Management Information Systems Commons^™

From Shadow It To Shadow Ai: A Scoping Review Of How Embedded Ai And Employee Use Increase Cybersecurity And Data Privacy Risk, Jenny Ahn, Bogdan Pavlyuchenkov, Lasette Smith, Paul Wagner, Robert J. Honomichl, Ryan Straight, Shengjie Xu

Journal of Cybersecurity Education, Research and Practice

The rapid integration of artificial intelligence into enterprise software has introduced a critical governance challenge: Shadow AI, the unmanaged and often invisible adoption of AI tools and features by employees outside formal IT oversight. Unlike traditional Shadow IT, which centers on unauthorized data storage and infrastructure, Shadow AI operates at the knowledge and decision-making layer, introducing probabilistic risks including data leakage, agentic misalignment, and indirect prompt injection that existing security frameworks are ill-equipped to address. This paper presents a Systematic Literature Review (SLR) synthesizing 38 peer-reviewed and industry sources to investigate three research questions: how organizational visibility gaps into embedded …

The Digital Responsibility Index: Quantifying Perceived Multi-Layered Responsibility In Cybersecurity, Mircea Ţălu

Journal of Cybersecurity Education, Research and Practice

In the evolving digital landscape, cybersecurity responsibility extends beyond technical safeguards to include individual behavior, organizational governance, and societal impact. This study introduces the Digital Responsibility Index (DRI), a novel metric that quantifies multi-layered accountability across four domains: technical, individual, organizational, and societal. Data were collected through scenario-based Likert-scale surveys with 120 cybersecurity professionals, supplemented by semi-structured interviews with senior leaders. Results reveal that while technical and organizational responsibilities are consistently prioritized, individual and societal accountability remain under-recognized. Leadership engagement significantly enhances responsibility scores across all layers. The proposed DRI framework provides a measurable and potentially actionable basis for assessing …

Ai-Generated Phishing Attacks: Emerging Threats And Detection Strategies For Security Operations Centers, Bahzad Khalid

Journal of Cybersecurity Education, Research and Practice

Artificial intelligence (AI) is transforming cybersecurity by strengthening defensive capabilities while simultaneously enabling more sophisticated phishing attacks. AI generated phishing emails increasingly evade traditional detection methods through improved grammar, contextual relevance and realistic communication styles creating significant challenges for Security Operations Centers (SOCs). This study investigates the effectiveness of current email security systems in detecting AI generated phishing emails compared with traditional phishing emails. A mixed method experimental approach was employed using controlled Gmail and Outlook environments to evaluate the detection and classification of multiple phishing scenarios. The results demonstrate that several AI generated phishing emails successfully bypassed initial security …

Mitigating Common Vulnerabilities And Exposures In Cobol-Based Critical Systems Using The Strangler-Fig Pattern, Lauren E. Caruso, Vincent J. Compeau, Assefaw H. Gebremedhin

Military Cyber Affairs

COBOL-based legacy systems continue to underpin critical infrastructure in banking and government sectors despite their age and associated cybersecurity risks. Originally developed through a Department of Defense–sponsored initiative to standardize business computing, COBOL remains widely used in mission-critical environments. However, these systems face increasing vulnerabilities due to outdated security architectures, workforce shortages, and rising maintenance costs. This paper examines cybersecurity and operational challenges associated with COBOL systems and evaluates the Strangler Fig pattern as a modernization strategy that enables incremental replacement while maintaining continuity. The findings highlight implications for financial institutions and public-sector organizations dependent on legacy infrastructure.

Case Study: Feasibility Of Creating A Simulated Mobile Data Center For Cross-Disciplinary Academic Programs, Stanley Mierzwa, Christoper J. Schultz, Iassen Christov, Michael Fagioli, Thomas Ikeda, Reinaldo Jaramillo, Giolian Sanagustin

Center for Cybersecurity

This case study examines the potential to envision, create, and deploy a simulated mobile micro data center solution that can be easily replicated and transported between locations and educational settings. The coined term for this solution is the Mobile AI-Centered Data Center (Mobile ACDC), which provides students with a platform to construct, in a hands-on fashion, such a solution and navigate the product to gain greater competencies and understanding of the components found in a data center. Instructor and student feedback assessments from the pilot classroom modules and laboratory experiential learning activities indicate that such a solution helps to improve …

The Nist Artificial Intelligence Risk Management Framework: Adoption Challenges And Opportunities, Gillian Kennedy, Devin Patel, Humza Sheikh, Paul Wagner, Robert J. Honomichl

Journal of Cybersecurity Education, Research and Practice

Artificial intelligence (AI) is being adopted at an exponential rate to improve efficiency, decision-making, and cybersecurity, but its rapid integration introduces new and often poorly understood risks, including system errors, algorithmic bias, data privacy concerns, security vulnerabilities, and ethical dilemmas. This paper examines how organizations are implementing AI and evaluates the National Institute of Standards and Technology's AI Risk Management Framework (NIST AI RMF) as a tool for managing these risks. It reviews the benefits of AI adoption alongside the risks emerging from its use in business and broader society and examines the legal and ethical challenges organizations face when …

The Intersection Between Mindfulness And Cybersecurity: A Tool To Reduce Burnout And Improve Operational Effectiveness, Ivo Ricardo Dias Rosa

Journal of Cybersecurity Education, Research and Practice

Abstract: This paper offers a conceptual discussion of how mindfulness, understood as present moment awareness and deliberate attention regulation, can support cybersecurity professionals. Drawing on a narrative synthesis of workplace mindfulness, burnout, and high pressure decision making literature, we map plausible self regulation mechanisms to typical cyber defense tasks. Rather than presenting new empirical data, we develop an explanatory framework linking attention, reactivity, and recovery to decision quality, team communication, and adherence to incident playbooks. We focus on two connected outcomes: reducing burnout in roles with sustained cognitive and emotional demands, and improving operational effectiveness during critical situations such as …

Cyber-Ready Libraries, Building Digital Fortresses For Tomorrow, Adeyinka B. Tella, Oluchi Precious Ogbonna Dr, Adebola Aderemi Olatoye Mrs

Journal of Cybersecurity Education, Research and Practice

Background and Purpose: Libraries are evolving into highly networked information ecosystems in this age of fast digital transformation, which increases their susceptibility to cybersecurity risks. The study "Cyber-Ready Libraries: Building Digital Fortresses for Tomorrow" looks into how prepared libraries are to face cyber threats and considers methods for creating information systems that are safe, robust, and ready for the future. To safeguard digital assets and user data, the study aims to assess existing cybersecurity practices in library settings and offer a roadmap for combining technological, human, and governance solutions.

Design/Method: The existing literature, case studies, and policy frameworks pertaining …

Trends In Non-Profit Cybersecurity: Analyzing Three Years Of Incident Data From The Npcir, Stanley Mierzwa, Joanna Paliszkiewicz, Edyta Skarzyńska

Center for Cybersecurity

This study analyzes cyberattack trends targeting non-profit organizations using longitudinal data collected over a three-year period within the Non-Profit Cybersecurity Incident Repository (NPCIR). Developed through a National Security Agency Center of Academic Excellence in Cyber Defense (NSA CAE-CD) designated center, the NPCIR applies an open-source intelligence (OSINT) methodology to systematically document cybersecurity incidents affecting the global non-profit sector. This study examines attack types, threat actor characteristics, sectoral distribution, and cybersecurity impacts using the Confidentiality–Integrity–Availability (CIA) triad framework. The results indicate that availability-related incidents, particularly ransomware and distributed denial-of-service (DDoS) attacks, constitute the most prevalent threats, while confidentiality breaches remain highly …

Trust And Pre-Employment Background Checks When Onboarding And Maintaining Information Security And Cybersecurity Staff, Stanley Mierzwa

Center for Cybersecurity

The realm of trust is broad and can include many facets that are difficult to capture and catalog. In relation to the work roles of information security and cybersecurity, the intersection of trust in human resource management is critical and an evolving area within most modern organizations, in almost any sector, and of any size. A foundational element of trust is fundamental to effective mission and work roles in information security and cybersecurity, as well as to every employee tasked with contributing to the security of an organization’s assets. This chapter will include sections on the role trust can and …

Adopting Artificial Intelligence: Cross-Sector Analysis Of Ai Adoption Risks, Brandon Saari, Yona Berger, Yanett Munoz, Alex Agnick, Paul Wagner, Robert J. Honomichl

Journal of Cybersecurity Education, Research and Practice

Artificial intelligence (AI) is rapidly being adopted across public and private sectors. This offers significant gains in efficiency, decision making, and access to information. At the same time, AI introduces complex risks related to cybersecurity, privacy, bias, transparency, accountability, and equity that existing governance and security frameworks do not fully address. This paper presents a cross-sector literature review and comparative analysis of AI adoption risks and mitigation strategies across four critical domains: the federal government, libraries, K–12 education, and healthcare. Drawing on peer-reviewed research, institutional frameworks, and policy guidance, the study identifies sector-specific challenges alongside shared systemic gaps, including insufficient …

Research Days: Case Study: Creation Of A Student-Driven Radio Talk Show To Answer Cybersecurity Questions And Concerns To Boost Power Skills, Joel Leiva, Anthony Bayate, David Abiandu, Keith Fernandez

Center for Cybersecurity

Power skills are essential in any professional career. Oftentimes, college students don’t feel prepared enough to enter the workforce. Having good power skills in a group can greatly increase production and efficiency. This case study aims to develop these power skills in a group of college students through the creation of a student-driven radio talk show answering cybersecurity questions and concerns. A qualitative approach was used via the creation of the C.Y.B.E.R. radio show. This show enhanced the participants’ power skills such as collaboration, teamwork, and communication skills. The findings from this case study prove the alternate hypothesis of boosting …

Cyber Science Education Meets Healthcare Technology, Angela Spencer

Journal of Cybersecurity Education, Research and Practice

The research investigates how cyber science education combines with healthcare technology during the digital age to resolve a fundamental research gap in these two advancing areas. A combined approach utilizing extensive surveys and detailed interviews evaluates the functionality of learning platforms as well as cybersecurity measures and potential uses of emerging virtual reality (VR) and augmented reality (AR) tools to improve both educational and clinical environments. The research document describes its methodologies thoroughly while. The research documents multiple quantitative and qualitative results before performing its analysis, which leads to strategy development for digit. The researchers worked to find ways that …

Using It And Accounting Education Pedagogy To Address Smaller Firms' Cybersecurity Concerns, Darlene A. Adkins, William Lyle, Walter Smith

The North American Accounting Studies

This study begins by exploring the cybersecurity activities and practices of small public accounting firms. It also examined how a cross-disciplinary curriculum design could be useful to accounting programs that are challenged to integrate cybersecurity-related content while preserving the core accounting knowledge valued by smaller accounting firms. Through interviews with current practitioners from small and regional firms, the research investigated the extent to which cybersecurity concerns impact their practice, how cybersecurity activities are staffed, and the perceptions of current practitioners on the state of accounting education related to information technology (IT) and cybersecurity. The participants expressed a desire for accounting …

Higher Education Cybersecurity: A Vulnerability Assessment Of The U.S. South’S Institutional Websites, Zachary W. Taylor, Vivi Vo

Journal of Cybersecurity Education, Research and Practice

As technology continues to advance, it is critical to understand how higher education institutions protect digital information of their stakeholders including students, faculty, and staff through cybersecurity measures. Although conceptual research has articulated various aspects of cybersecurity, no empirical research has explored the cybersecurity of higher education (.edu) websites through a vulnerability scan of these websites via an open PortScan and analysis. To fill a critical gap in the literature, this study conducted a vulnerability scan and open PortScan and analysis of all higher education websites in three of the lowest-income states in the United States: Louisiana (n=112), Mississippi (n=52), …

Beyond The Classroom: Competition Competency Creates Cybersecurity Careers (5cs), Dan Manson, Morgan A. Zantua, Zoe L. Fowler

Communications of the IIMA

ABSTRACT

The demand for cybersecurity talent appears to be constantly growing^[1], but the statistics can be illusory. According to Wages and Employment Trends in ONET On-Line^[2] cybersecurity job openings are ranked as having a Bright Outlook, and on May 1 2025 Cyberseek listed 450,000 US job openings out of a workforce of 1.25 million. However, most entry-level cybersecurity jobs require several years of experience resulting in a mismatch between supply and demand. Despite a “hot job market”, recently minted cybersecurity college graduates without experience have a hard time securing their first “entry-level” because they don’t meet the …

The Impact Of Ai Use In Programming Courses On Critical Thinking Skills, Christian Jay St Francis Clarke, Abdullah Konak

Journal of Cybersecurity Education, Research and Practice

Proficiency in computer programming extends far beyond memorizing syntax; it depends on the cultivation of critical thinking. Computer programming requires multiple interconnected competencies, including systematic problem analysis, algorithmic reasoning, mastery of programming languages, debugging capabilities, a comprehensive understanding of software development methodologies, rigorous testing practices, and systematic troubleshooting approaches. These skills are also essential for cybersecurity experts; cybersecurity programs require several programming courses to enhance students’ technical and critical thinking skills. Generative AI (GenAI) technologies have fundamentally changed the process of developing applications and approaches to teaching coding. The growing use of GenAI technologies by students in writing computer code …

The Urgency Of Instituting Systemic Cybersecurity Curriculum Within Stem At Secondary Educational Levels In Preparation For Postsecondary Institutions., Robert Spencer

Journal of Cybersecurity Education, Research and Practice

Over the last 20 years, many secondary institutions have made advances developing curriculum defined as “STEM (Science, Engineering and Mathematics)” in order to ensure secondary students are eligible to apply as well excel in technology degree programs at the college and university levels. Although various initiatives exist, there are studies however, which allude to a great possibility that there will be a lack of cybersecurity professionals filling present day and anticipated future positions. Despite a large number of federal and educational enhancements there is need for additional research regarding instituting overall systemic processes and curriculum which supports secondary student transition …

Managing Cybersecurity In Local Governments: 2022, Donald F. Norris Phd, Laura K. Mateczun Jd

Journal of Cybersecurity Education, Research and Practice

This paper, based on data from our second nationwide survey of cybersecurity among local or grassroots governments in the U.S., examines how these governments manage this important function. As we have shown elsewhere, cybersecurity among local governments is increasingly important because these governments are under constant or nearly constant cyberattack. Due to the frequency of cyberattacks, as well as the probability that at least some attacks will succeed and cause damage to local government information systems, these governments have great responsibility to protect their information assets. This, in turn, requires these governments to manage cybersecurity effectively, something our data show …

Insights In Cybersecurity Of A Smart Campus - A Review, Mircea Ţălu

Journal of Cybersecurity Education, Research and Practice

The profound impact of the Internet of Things (IoT) on various fronts, is driven by technological advancements, the ubiquitous spread of information, and the emergence of transformative events. IoT presents a diverse array of possibilities within university environments, fostering a more connected and enhanced educational experience. This research undertakes a comprehensive review of existing literature to provide context to the IoT and underscore its crucial significance in the realm of smart campuses. Additionally, the paper explores the intricate connections between IoT and key concepts such as cybersecurity and wireless sensor networks to present a holistic perspective. It delves into the …

Watchdogs Or Lapdogs: How Audit Committees Influence Financial Reporting Quality And Cybersecurity, Yanru Yang

2025

With the increasing complexity of the business environment, the role of corporate governance and oversight is expanding continuously. Grounded in archival research, my dissertation consists of three studies that explore the features of audit committees in monitoring both financial reporting and broader areas, such as cybersecurity.

The first paper, co-authored with Gopal Krishnan and Wei Yu, examines the implications of audit committee (AC) director departure for financial reporting quality and audit risk. We find that the departures in the firms with most concerning AC departures are associated with a higher likelihood of a future “Big R” restatement announcement and auditor …

Digital Twin And Cybersecurity In Additive Manufacturing, Lidong Wang

Journal of Cybersecurity Education, Research and Practice

Additive manufacturing (AM) has been applied to automotive, aerospace, medical sectors, etc., but there are still challenges such as parts’ porosity, cracks, surface roughness, intrinsic anisotropy, and residual stress because of the high level of thermal gradient. It is significant to conduct the modeling and simulation of the AM process and achieve quality products. Digital Twin (DT) can help AM with forecasting defects/errors through simulation and real-time process monitoring. DT is a concept of Industry 4.0, and its digital structure reflects the real-time behaviors of a cyber-physical or physical system. This paper introduces the progress of DT applications in AM, …

Happy Hours, Not Office Hours: Socially Engaging Cybersecurity Students In A Large Online Graduate Course, James T. Mccafferty

Journal of Cybersecurity Education, Research and Practice

Engagement is a critical part of student learning and student success. This is especially true in online classes where students have less interaction with their classmates and instructors when compared to traditional face-to-face courses. Research on engagement has shown that when students are meaningfully engaged it can increase student satisfaction and it may also increase levels of academic achievement, including grades earned and degree progression (e.g. Wong et al., 2024). This paper focuses on social engagement in a graduate cybersecurity program that uses large, expandable online courses as described by Whitman and Mattord (2023). Large online graduate classes (i.e., more …

How State Universities Are Addressing The Shortage Of Cybersecurity Professionals In The United States, Gary Harris

Journal of Cybersecurity Education, Research and Practice

Cybersecurity threats have been a serious and growing problem for decades. In addition, a severe shortage of cybersecurity professionals has been proliferating for nearly as long. These problems exist in the United States and globally and are well documented in literature. This study examined what state universities are doing to help address the shortage of cybersecurity professionals since higher education institutions are a primary source to the workforce pipeline. It is suggested that the number of cybersecurity professionals entering the workforce is related to the number of available programs. Thus increasing the number of programs will increase the number of …

Designing Cybersecurity Escape Rooms: A Gamified Approach To Undergraduate Learning, Thitima Srivatanakul

Journal of Cybersecurity Education, Research and Practice

Gamification, including game-based learning (GBL), is a widely recognized pedagogical approach used for imparting and reinforcing cybersecurity knowledge and skills to learners. One innovative form of GBL gaining popularity across various educational levels, from secondary schools to professional development, is escape room-style education. This study is centered on the development and design of escape room activities tailored for teaching cybersecurity concepts, with a particular focus on web and software security, to undergraduate students at York College. The primary objectives of this research are twofold: firstly, to evaluate the effectiveness of educational escape room activities in reinforcing cybersecurity concepts taught in …

The Impact Of Managerial Myopia On Cybersecurity: Evidence From Data Breaches, Wen Chen, Xing Li, Haibin Wu, Liandong Zhang

Research Collection School Of Accountancy

Using a sample of U.S. firms for the period 2005–2017, we provide evidence that managerial myopic actions contribute to corporate cybersecurity risk. Specifically, we show that abnormal cuts in discretionary expenditures, our proxy for managerial myopia, are positively associated with the likelihood of data breaches. The association is largely driven by firms that appear to cut discretionary expenditures to meet short-term earnings targets. In addition, the association is stronger for firms with greater short-term equity incentives, higher earnings response coefficients, low levels of institutional block ownership, or large market shares. Finally, firms appear to increase discretionary expenditures upon the announcement …

A Study Of Cybersecurity Landscape In The United States: Trend, Regional Variations, And Socioeconomic Factors, Trang Thi Thu Horn

All-Inclusive List of Electronic Theses and Dissertations

The Internet has become an essential part of our daily lives. Cyberspace has emerged significantly with an enormous number of users, creating a lucrative hunting field for cybercriminals. The exponential growth of internet users and online activities, along with the increased sophistication of cybercrimes, is raising significant global concerns for individuals, organizations, and governments. This research aims to explore the cybersecurity landscape in the United States, investigate regional variations, and the potential impact of the COVID-19 pandemic on the number of cybercrimes. The study utilizes a mixed research method approach, including historical analysis and a Delphi study. Historical analysis studied …

Improving Belonging And Connectedness In The Cybersecurity Workforce: From College To The Profession, Mary Beth Klinger

Journal of Cybersecurity Education, Research and Practice

This article explores the results of a project aimed at supporting community college students in their academic pursuit of an Associate of Applied Science (AAS) degree in Cybersecurity through mentorship, collaboration, skill preparation, and other activities and touch points to increase students’ sense of belonging and connectedness in the cybersecurity profession. The goal of the project was focused on developing diverse, educated, and skilled cybersecurity personnel for employment within local industry and government to help curtail the current regional cybersecurity workforce gap that is emblematic of the lack of qualified cybersecurity personnel that presently exists nationwide. Emphasis throughout the project …

Blockchain Applications In Higher Education Based On The Nist Cybersecurity Framework, Brady Lund Ph.D.

Journal of Cybersecurity Education, Research and Practice

This paper investigates the integration of blockchain technology into core systems within institutions of higher education, utilizing the National Institute of Standards and Technology’s (NIST) Cybersecurity Framework as a guiding framework. It supplies definitions of key terminology including blockchain, consensus mechanisms, decentralized identity, and smart contracts, and examines the application of secure blockchain across various educational functions such as enrollment management, degree auditing, and award processing. Each facet of the NIST Framework is utilized to explore the integration of blockchain technology and address persistent security concerns. The paper contributes to the literature by defining blockchain technology applications and opportunities within …

Simplifying The Hecvat: A Supplier Risk Assessment For Higher Education Institutions, Melissa Lopez-Barbosa

Undergraduate Honors Theses

The internet revolutionized global communication, enabling rapid messaging to thousands. This also means that malicious communication can happen quickly as well. In higher education, cyber risk has reached unprecedented levels due to the increased interconnectivity facilitated by the internet—it is one of the most cyber-attacked industries worldwide. Establishing robust preventative practices to safeguard sensitive data and maintain trust within the educational community is crucial. Preventative practices must be in place to ensure that suppliers and businesses follow specific security and privacy rules to warrant secure communication. Ensuring supplier compliance with security and privacy rules is critical to safeguarding student data, …