Cybersecurity Training and Behavioural Risk in Higher Education: A Mixed-Methods Study with Benchmarked Predictive Modelling
Year: 2026
Type: article
Abstract: Cybersecurity awareness and training programmes are widely implemented in higher education institutions, yet their association with employees’ behavioural risk remains insufficiently quantified. Using an explanatory sequential mixed-methods design, this study analysed survey responses from 167 faculty, staff and managers in United Arab Emirates higher education institutions and 22 semi-structured interviews. Behavioural risk was operationalised as a 0–100 score derived exclusively from five self-reported secure-behaviour items, so that no predictor contributed to the outcome. Respondents who reported attending institutional training had substantially lower behavioural risk than those who had not (13.4 vs. 40.8; Hedges’ g = 1.07), and training exposure explained 15.2% of additional variance after controlling for role. This association was transmitted through policy knowledge (indirect β = −0.52, 95% CI [−0.69, −0.35]) and was not independent of perceived cybersecurity culture and technical readiness; culture did not moderate it. In leakage-safe repeated cross-validation, simpler models predicted behavioural risk better (support vector regression, R2 = 0.73) than the proposed deep feedforward network (R2 = 0.28). Interviews described absent, optional or awareness-only training and a weak, compliance-oriented culture. Training appears to be associated with lower risk chiefly through policy knowledge, within a broader institutional security climate.
Source: Computers
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
SDG: Quality education
Open Access status: gold
Estimated APC paid: $2,172
OpenAlex ID: W7213556294