The design and development of instructional innovations rarely prepare designers for the challenges that emerge during implementation. Curricula, technologies, and learning experiences that perform well in controlled or idealized conditions often encounter significant obstacles when introduced into real-world educational settings, particularly informal or out-of-school contexts where structures, norms, and expectations differ markedly from traditional classrooms. Understanding how these implementation dynamics unfold is essential knowledge for instructional designers, yet practitioner accounts of implementation struggle and creative adaptation remain relatively underrepresented in the scholarly literature.
This design case documents the implementation of CySEC, The Crucible, a researcher-developed collectible card game (CCG) designed to teach cybersecurity and basic computer science to middle school-age children. CySEC was implemented across three after-school and informal learning centers during a single summer program cycle. What the research team anticipated as a promising rollout became a rich, complicated, and ultimately instructive experience. Encountering obstacles related to physical environment, student motivation, communication breakdowns, and the unpredictable rhythms of informal learning settings, the team was required to adapt continually and creatively.
This manuscript is not a report on CySEC’s effectiveness as a learning intervention. The design, development, and outcome data of this project are documented elsewhere (Thomas et al., 2019; Thomas & Emerling, 2026). Rather, this is a practitioner’s account of what happened when a carefully designed instructional innovation met the complex realities of out-of-school implementation. Our goal in sharing this story is to offer the instructional design community an honest account of our experiences, including our missteps, in the hope that it resonates with others who design for informal, semi-structured, or community-based settings. We focus specifically on what did not go as planned, the innovative ways we adapted in real time, and what those adaptations reveal about the unique demands of implementing game-based learning in non-traditional contexts.
The paper is organized as follows. We first provide background on games for learning, collectible card games, implementation research, and cybersecurity education to contextualize the innovation and its deployment. We then describe CySEC itself and the three settings in which it was implemented, including a comparative overview table. A cross-case analysis of implementation challenges follows, organized by theme. We then describe the adaptive design responses we enacted before offering a distilled set of lessons for instructional designers working with game-based approaches in informal settings.
It is now widely accepted that both children and adults learn a great deal through gameplay and that compelling games have design features that make learning not only fun but also highly effective (Barab, Thomas, Dodge, Carteaux, & Tuzun, 2005; Barab, Thomas, Dodge, Newell, & Squire, 2004; Gee, 2003; Squire, 2006, 2011; Steinkuehler, 2006). In studying ways to use digital gaming for learning, Gee (2003) developed a list of 36 principles of learning, which he argues are built into quality video games. Gee (2003) further investigated three areas of research related to video game learning: (a) situated cognition (Lave & Wenger, 1991), (b) new literacy studies, and (c) connectionism. Shaffer (2006) explored how games can expand learning beyond rote knowledge and help students think like the expert professionals they hope to become someday. By trying on the epistemic lenses that real-life experts use to see their world, learners vicariously experience the habits of mind of experts and take on the experts’ identity as part of a learning trajectory. Games can provide learning environments that situate social action while incorporating elements such as narrative, leveling systems, and epistemographic identity work as players “try on” experts’ identities and world views (Gee, 2003; Shaffer, 2006). Steinkuehler (2006) examined the complex interactions between players of the game Lineage and found that players display allegiance and identity through the turn of talk within the game.
More recent scholarship has reinforced and extended these early findings. Systematic reviews and meta-analyses have provided robust evidence that well-designed games can produce meaningful learning gains across a range of domains and age groups and support the notion that game-based approaches are effective for engaging young learners in cybersecurity (Clark, Tanner-Smith, & Killingsworth, 2016; Sailer & Homner, 2020; Sağlam et al., 2023; Arishi et al., 2024; Ebrahimi et al., 2025). Plass, Homer, and Kinzer (2015) proposed a framework for game-based learning that emphasizes the role of cognitive, motivational, emotional, and sociocultural factors in mediating how games produce learning. Mayer (2019) argues that the critical question is not whether games promote learning, but under what conditions and for what kinds of learning outcomes they are most effective. As this body of research indicates, games can provide valuable real-world experiences for learners that are compelling, effective, motivating, and practical (Schell, 2008; Wang et al., 2022).
Collectible card games (CCGs) are games of strategy where players compete and build decks of cards for gameplay. Cards are acquired through purchase or trade with other players or collectors (Adinolf & Turkay, 2011). Turkay et al. (2012) describe aspects of CCGs that include their ability to promote creativity, cognition, and logical reasoning, all while creating opportunities for players to synthesize new knowledge and develop skills not traditionally taught in a classroom setting. Recently, several researchers have found that the affordances of card games make them appropriate learning environments for learning content related to security awareness (Shah & Agarwal, 2023; Obeng et al., 2024; Camilleri et al., 2025). It is not uncommon for physical CCGs to make the digital leap and become digital collectible card games (DCCGs), providing them a larger possible network of users and more significant potential for impact. Like video games, DCCGs are appealing and popular with many age groups but particularly with younger children. The current study examines the implementation of a researcher-developed CCG for teaching cybersecurity to early adolescents. The literature and theory that we draw upon are mentioned here not to prescribe our approaches for other designers but rather to inform readers as to where we (the designers) are drawing guidance from.
Implementation has long been recognized as a critical challenge accompanying the introduction of any new educational innovation, whether in the form of curriculum, technology, or instructional model. The question of how to maintain the integrity of an innovation while adapting it for diverse contexts lies at the heart of implementation research. This field is concerned with assessing both the fidelity with which an innovation is enacted and the extent to which contextual variables influence outcomes (Fixsen et al., 2005; Fullan & Pomfret, 1977; Snyder et al., 1996). Over time, as innovations are modified to accommodate local needs, such adaptations may significantly alter their core design, potentially undermining intended effects or reshaping the innovation entirely (Brown & Campione, 1996). Berman and McLaughlin (1975) conceptualize this as the cooptation of an innovation by its implementers, a process that may dilute its original purpose and compromise long-term success. Hernandez and Hodges (2003) further distinguish between “paper” implementation (plans and guidelines) and “process” implementation, which involves enacting those plans in practice. While challenges in this transition are to be expected, the modifications made during implementation are not inherently detrimental; in fact, they can be essential for achieving relevance and effectiveness across settings. Ultimately, what Fixsen and colleagues (2005) term “performance implementation” is realized when the core components of an innovation are institutionalized and yield consistent, positive outcomes at scale (Bertram et al., 2011; Fixsen et al., 2005; Hernandez & Hodges, 2003).
Research since the 1970s has focused on the broad-scale implementation of educational innovations and has established the varied problems associated with hierarchical, top-down approaches to implementing practices across contexts (Berman et al., 1975; Berman & McLaughlin, 1974, 1975, 1978; Greenwood et al., 1975; McLaughlin, 1990). More recent work has continued to refine our understanding of what makes implementation succeed or fail. Durlak and DuPre (2008) conducted an influential review demonstrating that implementation quality significantly moderates program outcomes, estimating that programs implemented with higher fidelity produce effects two to three times larger than those implemented poorly. Meyers, Durlak, and Wandersman (2012) proposed a Quality Implementation Framework synthesizing critical steps in the implementation process, emphasizing the importance of organizational readiness, implementation teams, and ongoing formative evaluation. Together, this body of work reinforces that external innovations can be adopted into different contexts successfully when implementation is approached with flexibility, adequate scaffolding, and sustained attention to individual and organizational factors (Crandall et al., 1982; Huberman & Miles, 1984; Miles & Louis, 1990). Rogers (1995) described concerns related to hesitant adopters of innovations, noting that adoption confidence grows as individuals see the innovation implemented and learn from colleagues in social settings (Crandall, 1983; Huberman & Miles, 1984). Implementation researchers and developers should anticipate the likelihood of contextual adaptations and provide flexibility for individual factors in order to increase the probability of successful adoption (Fullan & Pomfret, 1977; Randi & Corno, 1997; Snyder et al., 1996).
In 2015, the Government Accountability Office (GAO) reported that cybersecurity incidents related to federal agencies spiked from approximately 5,500 in 2006 to more than 67,000 in 2014 (Wilshusen, 2015). In 2024, the GAO noted that since 2010, it had made 1,610 recommendations in public reports that addressed cybersecurity vulnerabilities. As of May 2024, federal agencies had implemented 1,043 of these recommendations but 567 remained unimplemented (GAO, 2024). The Ponemon Institute (2015) reported that the average individual cost of cybercrime on major companies worldwide was $7.7 million. The sustained increase in cybercrime creates and maintains demand for cybersecurity professionals and creates urgency around building the talent pipeline from an early age. The National Initiative for Cybersecurity Careers and Study (2015) described five necessary skills needed to be developed in an individual to be successful as a cybersecurity expert: (a) agility to move between roles, (b) multifunctionality of skills that can be executed at any moment, (c) the dynamism of continuous learning to address new and evolving threats, (d) flexibility that allows individuals to maneuver into new settings and roles easily, and (e) the ability to work successfully in non-traditional environments. These career-related requirements develop the individual’s capacity to creatively “hack” in ethical ways (Gee, 2003).
Attention should be given to developing the interest of younger generations in cybersecurity careers and offering exposure to computer science courses and classroom experiences. Although the United States population is twice that of Russia, twice as many Russian high school students have taken the Russian equivalent of the AP Computer Science exam (Krebs, 2017). Russian children receive far more informatics education in school at much earlier ages than their American counterparts (Krebs, 2017). Federal policy has recognized this gap. In 2017, President Trump signed an executive order directing the development of a cybersecurity training curriculum spanning from primary school through the post-secondary years, with explicit attention to building the national workforce pipeline (Trump, 2017).
One essential pathway toward this goal is exposing students from traditionally underrepresented communities to cybersecurity content throughout their K-12 experience. There are documented barriers for specific communities entering the cybersecurity workforce that include a lack of access to training opportunities and low expectations on the part of some educators that channel students away from computer science fields (Denner, Campe, & Werner, 2019). Research on cybersecurity education for children supports game-based and interactive approaches as particularly effective for engaging young learners with this content and building early career interest in the field (Arishi et al., 2024; Sağlam et al., 2023). This body of evidence provides direct support for the design approach taken in the current project.
CySEC, The Crucible is a game with a total of 99 cards that players can use to assemble their decks. There are attack cards, supporting attack cards, defense cards, supporting defense cards, resource cards, general support cards, game mechanics cards, instruction cards, and hacker cards. These card types are distributed in decks similar to other popular deck-building games like Pokémon. Players select cards from the 99 existing cards to assemble personal decks composed of 40 cards in addition to hacker cards and main loop cards. As shown in Figure 1, the game features 18 hacker cards, each with unique strengths and weaknesses in skill and equipment that may be augmented with resource cards; the functions of each element mirror real-life elements of computer science and cybersecurity content. Players “tick” through turns using the “main loop” cards, and the structure of gameplay closely mirrors the decision-making processes of real hackers and cybersecurity professionals.
Figure 1 The CySEC cybersecurity learning card game has 18 hacker cards in its current state of development. Players “tick” through turns using the “main loop” cards (pictured in the lower row). Each hacker has strengths and weaknesses in their skill and equipment that may be augmented with resource cards. The functions of each element mirror real-life elements of computer science and cybersecurity content.
Because players assemble their own decks in preparation for gameplay, they develop their strategy for winning through this deck-building process. In this way, players creatively solve problems related to both offensive and defensive gameplay, modeling the experiences of real-life hackers and cybersecurity professionals who must create new strategies to accomplish their goals. The main goal of the CySEC CCG is to teach general security principles via current defense and attack scenarios and techniques mapped to the game mechanics. Like other CCGs such as Magic: The Gathering, Pokémon, and Yu-Gi-Oh!, CySEC, The Crucible is a deck-building game.
During the summer of 2018, the CySEC research team implemented the card game at three after-school and informal learning centers. While the broader project included a fourth site, the three described here were selected for this design case as they most clearly illustrate the range of implementation challenges encountered. Across all three settings, the same game, CySEC, The Crucible, and the same core instructional approach were used. Sessions were organized around a brief whole-group instructional phase focused on a cybersecurity concept or game mechanic, followed by breakout play in pairs or small groups. While the core innovation remained constant, the research team was required to adapt continually to each site’s unique ecological, programmatic, and social conditions. Table 1 provides a comparative overview of the three settings.
“The University” setting recruited children from a variety of neighborhoods surrounding the university; many students were children of faculty and staff who worked on campus. Students’ ages varied most widely at this site, ranging from approximately 6 to 13 years old, making it both the most diverse in age and the most challenging in terms of differentiated instruction (approximately 25 students). The summer camp focused on STEM topics, and students were on campus from morning through mid-afternoon. The camp directors scheduled CySEC during the midday lunch break, providing the research team one hour to supervise students during their lunch period and transition them into the CySEC activity. Instructional goals at this site centered on introducing cybersecurity vocabulary, familiarizing students with the CySEC card types and their cybersecurity analogs, and initiating basic deck-building practices. The instructional approach began with a brief whole-group orientation to the day’s cybersecurity concept, followed by guided card sorting and deck selection, and culminated in structured gameplay between pairs or small groups.
The counselors and director of the program used the lunch period as their own break, leaving students in the total supervision of the CySEC research team. The team planned each session with specific sequential instructions and related gameplay activities. However, managing both the transition out of mealtime and the behavioral dynamics of a wide age span within a compressed one-hour window proved consistently difficult. The lack of on-site staff support required the team to function simultaneously as instructors, behavior managers, and game facilitators. This was a demanding combination that limited the depth of instructional engagement the team could sustain.
“Parkview” initially appeared to offer the most favorable conditions for implementing CySEC. A comprehensive planning meeting with the center director, “Kyle,” confirmed his enthusiasm for the partnership and the program’s alignment with Parkview’s newly adopted STEM focus. Located in a neighborhood on the southwest side of a large Midwestern metropolitan city, Parkview provided services to surrounding neighborhood families (approximately 20 students). The age range of students, primarily 10 to 13 years old, aligned precisely with CySEC’s intended audience, and the older ages supported the reading fluency and cognitive autonomy required for deck-building strategy. Instructional goals at Parkview emphasized deck-building strategy, application of offensive and defensive cybersecurity concepts, and peer-to-peer gameplay. The gender balance at this site was approximately even, and some students were already experienced CCG players. One student in particular, a girl who emerged as an opinion leader, demonstrated enthusiasm from the first session and helped shape positive peer norms around the game.
Despite these favorable preconditions, Parkview presented significant implementation challenges. Parkview counselors provided little to no support to the research team. The team was frequently introduced to new staff during sessions, and the center used the CySEC space as an overflow room, regularly funneling students who had no other placement into the session. New students arrived each session who had not previously attended, disrupting the established social dynamics and requiring constant re-onboarding. Sessions immediately followed a center-wide meditation period during which students were encouraged to be still and quiet, and many fell asleep. The research team regularly found itself needing to re-engage students who arrived drowsy or disoriented. When new participants joined mid-session, the research team also faced episodes of bullying triggered by disrupted peer relationships, which required immediate intervention and diverted considerable energy from instruction.
“South Side” also held early promise. Multiple planning conversations between the program director and the research staff established alignment around the summer programming and the center’s recently adopted STEM focus. Students at this site came from the surrounding neighborhood in the same large Midwestern metropolitan city (approximately 30 students). The center provided the team with a large, consistently available space, a logistical advantage relative to the other two sites. Instructional goals at South Side paralleled those at the other settings, with particular emphasis on connecting cybersecurity concepts to real-world scenarios and fostering students’ identification with the hacker personas depicted on the CySEC cards.
The consistent use of air conditioning in the space created an unexpectedly cold climate that affected the comfort and alertness of both students and staff; most participants arrived dressed for summer weather and were visibly uncomfortable throughout sessions. The scheduling of CySEC in the morning as students first arrived created additional engagement challenges, as students were still drowsy upon entry. One designated counselor, “Carol,” was assigned to assist; her role, however, functioned primarily as behavioral management rather than instructional facilitation. A notable asset unique to this site was the regular attendance of a professor of computer science, whose domain expertise enriched discussions of cybersecurity concepts. The team adapted to leverage this resource by occasionally shifting sessions toward live demonstrations of hacking techniques and cybersecurity concepts. This was an unplanned but effective adaptation that illuminated how cybersecurity content could be brought to life beyond the card game itself.
Across all three settings, several categories of challenges recurred with sufficient regularity to warrant systematic discussion. We have organized these into five thematic categories: Ecological, Motivational, Programming, Communication, and Student Relationships. Though we present them separately here for analytical clarity, we view them as interrelated dimensions of a broader implementation challenge rooted in the culture of each setting, its ecology, its rituals, its human hierarchies, and its patterns of action. Attending to this cultural dimension, we believe, is the central imperative for designers working in informal contexts and puts into practice design-based research approaches that have been found to support effective instructional design (Barab & Squire, 2004).
Several challenges that emerged during implementation concerned the physical environment. Environmental factors can be difficult or impossible to control, but they can have decisive impacts on an implementation’s trajectory.
Across all three sites, the research team was displaced from its planned space without advance notice at various points. Sometimes this occurred just before students arrived and, in some cases, during sessions. These unplanned moves required the team to set up materials in new rooms on the fly while managing the student transition.
Temperature control proved to be a persistent ecological challenge. At one site, there was no air conditioning at all, making the room temperature nearly unbearable and requiring the opening of windows that presented safety concerns. At another, aggressive air conditioning made the space so cold that students and adults shivered through sessions. At neither site was the research team able to get the temperature adjusted, and in both cases the physical discomfort affected student alertness, comfort, and willingness to engage.
At two of the three centers, the CySEC space was used as a holding room for students who were late, had no other scheduled program, or arrived without a clear placement. This created incessant interruptions to session flow. Additionally, there was no consistent adult presence from center staff, and those who did appear were largely passive, occasionally managing disruptive behavior but not participating in or supporting the instructional activity.
The most persistent motivational barrier across all three settings was students’ personal technology devices. Each center allowed students to bring their home devices and use them freely during the day. Because most students in the target age range owned smartphones with internet access, and because the environmental norm at all three centers was permissive regarding device use, the research team had no authority to require students to put their phones away. This created a low-cost exit from engagement that students exercised regularly, preferring to text, access social media, or FaceTime friends who were not present.
Scheduling compounded this dynamic. At The University, the research team was allotted the lunch period, requiring them to transition students directly from eating into focused instruction within a compressed one-hour window. At Parkview, CySEC sessions immediately followed a midday meditation period in which students were frequently given the opportunity to rest quietly and many fell asleep. The team was required to re-engage students who arrived effectively “checked out.” Over time, it became more effective to allow students who were genuinely asleep to remain at rest, since their disruptive effect on the group was lower than that of students who were physically present but actively resistant or restless.
Several implementation challenges concerned the scheduling and flow of sessions. Some of these were within the team’s control, and many were not. CySEC activities were embedded within existing center programs, each of which had its own culture, schedule, and personnel structure. When the research team had control over session design, there was a persistent internal pressure to compress instruction and accelerate to gameplay. This urgency sometimes compromised instructional depth.
Sessions followed a general structure: a brief whole-group instructional phase, followed by breakout play. Variation from this structure occurred when a cybersecurity expert on the team was present, at which point sessions shifted toward live computer demonstrations of hacking techniques and cybersecurity scenarios. While these demonstrations were engaging, they diverted attention from the CySEC card game itself and shifted the focus of the session away from the game-based learning objectives that had motivated the project. The challenge of balancing broad cybersecurity education with specific game-based instruction was never fully resolved during the summer.
Communication emerged as a significant cross-cutting issue. Rogers (1995) noted that the communication channels of an innovation are inextricably linked to its success in context. Our experience strongly supported this claim.
At multiple sites, key stakeholders became unavailable without notice. A director at one center went out for paternity leave mid-program without introducing a replacement to the research team. A designated contact at another site had agreed to collect IRB consent forms from parents during afternoon pickup; this did not happen, resulting in the loss of many participants whose data could not be used. On the last day of one program, the day the research team had scheduled for post-testing, students were absent on a field trip. The research team had been present at that site for weeks and had no knowledge of the trip, despite having scheduled the post-test at the program’s outset.
The team also learned retrospectively that programming could have begun several weeks earlier at one site, but this opportunity was never communicated. In fact, on the first day at one site, front desk and security staff were completely unaware that the research team was expected, despite multiple prior conversations with the program director.
Several issues related to student relationships and social dynamics arose across sites. The most serious involved bullying. These included incidents of students mocking and hazing peers during sessions. These required immediate intervention and significantly disrupted the flow of play. Notably, the students most frequently involved in bullying behavior also had the best attendance, creating a recurring facilitation challenge that had to be addressed proactively rather than reactively.
The addition of new students to established sessions created unpredictable social dynamics. New arrivals disrupted established group norms, sometimes triggering bullying or social withdrawal among students who clustered with friends rather than continuing to engage with the game. Managing the dual demands of onboarding new students and sustaining momentum for returning students required constant negotiation.
There was also a notable pattern in how some female students responded to the game. Several expressed, in some form, that they did not personally find the game appealing but believed other children would. While the team did not collect formal gender demographic data and cannot draw strong conclusions, anecdotal observation suggested that the CCG format may have resonated differently across gender groups. This represents a meaningful area for future investigation in the design and implementation of game-based learning innovations.
Documenting the challenges we encountered tells only part of the story. Equally important, and perhaps more instructive for practicing designers, are the adaptive responses the team developed in real time. These responses were not anticipated in the original design but emerged from necessity and, in retrospect, represent some of the most substantive learning to come out of the project.
The unpredictable nature of student attendance, staff presence, and scheduling disruptions created what we came to call the “rhythm of chaos.” We used this term to refer to a condition marked by a steady undulation of new faces, absent regulars, and shifting logistics that could not be eliminated but could be designed around. Rather than continuing to plan sessions as though we would have a stable, consistent group, we shifted our approach to assume that each session would include unfamiliar participants and that we would need to onboard new students without penalizing or boring those who had attended before.
We developed short, self-contained warm-up activities that introduced the key card types and their cybersecurity meanings without requiring a full restart of instruction for returning students. We also began distributing hacker cards as take-home artifacts for students who could not sustain engagement during sessions. These cards served multiple purposes: they functioned as prizes, as mnemonic devices connecting students to cybersecurity vocabulary, and as seeds for identification with the hacker personas depicted on the cards. Even students who could not fully participate in the card game could carry the language and imagery of cybersecurity with them. This approach planted seeds for future engagement and helped nurture an emerging sense of identification with cybersecurity and computer science.
Local teachers and staff did not participate in the card game at any of the three centers. In all cases, their engagement was minimal. Some encouraged children to play at times but were largely absent from the instructional activity. Staff frequently disappeared from the site entirely during sessions, and in some cases so did directors. Rather than viewing this only as a deficit, the team eventually reframed it: staff absence meant greater freedom to adapt session content and structure without external scrutiny or interference. At the same time, the absence of support meant that all classroom management, logistics, and facilitation responsibilities fell entirely on the research team.
Our adaptive response was to arrive at each site with enough team members to provide the supervision and facilitation the sessions required without relying on center staff. We revised our expectations for staff involvement, treating any participation from site personnel as a bonus rather than an assumption. The lesson this generated for future work is clear: the staffing model and role expectations should be formalized in the partnership agreement with each site before implementation begins, and the research team should arrive resourced to operate independently.
A single planning email or meeting at the start of a program partnership is insufficient. We found it necessary to establish regular, multi-directional communication with site contacts, not only pushing information about upcoming sessions but actively soliciting information about the site’s schedule, events, and personnel. The specific questions we began asking regularly included:
• What activities are scheduled at this center this week?
• May we see the schedule for the next two weeks?
• Are there any special events taking place?
• Are there any unforeseen circumstances we should know about?
We also found value in identifying multiple communication contacts at each site rather than depending on a single individual whose availability might change without notice. The designation of a backup contact should be established at the outset of the partnership.
The literature on implementing innovations in educational settings is extensive (Durlak & DuPre, 2008; Fixsen et al., 2005; Meyers et al., 2012). However, as media formats for learning continue to evolve and as designers increasingly venture into informal, community-based, and out-of-school contexts, our ability to develop data-driven, practice-grounded guidance must evolve as well. Based on our experience implementing CySEC across three informal settings, we offer three interrelated lessons for instructional designers working with game-based approaches.
Implementing CySEC required constant adaptation, not only of peripheral logistical elements but of the game itself. We removed higher-order thinking cards that proved too cognitively demanding in the context of disruptive, time-compressed sessions. We narrowed the thematic focus to social phishing and attack scenarios that resonated more readily with students’ existing frames of reference. The number of players per game was adjusted based on the size and engagement level of the group present on any given day. These were not failures of the original design but necessary responses to the real conditions of implementation. Designers should anticipate that their innovation will need to adapt and should build structured mechanisms for doing so. Adaptivity should be treated as a design feature rather than a concession.
The frequency and unpredictability of disruptions during the CySEC implementation required the research team to develop a high tolerance for ambiguity, change, and disappointment. We found ourselves regularly frustrated by unexpected events in the implementation contexts. Over time, we came to understand flexibility not merely as a personal disposition to cultivate but as a design principle to embed. Designers working in informal contexts should build contingency plans, alternate activities, and “minimum viable session” designs that can be executed even when most conditions are working against the program. A session plan that depends on everything going right is not suited for informal learning environments.
Game-based learning requires time to understand the rules, time to assemble a deck, and time to play through a hand, fail, and try again. The time structures available in informal, out-of-school settings often work against this need. Compressed sessions, unpredictable interruptions, and competing program activities make it difficult to sustain the extended engagement that meaningful gameplay requires. We found it necessary to continuously adapt the pacing of our sessions, sometimes choosing depth over breadth, slowing down to allow genuine gameplay rather than rushing through a prescribed sequence of activities. Designers working in informal contexts should plan sessions that work at multiple time scales, capable of delivering value in 15 minutes when necessary but expandable when conditions allow.
This design case set out to tell the story of implementing a collectible card game to teach cybersecurity in informal, after-school settings. While CySEC as an instructional medium holds considerable promise that allows designers to relatively quickly and inexpensively simulate the habits of mind of hackers and cybersecurity professionals, implementing the project in out-of-school settings was fraught with hidden difficulties that demanded nuanced and flexible responses. The challenges we encountered cut across ecological, motivational, programming, communication, and relational dimensions, and no single strategy addressed them all.
What we found most valuable in retrospect was the learning that emerged from struggle. The rhythm of chaos, the fading of local staff, the communication breakdowns, and the unpredictable social dynamics were not simply obstacles to good implementation. They were data about the contexts in which instructional innovations must live. Instructional designers who venture into informal, community-based, or out-of-school settings should expect to encounter similar conditions and should design for resilience, not just effectiveness. We offer these lessons not as a prescription but as a practitioner’s reflection, shared in the hope that it may help others anticipate the unexpected and design more thoughtfully for the full range of conditions in which their innovations will be asked to perform.
This work was supported by the National Science Foundation Grant #1623267.
EdTech Archives