Business Commons^™

Optimising Cybersecurity Application Utilisation For Digital Learning In Nigeria: An Evidence-Constrained Hybrid Agent-Based And System-Dynamics Model, Adesegun Nurudeen Osijirin, Leonard C. Anigbo, Oliver Okechukwu

Journal of Cybersecurity Education, Research and Practice

This study examines hypothetical cybersecurity-application utilisation interventions for Computer Science undergraduates in Enugu State, Nigeria. Five author-supplied datasets, each containing 364 cases, provide audited sex-specific calibration moments for a hybrid agent-based and system-dynamics model. Seven portfolios are compared over 24 months using 400 paired replications; additional experiments examine dose, effect assumptions, targeting, academic calendars, turnover and peer structure. A 1,200-point Latin-hypercube design is applied to every original scenario. Across 37,600 runs, the main-model median proportions meeting the survey utilisation criterion are 26.4%, 48.6% and 50.3% for status quo, universal combined and equity-adaptive provision. However, matching nominal dose reduces the corresponding …

From Shadow It To Shadow Ai: A Scoping Review Of How Embedded Ai And Employee Use Increase Cybersecurity And Data Privacy Risk, Jenny Ahn, Bogdan Pavlyuchenkov, Lasette Smith, Paul Wagner, Robert J. Honomichl, Ryan Straight, Shengjie Xu

Journal of Cybersecurity Education, Research and Practice

The rapid integration of artificial intelligence into enterprise software has introduced a critical governance challenge: Shadow AI, the unmanaged and often invisible adoption of AI tools and features by employees outside formal IT oversight. Unlike traditional Shadow IT, which centers on unauthorized data storage and infrastructure, Shadow AI operates at the knowledge and decision-making layer, introducing probabilistic risks including data leakage, agentic misalignment, and indirect prompt injection that existing security frameworks are ill-equipped to address. This paper presents a Systematic Literature Review (SLR) synthesizing 38 peer-reviewed and industry sources to investigate three research questions: how organizational visibility gaps into embedded …

Quantifying Attacker Payoff In Harvest Now, Decrypt Later Attacks: A Persistence-Based Framework For Trade Secret Risk, Arjun Kumar, Gene Yang, Turiya Misra, Francis Kagai

Journal of Cybersecurity Education, Research and Practice

Harvest-now, decrypt-later (HNDL) assumes that encrypted secrets stolen today will remain worth decrypting when quantum computers eventually make that possible. But what if they do not? This paper models HNDL from the attacker’s perspective by asking a different question: how much will a stolen secret still be worth when it can finally be decrypted? We develop a conditional retained-value framework combining probabilistic Q-day timing, information depreciation, and adversary-access delay. The results reveal a sharp divide. Rapidly depreciating secrets can lose much of their strategic value before quantum decryption becomes useful, while persistent secrets can retain substantial attacker payoff even under …

Data Without Borders, Sovereignty Without Guarantees: Cybersecurity Risks Of Cross-Border Data Hosting In The Global South, Evidence And Policy Lessons From Mozambique, Faztudo Languisse Eng.

Journal of Cybersecurity Education, Research and Practice

The digital transformation of public and private institutions across the Global South has produced a paradox: as states digitize government services, financial systems, and citizen records, an increasing share of this data is hosted on servers physically located in the United States, the European Union, and other developed economies. This article develops a taxonomy of the cybersecurity and sovereignty risks generated by this dependency, distinguishing deliberate risks, arising from extraterritorial legal instruments such as the United States CLOUD Act, foreign surveillance regimes, and a concentrated hyperscale cloud market, from non-deliberate risks, arising from undersea cable failures, hyperscaler outages, misconfiguration, and …

Specification And Internal Assessment Of A Self Reported Protective Application Use Composite Among Computer Science Undergraduates In Enugu State Nigeria, Adesegun Nurudeen Osijirin, Leonard C. Anigbo, Oliver Okechukwu

Journal of Cybersecurity Education, Research and Practice

This study specifies a Protective Application Use Composite restricted to self-reported protective application use. A cross-sectional survey provided 364 complete records from Computer Science undergraduates at four universities in Enugu State, Nigeria, from 393 distributed questionnaires. The score is the equal-weight average of five questionnaire categories: antivirus, firewall, encryption, multi-factor authentication, and virtual private network use. Reanalysis of the author-supplied item records yielded category means from 2.097 to 2.376 and internal-consistency coefficients from 0.958 to 0.971. The composite mean was 2.170, with a standard deviation of 0.469. The first component of the category-score correlation matrix explained 50.98 percent of variance. …

Markets For Unverified Capability: Why Organizations Facing Real Adversarial Scrutiny Reject The Metrics Academic Ai-Security Research Relies On, Babar Khan Akhunzada

Journal of Cybersecurity Education, Research and Practice

Governments, insurers, and defenders increasingly rely on published capability claims about AI cybersecurity agents to inform procurement, regulation, and risk assessment. Yet a striking pattern runs through the organizations with the most at stake: enterprises and technology companies deploying frontier AI agents against real production infrastructure consistently decline to publish the accuracy metrics that academic and vendor benchmarks compete to report. This paper investigates that pattern as an economic, organizational, and policy problem rather than a purely technical one. We audit eleven independently published AI cybersecurity benchmarks and deployments using a five-dimension integrity rubric and find that benchmarks relying on …

The Digital Responsibility Index: Quantifying Perceived Multi-Layered Responsibility In Cybersecurity, Mircea Ţălu

Journal of Cybersecurity Education, Research and Practice

In the evolving digital landscape, cybersecurity responsibility extends beyond technical safeguards to include individual behavior, organizational governance, and societal impact. This study introduces the Digital Responsibility Index (DRI), a novel metric that quantifies multi-layered accountability across four domains: technical, individual, organizational, and societal. Data were collected through scenario-based Likert-scale surveys with 120 cybersecurity professionals, supplemented by semi-structured interviews with senior leaders. Results reveal that while technical and organizational responsibilities are consistently prioritized, individual and societal accountability remain under-recognized. Leadership engagement significantly enhances responsibility scores across all layers. The proposed DRI framework provides a measurable and potentially actionable basis for assessing …

Ai-Generated Phishing Attacks: Emerging Threats And Detection Strategies For Security Operations Centers, Bahzad Khalid

Journal of Cybersecurity Education, Research and Practice

Artificial intelligence (AI) is transforming cybersecurity by strengthening defensive capabilities while simultaneously enabling more sophisticated phishing attacks. AI generated phishing emails increasingly evade traditional detection methods through improved grammar, contextual relevance and realistic communication styles creating significant challenges for Security Operations Centers (SOCs). This study investigates the effectiveness of current email security systems in detecting AI generated phishing emails compared with traditional phishing emails. A mixed method experimental approach was employed using controlled Gmail and Outlook environments to evaluate the detection and classification of multiple phishing scenarios. The results demonstrate that several AI generated phishing emails successfully bypassed initial security …

A Narrative-Driven, Socratic Instructional Framework For Teaching Adversarial Cognition In Cybersecurity, Joshua K. Goossen

Journal of Cybersecurity Education, Research and Practice

The Socratic method has demonstrated, in studies across law, medicine, and nursing, that dialectic structured questioning improves expert reasoning. Cybersecurity currently teaches tools and techniques but lacks Socratic dialogic leaving graduates underprepared for novel scenarios requiring cross-domain reasoning. Because law, medicine and nursing cultivate similar reasoning as security there is principled reason to expect reasoning benefits could transfer to security students. This paper argues that the correspondence warrants investigation. Investigation requires a named, teachable reasoning target analogous to clinical reasoning and we specify that target as adversarial cognition, a framework integrating adversary features, system architecture, implementation logic, governance structure, human …

From Consumers To Makers: A Community-Based Model Of The Diy Food And Beverage Kit Ecosystem, Mark Mitchell, Richard Martin, Sheila Mitchell

Atlantic Marketing Journal

The market for do-it-yourself (DIY) food and beverage kits continues to expand as consumers seek experiences that combine convenience, learning, creativity, and participation. This conceptual paper proposes a four-community ecosystem model consisting of consumers, makers, marketers, and consumption communities. Drawing on value co-creation, prosumption, experiential consumption, and diffusion of innovation theories, the model suggests that participation in DIY production transforms consumers into makers, fosters a maker identity, and encourages engagement in product-category consumption communities. Through sharing experiences and outcomes, participants attract new consumers into the marketplace, creating a self-reinforcing cycle of growth. The framework extends value co-creation theory by explaining …

Brand Gravity And Instant Adoption: Consumer Visitation, Loyalty, And Trip Chaining Following The Entry Of A New National Coffee Chain, Mark J. Sciuchetti Jr., Jianping Huang

Atlantic Marketing Journal

This study examines how consumers adopt a strong national brand immediately after its entry into a small regional market. Using anonymized mobile location data from the first twenty-nine weeks of a new Starbucks location in Anniston, Alabama, the analysis evaluates weekly visitation, repeat behavior, visitor origin distance, trip chaining, and temporal demand. The store opened above its subsequent steady state, indicating activation of preexisting demand rather than a gradual diffusion process. Repeat visitors generated 82.6% of visits within the observation window, showing rapid movement from trial to habitual use. The entrant also exhibited a flatter distance decay gradient than adjacent …

Where Shoppers Look First: How Navigation Bar Design Shapes Visual Attention Online, James Coyle, Linh Nguyen, Lee Hillman

Atlantic Marketing Journal

Abstract

Despite the crucial role that a website navigation bar can play in affecting consumer behavior, there has been a lack of theory-driven studies to investigate how to most effectively design navigation bars. Grounded in cognitive fit theory and visual attention theory, this study investigates how the effects of navigation bar design and content can influence visual processing of an unfamiliar online retailer’s website. A total of 40 subjects participated in a controlled experiment in which we gathered eye-tracking data. We find that navigation bar placement strongly affects how quickly participants locate the navigation bar: an unexpected placement more than …

Reducing Cognitive Load To Strengthen Customer Engagement: The Strategic Role Of Digital Tools, Neda Mossaei, Maryam Tofighi

Atlantic Marketing Journal

This paper examines how advanced technological interfaces, particularly chatbots and augmented reality, influence customer engagement by reducing the cognitive effort required to interact with firms. As digital tools become increasingly embedded in everyday life, companies are leveraging these technologies to streamline communication, personalize experiences, and foster long-term relational outcomes. Guided by cognitive load theory, this study argues that minimizing mental effort in customer–firm interactions improve engagement by making interactions more seamless and intuitive. At the same time, relationship marketing theory emphasizes that reducing cognitive barriers can cultivate customer engagement, trust, and loyalty over time. Together, these perspectives suggest that implementing …

Designing For Who Actually Shows Up: A Signal Framework For Online Adult Learners In Cybersecurity And Information Technology, Chad Whistle, Mayyada Al-Hammoshi

Journal of Cybersecurity Education, Research and Practice

Online adult learners pursuing cybersecurity and information technology credentials represent one of the fastest-growing student populations in American higher education, yet the frameworks institutions use to support their success were not designed for them. This population, disproportionately drawn from the 41.9 million Americans who hold some college credit but no credential, arrives workforce-embedded, time-constrained, and skeptical of institutional systems that previously failed to serve them. Existing persistence models grounded in traditional student integration theory inadequately account for the behavioral patterns, motivational structures, and credential expectations that define this learner. This paper proposes the SIGNAL Framework (Skills-based credential architecture, Integrated AI-informed …

Between Digital Transformation And Regulatory Vacuum: Cybersecurity Of Public Services In Mozambique, Faztudo Languisse Eng.

Journal of Cybersecurity Education, Research and Practice

The rapid expansion of digital public services in Mozambique—including e-government platforms, digital health systems, and electronic tax administration—has outpaced the development of a coherent legal framework for cybersecurity. While Law No. 3/2017 (Electronic Transactions Law) of 9 January 2017 introduced foundational data-protection principles, Mozambique long lacked a dedicated cybersecurity regulatory authority, mandatory security standards, and formal incident-notification mechanisms. This regulatory vacuum exposed critical public services to escalating cyber risks as digital transformation was actively promoted as a development priority. This article examines the legal and institutional gaps in Mozambique's cybersecurity governance framework prior to the 2026 Cybersecurity and Cybercrime Laws, …

Clinic-In-A-Box: A Portable, Software-Defined Cyber Range For Realistic, Scenario-Based Cybersecurity Training, Ethan Chumley, Aaron Nair, Royce Yaezenko, Joshua Payne, Veronika Kyles, Paul Wagner, Robert J. Honomichl, Ryan Straight, Shengjie Xu

Journal of Cybersecurity Education, Research and Practice

Realistic, hands-on cybersecurity training has traditionally depended on fixed infrastructure such as dedicated lab hardware, cloud subscriptions, or permanent network connectivity, limiting where and how often it can be delivered. This paper presents the design and implementation of a portable, scenario-based cybersecurity training platform housed in a single travel case and built from commodity hardware, type-1 hypervisor virtualization, containerized service orchestration, and software-defined networking. The platform clones, isolates, and resets complete lab environments on demand, allowing the same physical system to support repeated classroom, workshop, or field deployments with minimal manual reconfiguration. Training scenarios are grounded in generated organizational profiles …

Self Efficacy And Instructional Support Predict Cyber Deception Acceptance In Ics And Ot Cybersecurity, Daniel Ward

Journal of Cybersecurity Education, Research and Practice

Cyber deception can produce high-confidence evidence of unauthorized activity in industrial control systems (ICS) and operational technology (OT), but practitioners must consider the technology useful, safe, understandable, and supported before they will use it. This study reports a secondary quantitative analysis of a deidentified survey of United States-based ICS and OT professionals to determine whether psychological and instructional factors predict adoption readiness and effective utilization beyond education, experience, and sector. Hierarchical ordinary least squares regression with HC3 robust standard errors was conducted on 262 complete cases. The demographics-only model was not significant and explained 2.8 percent of outcome variance. Adding …

Opengrcrmf: A Vendor-Neutral Framework For Teaching And Modeling Rmf Automation, Continuous Authorization, And Zero Trust Governance, Anand Janjal

Journal of Cybersecurity Education, Research and Practice

Abstract—Federal and regulated organizations continue to rely on document-centric Authorization to Operate (ATO) processes even as the NIST Risk Management Framework (RMF), continuous monitoring guidance, Zero Trust Architecture (ZTA), and continuous authorization initiatives require more continuous, evidence-driven risk management [1]-[3], [13], [15]. Manual System Security Plan (SSP) updates, spreadsheet-based Plan of Action and Milestones (POA&M) tracking, and disconnected assessment evidence create governance latency: the delay between operational security events and authorization-ready governance response. This paper presents OpenGRCRMF, a proposed open, vendor-neutral reference framework that models RMF lifecycle activities as workflow states, treats authorization artifacts as structured governance objects, and …

Personal Authenticity For Engagement And Transfer In Introductory Cybersecurity Education, Daniel T. Hickey, Ronald J. Kantor

Journal of Cybersecurity Education, Research and Practice

Abstract—This conceptual/theoretical paper explores how personal authenticity might promote generative learning in introductory cybersecurity courses. Generative learning transfers confidently to future educational, professional, personal, and testing situations. This cycle of design-based research addresses the concern that more typical professionally authentic contexts (e.g., hospitals, banks, etc.) may be alien and overwhelming to many students, particularly those in introductory courses and/or from non-professional families and communities. If so, this leads to “inert” knowledge that does not transfer. Personal authenticity is rooted in expansive framing, a modern theory of learning transfer. We reframe expansive framing as personal authenticity to make it …

From Disruption To Replacement: The 2026 Cae Cybersecurity Community Symposium And The Emerging Federal-Academic Compact For An Ai Workforce, Sunday Oludare Ogunlana

Journal of Cybersecurity Education, Research and Practice

The cybersecurity workforce gap in the United States is estimated at several hundred thousand unfilled positions, and the rapid integration of artificial intelligence into adversary tradecraft and federal cyber operations is widening that gap qualitatively as well as quantitatively, threatening national security and the operational readiness of graduates entering the field. This perspective article synthesizes the principal arguments advanced by five federal and academic speakers at the 2026 CAE Cybersecurity Community Symposium, using verbatim session transcripts, a structured thematic extraction process, and triangulation against published workforce policy and peer-reviewed literature. Findings document a unified speaker thesis that artificial intelligence now …

A Return On Investment (Roi) Evaluation Tool For Quantifying The Value Of Cybersecurity Certifications, Nicolas Meysmans, Kelly Hughes

Journal of Cybersecurity Education, Research and Practice

The growing reliance on cybersecurity certifications has increased the financial and professional stakes associated with certification decision-making for cybersecurity professionals. Despite their widespread use in hiring and career advancement, there is limited objective guidance available to help individuals evaluate the return on investment (ROI) of specific certifications. This gap has created uncertainty regarding which credentials provide the greatest value relative to their cost and market impact. This study presents a data-driven, design science–based tool that supports cybersecurity professionals in evaluating certification ROI using practitioner survey data combined with certification cost and labor-market demand indicators. The paper also demonstrates how such …

Beyond Procedural Participation: A Process Perspective Of Disability-Inclusive Digital Innovation, Millicent Agangiba, David Aboagye-Darko, Salah Kabanda, William Agangiba, Ralitsa Diana Debrah

African Conference on Information Systems and Technology

While previous research has recognized the importance of participation, how the structurally embedded inclusion of PWDs reshapes digital innovation processes and their outcomes in resource-constrained contexts remains underexplored. The study addresses this gap through a longitudinal qualitative case study of a five-year recurring hackathon organized in Ghana from 2021 to 2025, with a focus on disability inclusion. Drawing on Adaptive Structuration Theory as an analytical lens, normatively supported by critical disability studies, this study analyzes the qualitative interview and observation data from 20 participants. The results reveal that inclusion is a structuring force through four interrelated mechanisms: (1) lived experience …

Big Data Analytics Strategy Formulation In South African Organisations, Never Kondo, Maureen C. Tanner

African Conference on Information Systems and Technology

The main goal for organisations investing in big data analytics (BDA) is to derive business value. However, most organisations struggle to gain a competitive advantage from BDA insights. As a result, top management continues to grapple with pervasive BDA issues that they find difficult to comprehend. This research explores the foundational components that inform the formulation of a BDA strategy for organisations in South Africa. The research followed a general inductive approach through a multiple-case study of two South African BDA organisations. The findings revealed 5 components that inform the formulation of a BDA strategy. In particular, organisations require well-articulated …

Proposing An Electronic Government Procurement Conceptual Framework For African Governments, Tichaona Chinyerere, Walter F. Uys

African Conference on Information Systems and Technology

Electronic Government Procurement (e-GP) significantly contributes to the economic growth of African Economies (AEs). However, many e-GP projects fail due to a disconnect between the initial design assumptions and real-world conditions. Guided by Hevner's (2004) Design Science Research (DSR) approach, the research is rooted in Information Systems Design Theory (ISDT). The methodology involves a two-layered analysis: descriptive and prescriptive, using abductive reasoning to link real-world conditions with the theoretical insights. The analysis was conducted in three phases: Informing (assessing context readiness), Designing (iterative development), and Explaining (causal reasoning and theoretical contribution). The ASTI framework offers Design and Action Theory centered …

Artificial Intelligence And Marginalised Enterprises: A Systematic Literature Review, Rahinatu Haruna, Muftawu Dzang Alhassan, Isahaque Mahama

African Conference on Information Systems and Technology

The rapid diffusion of artificial intelligence (AI) technologies across economic sectors has intensified debate about whether such innovations exacerbate or alleviate structural inequalities, particularly for actors excluded from mainstream economic systems. Marginalized enterprises, including micro, small and medium enterprises operating in informal economies, occupy a structurally vulnerable position in digital transformation. Despite growing scholarly attention, limited attempts have been made to synthesize the body of knowledge specifically at the intersection of AI and marginalized enterprises. As such, this paper fills this gap by developing a comprehensive framework that synthesises and provides an overall direction of AI-marginalized enterprise (AI-ME) research, pointing …

Assessing Factors Affecting User Satisfaction With Health Information Technology: A Case Study Of Komfo Anokye Teaching Hospital Of Ghana, Braimah Wadudu, Augustine Kwame Acheampong, Kwame Boateng Opoku Agyeman, Aku Humphery-Ackumey, Phyllis Sakyiwaa Anning, Vida Asante, Abubakar Essilfie, Lawrence Amakye Jnr

African Conference on Information Systems and Technology

Health information technology (HIT) is central to modern healthcare, yet its value depends on user satisfaction with system performance, support services, and institutional commitment. At Komfo Anokye Teaching Hospital (KATH), the Lightwave Health Information Management System (now GHIMS) has transformed workflows, but frontline user experiences remain underexplored. This study assessed factors influencing user satisfaction with HIT and examined how satisfaction affects job performance. A quantitative survey instrument was administered to sample 352 staff at KATH. System quality, service quality, and top-management support were all significant predictors of user satisfaction. System quality had the strongest effect, followed by service quality and …

Design And Evaluation Criteria For Community-Based Ict4d Artefacts, Tinaye Tanatswa Mushore, Gwamaka Mwalemba

African Conference on Information Systems and Technology

The widespread use of Information and Communication Technologies (ICTs) worldwide has underscored the importance of research initiatives in Information and Communication Technologies for Development (ICT4D). It has become crucial to understand the extent to which ICTs contribute to development, particularly for relatively disadvantaged members of society, given the persistent inequality despite technological advancements. However, many ICT4D projects launched to address challenges in multidisciplinary contexts suffer chronic failure rates, often linked to researchers' limited understanding of and consideration for local conditions and the contexts in which the projects are intended. This study proposes design and evaluation criteria that embed ICT4D guidelines …

Predicting Agile Success: The Critical Few Factors, Ridewaan Hanslo, Maureen Tanner

African Conference on Information Systems and Technology

While Agile projects are more successful than traditional software development project management approaches, their overall success rate remains relatively low, with a high percentage of projects still deemed challenged or failed. This low project success rate is attributed to projects not being rigorously evaluated against critical success factors (CSF) of Agile projects and contemporary project success criteria. To identify the CSF that contribute to Agile software development project success as perceived by Agile practitioners, this study used a positivist approach to investigate the CSF of Agile software development projects. PLS-SEM with SmartPLS was used to analyse the data and test …

The Role Of Organisational Culture In Implementing Cybersecurity Practices To Address Insider Threats In South Africa, Thamsanqa Ngcobo, Salah Kabanda, Ronald Chiwariro

African Conference on Information Systems and Technology

Cybersecurity is a critical component of organisational resilience as digital transformation reshapes operations and risk management. Despite substantial investment in technical controls, insider threats remain a persistent challenge, shaped as much by cultural and organisational factors as by technology. This study examines how cultural factors influence the implementation of cybersecurity practices aimed at mitigating insider threats in South African organisations, considering national, organisational, and individual dimensions. Using a qualitative research design, semi‑structured interviews were conducted from nine participants working across a range of industries including ICT consulting, financial services, IT services, gaming, telecommunications, pharmaceuticals, and IT managed services. The findings …

Factors Hindering E-Procurement Adoption In South African State-Owned Enterprises: A Scoping Review, Lumka T. P. Salamntu, Zintle Ntlokwana

African Conference on Information Systems and Technology

e-Procurement is a digital management system that oversees the entire purchasing process, encompassing acquisition, procurement, and payment. e-Procurement aims to enhance efficiency, minimise redundancies and reduce paper-based processes. In South Africa, State-Owned Enterprises (SOEs) view e-Procurement as a strategic tool used to optimise processes, improve efficiency, accountability and transparency. This study followed a scoping review protocol and analysed eighteen articles which were written in the English language. The Rayyan screening software was used to screen and manage articles during the selection process. A search strategy was developed, and the search was conducted across four electronic databases from 2020 to 2025 …