Computer Sciences Commons^™

Optimising Cybersecurity Application Utilisation For Digital Learning In Nigeria: An Evidence-Constrained Hybrid Agent-Based And System-Dynamics Model, Adesegun Nurudeen Osijirin, Leonard C. Anigbo, Oliver Okechukwu

Journal of Cybersecurity Education, Research and Practice

This study examines hypothetical cybersecurity-application utilisation interventions for Computer Science undergraduates in Enugu State, Nigeria. Five author-supplied datasets, each containing 364 cases, provide audited sex-specific calibration moments for a hybrid agent-based and system-dynamics model. Seven portfolios are compared over 24 months using 400 paired replications; additional experiments examine dose, effect assumptions, targeting, academic calendars, turnover and peer structure. A 1,200-point Latin-hypercube design is applied to every original scenario. Across 37,600 runs, the main-model median proportions meeting the survey utilisation criterion are 26.4%, 48.6% and 50.3% for status quo, universal combined and equity-adaptive provision. However, matching nominal dose reduces the corresponding …

From Shadow It To Shadow Ai: A Scoping Review Of How Embedded Ai And Employee Use Increase Cybersecurity And Data Privacy Risk, Jenny Ahn, Bogdan Pavlyuchenkov, Lasette Smith, Paul Wagner, Robert J. Honomichl, Ryan Straight, Shengjie Xu

Journal of Cybersecurity Education, Research and Practice

The rapid integration of artificial intelligence into enterprise software has introduced a critical governance challenge: Shadow AI, the unmanaged and often invisible adoption of AI tools and features by employees outside formal IT oversight. Unlike traditional Shadow IT, which centers on unauthorized data storage and infrastructure, Shadow AI operates at the knowledge and decision-making layer, introducing probabilistic risks including data leakage, agentic misalignment, and indirect prompt injection that existing security frameworks are ill-equipped to address. This paper presents a Systematic Literature Review (SLR) synthesizing 38 peer-reviewed and industry sources to investigate three research questions: how organizational visibility gaps into embedded …

Quantifying Attacker Payoff In Harvest Now, Decrypt Later Attacks: A Persistence-Based Framework For Trade Secret Risk, Arjun Kumar, Gene Yang, Turiya Misra, Francis Kagai

Journal of Cybersecurity Education, Research and Practice

Harvest-now, decrypt-later (HNDL) assumes that encrypted secrets stolen today will remain worth decrypting when quantum computers eventually make that possible. But what if they do not? This paper models HNDL from the attacker’s perspective by asking a different question: how much will a stolen secret still be worth when it can finally be decrypted? We develop a conditional retained-value framework combining probabilistic Q-day timing, information depreciation, and adversary-access delay. The results reveal a sharp divide. Rapidly depreciating secrets can lose much of their strategic value before quantum decryption becomes useful, while persistent secrets can retain substantial attacker payoff even under …

Data Without Borders, Sovereignty Without Guarantees: Cybersecurity Risks Of Cross-Border Data Hosting In The Global South, Evidence And Policy Lessons From Mozambique, Faztudo Languisse Eng.

Journal of Cybersecurity Education, Research and Practice

The digital transformation of public and private institutions across the Global South has produced a paradox: as states digitize government services, financial systems, and citizen records, an increasing share of this data is hosted on servers physically located in the United States, the European Union, and other developed economies. This article develops a taxonomy of the cybersecurity and sovereignty risks generated by this dependency, distinguishing deliberate risks, arising from extraterritorial legal instruments such as the United States CLOUD Act, foreign surveillance regimes, and a concentrated hyperscale cloud market, from non-deliberate risks, arising from undersea cable failures, hyperscaler outages, misconfiguration, and …

Constructing The Cyber Workforce Gap: Measurement And Its Consequences, Ryan Straight

Journal of Cybersecurity Education, Research and Practice

Cyber workforce-gap figures steer federal strategy, industry advocacy, and the growth of educational programs. Rather than estimating the U.S. gap, this review examines how the estimates are made: through job-posting analytics, survey-based estimation, and federal accounting, each of which must assume its way from instrument to labor market. A census of this journal's complete run illustrates what those figures underwrite in one venue: of 176 items published across eleven years, 51 invoke a labor-market workforce claim, 46 treat it as settled fact, and only one, an editorial, interrogates it. Meanwhile, the producers and auditors of those figures have diverged. Between …

Specification And Internal Assessment Of A Self Reported Protective Application Use Composite Among Computer Science Undergraduates In Enugu State Nigeria, Adesegun Nurudeen Osijirin, Leonard C. Anigbo, Oliver Okechukwu

Journal of Cybersecurity Education, Research and Practice

This study specifies a Protective Application Use Composite restricted to self-reported protective application use. A cross-sectional survey provided 364 complete records from Computer Science undergraduates at four universities in Enugu State, Nigeria, from 393 distributed questionnaires. The score is the equal-weight average of five questionnaire categories: antivirus, firewall, encryption, multi-factor authentication, and virtual private network use. Reanalysis of the author-supplied item records yielded category means from 2.097 to 2.376 and internal-consistency coefficients from 0.958 to 0.971. The composite mean was 2.170, with a standard deviation of 0.469. The first component of the category-score correlation matrix explained 50.98 percent of variance. …

Markets For Unverified Capability: Why Organizations Facing Real Adversarial Scrutiny Reject The Metrics Academic Ai-Security Research Relies On, Babar Khan Akhunzada

Journal of Cybersecurity Education, Research and Practice

Governments, insurers, and defenders increasingly rely on published capability claims about AI cybersecurity agents to inform procurement, regulation, and risk assessment. Yet a striking pattern runs through the organizations with the most at stake: enterprises and technology companies deploying frontier AI agents against real production infrastructure consistently decline to publish the accuracy metrics that academic and vendor benchmarks compete to report. This paper investigates that pattern as an economic, organizational, and policy problem rather than a purely technical one. We audit eleven independently published AI cybersecurity benchmarks and deployments using a five-dimension integrity rubric and find that benchmarks relying on …

The Digital Responsibility Index: Quantifying Perceived Multi-Layered Responsibility In Cybersecurity, Mircea Ţălu

Journal of Cybersecurity Education, Research and Practice

In the evolving digital landscape, cybersecurity responsibility extends beyond technical safeguards to include individual behavior, organizational governance, and societal impact. This study introduces the Digital Responsibility Index (DRI), a novel metric that quantifies multi-layered accountability across four domains: technical, individual, organizational, and societal. Data were collected through scenario-based Likert-scale surveys with 120 cybersecurity professionals, supplemented by semi-structured interviews with senior leaders. Results reveal that while technical and organizational responsibilities are consistently prioritized, individual and societal accountability remain under-recognized. Leadership engagement significantly enhances responsibility scores across all layers. The proposed DRI framework provides a measurable and potentially actionable basis for assessing …

Ai-Generated Phishing Attacks: Emerging Threats And Detection Strategies For Security Operations Centers, Bahzad Khalid

Journal of Cybersecurity Education, Research and Practice

Artificial intelligence (AI) is transforming cybersecurity by strengthening defensive capabilities while simultaneously enabling more sophisticated phishing attacks. AI generated phishing emails increasingly evade traditional detection methods through improved grammar, contextual relevance and realistic communication styles creating significant challenges for Security Operations Centers (SOCs). This study investigates the effectiveness of current email security systems in detecting AI generated phishing emails compared with traditional phishing emails. A mixed method experimental approach was employed using controlled Gmail and Outlook environments to evaluate the detection and classification of multiple phishing scenarios. The results demonstrate that several AI generated phishing emails successfully bypassed initial security …

A Narrative-Driven, Socratic Instructional Framework For Teaching Adversarial Cognition In Cybersecurity, Joshua K. Goossen

Journal of Cybersecurity Education, Research and Practice

The Socratic method has demonstrated, in studies across law, medicine, and nursing, that dialectic structured questioning improves expert reasoning. Cybersecurity currently teaches tools and techniques but lacks Socratic dialogic leaving graduates underprepared for novel scenarios requiring cross-domain reasoning. Because law, medicine and nursing cultivate similar reasoning as security there is principled reason to expect reasoning benefits could transfer to security students. This paper argues that the correspondence warrants investigation. Investigation requires a named, teachable reasoning target analogous to clinical reasoning and we specify that target as adversarial cognition, a framework integrating adversary features, system architecture, implementation logic, governance structure, human …

Designing For Who Actually Shows Up: A Signal Framework For Online Adult Learners In Cybersecurity And Information Technology, Chad Whistle, Mayyada Al-Hammoshi

Journal of Cybersecurity Education, Research and Practice

Online adult learners pursuing cybersecurity and information technology credentials represent one of the fastest-growing student populations in American higher education, yet the frameworks institutions use to support their success were not designed for them. This population, disproportionately drawn from the 41.9 million Americans who hold some college credit but no credential, arrives workforce-embedded, time-constrained, and skeptical of institutional systems that previously failed to serve them. Existing persistence models grounded in traditional student integration theory inadequately account for the behavioral patterns, motivational structures, and credential expectations that define this learner. This paper proposes the SIGNAL Framework (Skills-based credential architecture, Integrated AI-informed …

Between Digital Transformation And Regulatory Vacuum: Cybersecurity Of Public Services In Mozambique, Faztudo Languisse Eng.

Journal of Cybersecurity Education, Research and Practice

The rapid expansion of digital public services in Mozambique—including e-government platforms, digital health systems, and electronic tax administration—has outpaced the development of a coherent legal framework for cybersecurity. While Law No. 3/2017 (Electronic Transactions Law) of 9 January 2017 introduced foundational data-protection principles, Mozambique long lacked a dedicated cybersecurity regulatory authority, mandatory security standards, and formal incident-notification mechanisms. This regulatory vacuum exposed critical public services to escalating cyber risks as digital transformation was actively promoted as a development priority. This article examines the legal and institutional gaps in Mozambique's cybersecurity governance framework prior to the 2026 Cybersecurity and Cybercrime Laws, …

Clinic-In-A-Box: A Portable, Software-Defined Cyber Range For Realistic, Scenario-Based Cybersecurity Training, Ethan Chumley, Aaron Nair, Royce Yaezenko, Joshua Payne, Veronika Kyles, Paul Wagner, Robert J. Honomichl, Ryan Straight, Shengjie Xu

Journal of Cybersecurity Education, Research and Practice

Realistic, hands-on cybersecurity training has traditionally depended on fixed infrastructure such as dedicated lab hardware, cloud subscriptions, or permanent network connectivity, limiting where and how often it can be delivered. This paper presents the design and implementation of a portable, scenario-based cybersecurity training platform housed in a single travel case and built from commodity hardware, type-1 hypervisor virtualization, containerized service orchestration, and software-defined networking. The platform clones, isolates, and resets complete lab environments on demand, allowing the same physical system to support repeated classroom, workshop, or field deployments with minimal manual reconfiguration. Training scenarios are grounded in generated organizational profiles …

Self Efficacy And Instructional Support Predict Cyber Deception Acceptance In Ics And Ot Cybersecurity, Daniel Ward

Journal of Cybersecurity Education, Research and Practice

Cyber deception can produce high-confidence evidence of unauthorized activity in industrial control systems (ICS) and operational technology (OT), but practitioners must consider the technology useful, safe, understandable, and supported before they will use it. This study reports a secondary quantitative analysis of a deidentified survey of United States-based ICS and OT professionals to determine whether psychological and instructional factors predict adoption readiness and effective utilization beyond education, experience, and sector. Hierarchical ordinary least squares regression with HC3 robust standard errors was conducted on 262 complete cases. The demographics-only model was not significant and explained 2.8 percent of outcome variance. Adding …

Opengrcrmf: A Vendor-Neutral Framework For Teaching And Modeling Rmf Automation, Continuous Authorization, And Zero Trust Governance, Anand Janjal

Journal of Cybersecurity Education, Research and Practice

Abstract—Federal and regulated organizations continue to rely on document-centric Authorization to Operate (ATO) processes even as the NIST Risk Management Framework (RMF), continuous monitoring guidance, Zero Trust Architecture (ZTA), and continuous authorization initiatives require more continuous, evidence-driven risk management [1]-[3], [13], [15]. Manual System Security Plan (SSP) updates, spreadsheet-based Plan of Action and Milestones (POA&M) tracking, and disconnected assessment evidence create governance latency: the delay between operational security events and authorization-ready governance response. This paper presents OpenGRCRMF, a proposed open, vendor-neutral reference framework that models RMF lifecycle activities as workflow states, treats authorization artifacts as structured governance objects, and …

Personal Authenticity For Engagement And Transfer In Introductory Cybersecurity Education, Daniel T. Hickey, Ronald J. Kantor

Journal of Cybersecurity Education, Research and Practice

Abstract—This conceptual/theoretical paper explores how personal authenticity might promote generative learning in introductory cybersecurity courses. Generative learning transfers confidently to future educational, professional, personal, and testing situations. This cycle of design-based research addresses the concern that more typical professionally authentic contexts (e.g., hospitals, banks, etc.) may be alien and overwhelming to many students, particularly those in introductory courses and/or from non-professional families and communities. If so, this leads to “inert” knowledge that does not transfer. Personal authenticity is rooted in expansive framing, a modern theory of learning transfer. We reframe expansive framing as personal authenticity to make it …

From Disruption To Replacement: The 2026 Cae Cybersecurity Community Symposium And The Emerging Federal-Academic Compact For An Ai Workforce, Sunday Oludare Ogunlana

Journal of Cybersecurity Education, Research and Practice

The cybersecurity workforce gap in the United States is estimated at several hundred thousand unfilled positions, and the rapid integration of artificial intelligence into adversary tradecraft and federal cyber operations is widening that gap qualitatively as well as quantitatively, threatening national security and the operational readiness of graduates entering the field. This perspective article synthesizes the principal arguments advanced by five federal and academic speakers at the 2026 CAE Cybersecurity Community Symposium, using verbatim session transcripts, a structured thematic extraction process, and triangulation against published workforce policy and peer-reviewed literature. Findings document a unified speaker thesis that artificial intelligence now …

A Return On Investment (Roi) Evaluation Tool For Quantifying The Value Of Cybersecurity Certifications, Nicolas Meysmans, Kelly Hughes

Journal of Cybersecurity Education, Research and Practice

The growing reliance on cybersecurity certifications has increased the financial and professional stakes associated with certification decision-making for cybersecurity professionals. Despite their widespread use in hiring and career advancement, there is limited objective guidance available to help individuals evaluate the return on investment (ROI) of specific certifications. This gap has created uncertainty regarding which credentials provide the greatest value relative to their cost and market impact. This study presents a data-driven, design science–based tool that supports cybersecurity professionals in evaluating certification ROI using practitioner survey data combined with certification cost and labor-market demand indicators. The paper also demonstrates how such …

Technical Reliability As Foundation Of Mobile Self-Checkout Experience, Pumezile O. Dyantyi, Fazlyn Petersen

African Conference on Information Systems and Technology

Although mobile self-checkout (MSCO) apps are becoming more common in retail stores, their long-term success in emerging markets depends heavily on the system’s technical reliability. This qualitative thematic study of 888 user reviews for four established MSCO apps investigates how technical reliability shapes the user experience (UX) after app adoption. Using an integration of the UX Honeycomb model and the UTAUT2 framework, this paper demonstrates that technical reliability is a core UX element that affects usability, performance, trust, value, satisfaction and continued use. Technical reliability problems such as system outages, login challenges and transaction difficulties negatively impact several core UX …

South Africa's Inclusive Six-Dimensional Generative Ai Readiness Framework, Keegan Steyn, Ojelanki Ngwenyama, Sibongiseni Tunzelana

African Conference on Information Systems and Technology

Generative artificial intelligence (Gen AI) is transforming governance, knowledge systems, and economic activity, but current preparedness measures pay little attention to the socio-technical, institutional, and postcolonial contexts that shape country trajectories. To address this gap, the study employs a design science methodology to create the National Generative AI Readiness Assessment Framework (N-GAIRF), a six-dimensional diagnostic tool theoretically based on Sen's capability approach to development and incorporating Institutional Theory, Socio-Technical Systems Theory, National Innovation Systems Theory, and Postcolonial Information Systems critique. An example application to South Africa, compared to Zimbabwe and an indicative Organization for Economic Cooperation and Development (OECD) reference …

Closing The Awareness–Behavior Gap: A Role-Based Phishing Training Framework For Higher Education, Ranylene O. Olaybal, Ryan A. Olaybal

Journal of Cybersecurity Education, Research and Practice

Phishing remains one of the most persistent cybersecurity threats facing higher education institutions, where diverse user populations and highly connected digital environments increase exposure to social engineering attacks. Although cybersecurity awareness initiatives are widely implemented, high awareness does not always translate into secure behavior. This study examined phishing awareness, phishing-related practices, phishing susceptibility, and phishing experiences among college students, teaching faculty, and administrative staff in a private higher education institution in the Philippines. Using a quantitative cross-sectional design, data were collected from 553 respondents through a validated survey instrument and analyzed using descriptive statistics, one-way analysis of variance, Tukey's honestly …

Enabling Multi-Task Neural Network Inference On Heterogeneous Edge Devices, Redwanul Islam Arif

Master's Theses

Deep neural networks are increasingly required to run on the devices that generate the data. If such a device must perform more than one task, the standard practice is deploying one model per task, which makes memory grow linearly with task count, which is unacceptable when the entire budget is kilobytes. This thesis asks one question in three settings: how much capability can a network acquire without incurring deployment cost?

The first study takes an ImageNet-pretrained ResNet-18, sweeps the branch point across every residual stage and the classification-head depth across one, ten, and twenty layers, and deploys the resulting multi-head …

Federated Learning For Early Medical Diagnosis: Enhanced Diabetic Retinopathy Detection In Smart Healthcare, Mohammad Nasajpour Esfahani

Master's Theses

This thesis investigates the role of federated learning as a privacy-preserving solution for modern healthcare challenges. In traditional machine learning, sensitive medical data must be centralized for model training, raising concerns about privacy, security, and regulatory compliance. Federated learning offers an alternative by allowing hospitals, clinics, and personal health devices to collaboratively train shared models without exchanging raw patient data. The study first explores how federated learning is being used across various healthcare domains, including cancer detection, medical imaging, and disease prediction— highlighting its potential to support secure collaboration across institutions. It addresses key benefits such as data privacy, scalability, …

Differential Effects Of Generative Artificial Intelligence On Formative And Summative Assessment Performance: A Quasi-Experimental Longitudinal Study, Md Istiak Morsalin

Master's Theses

Generative artificial intelligence has unsettled a core assumption of course assessment: that scores on unsupervised work reflect what students can do unassisted. This study tests whether the widespread availability of ChatGPT altered student performance differently on formative versus summative assessments in Business Analytics and Foundations, a required undergraduate quantitative-methods course taught by one instructor across nine cohorts. In a quasi-experimental longitudinal design, the Fall~2022 cohort ($n = 90$), the last to finish before ChatGPT's public release, serves as a control against eight post-ChatGPT cohorts spanning Spring~2023 through Summer~2025 ($N = 646$). Outcomes were drawn from McGraw-Hill Connect records using matched …

Escaping The Cyberstorm: A Gamified Social Engineering Training Program, Noah Mcclanahan, Fadi Abu-Amara, Ali Khattab, Travis Jett, Andre Jackson

Journal of Cybersecurity Education, Research and Practice

In this research work, we explored the effectiveness of gamification in improving cybersecurity awareness and training users on targeted social engineering attacks. Traditional cybersecurity training focuses on lectures and videos. These training methods may not actively engage employees, which reduces their knowledge retention and ability to recognize social engineering attacks. This lack of involvement is a concern, as social engineering continues to be one of the most prevalent attack methods faced by end-users. A gamified training program, Escaping the Cyberstorm, was developed using the Godot game engine to address key challenges in spreading cybersecurity awareness. The game includes real-life …

Stop Blaming My Users: Illumination Of The Technocentric Mythos Bias, Ervin H. Frenzel, Richard Lightcap

Journal of Cybersecurity Education, Research and Practice

 Abstract -This conceptual essay addresses the need for systemic and systematic transdisciplinary analytical techniques within cybersecurity and technical security. This conceptual essay is contingent upon recognition that cybersecurity is not simply technical in nature, it does not need an adversary, and more importantly it is based upon systems engineering and systems thinking.  The essay contributes a socio-technical attribution chain and field-specific ontology/taxonomy which distinguish user-triggered events from root causes, latent conditions, technical debt, validation failures, governance failures, and attribution bias before assigning responsibility to end users. It systematically defines an ontology inclusive of developer technical debt, organizational debt arising from …

Assessment And Evidence Practices In Cybersecurity Education: A Systematic Review (2015–2025), James K. Mayberry

Journal of Cybersecurity Education, Research and Practice

This study presents a PRISMA-based systematic review of 412 cybersecurity education intervention studies, coding assessment methods, evidence types, claimed outcomes, use of established assessment instruments, and artifact availability. Despite frequent claims of skill development and workforce preparation, 45.4% of studies reported no identifiable assessment. Knowledge tests appeared in 11.4% of studies, while performance assessments appeared in 10.2%. From 2015 to 2025, assessment practices remained dominated by post-only designs or no assessment, with no statistically detectable increase in pre/post-capable designs. Use of established assessment instruments was rare, with 94.2% of assessed studies using ad hoc measures or not identifying an established …

Cybersecurity Governance Of Industrial Iot In Sub-Saharan Africa: Policy Gaps, Threat Landscape, And Lessons From Comparative African Contexts, Faztudo Languisse Eng.

Journal of Cybersecurity Education, Research and Practice

The rapid deployment of Industrial Internet of Things (IIoT) systems across Sub-Saharan Africa's extractive, energy, logistics, and agro-industrial sectors has introduced a cybersecurity challenge of growing urgency: industrial networks that were designed for operational efficiency are increasingly exposed to cyber threats for which neither the organizations nor the regulatory frameworks are adequately prepared. This article examines the cybersecurity governance of IIoT systems in a developing African economy, using Mozambique as a primary case study and drawing comparative lessons from South Africa, Rwanda, and Kenya. Through an integrative literature review and documentary analysis of national digital, cybersecurity, and industrial policies, the …

Contemporary Cybersecurity Challenges In Emerging Technologies: A Systematic Literature Analysis, Faztudo Languisse Prof

Journal of Cybersecurity Education, Research and Practice

The accelerating convergence of artificial intelligence (AI), the Internet of Things (IoT), cloud computing, blockchain, and quantum computing has fundamentally transformed the global threat landscape, introducing cybersecurity challenges of unprecedented complexity and scale. This systematic literature review synthesizes findings from peer-reviewed publications, institutional reports, and regulatory documents published primarily between 2020 and 2025 to provide an integrated analysis of contemporary cybersecurity challenges across five key emerging technology domains. The review identifies critical vulnerabilities inherent to each domain, documents the evolution of threat actors and attack methodologies — including AI-powered ransomware, adversarial machine learning, and harvest-now-decrypt-later quantum attacks — and evaluates …

Building The Next Cybersecurity Workforce: A Grades 7–12 Curriculum To Close The Cyber Talent Gap, Mohammed A. Salam, Iqbal Shareef, Rich P. Manprisio

Journal of Cybersecurity Education, Research and Practice

In today’s rapidly evolving technological landscape, cyberattacks pose increasing threats, yet a global shortage of cybersecurity and digital forensics professionals leaves industries vulnerable, similar to having too few law enforcement officers in a densely populated city. The judicial system faces rising digital crimes and fraud cases, further strained by the lack of experts to analyze and extract digital evidence. Despite high demand, millions of positions remain unfilled. This paper identifies the root causes of the cybersecurity workforce shortage and proposes a targeted solution: a curriculum for Grades 7–12 designed to foster cybersecurity awareness and interest. The methodology included a comprehensive …