and games from recent literature, we discuss a few key challenges that must be considered while designing and evaluating serious games for cybersecurity awareness.