Purpose This study aims to investigate how digital literacy is associated with cybersecurity implementation by examining the parallel mediating roles of information security awareness and information security achievement within a knowledge–attitude–practice (KAP) framework. It aims to clarify why digital literacy alone may not be sufficient for reported secure online behaviour. Design/methodology/approach The study uses a predictive correlational design and structural equation modelling. Data were collected from 551 undergraduate students at a public university in Türkiye using four validated instruments measuring digital literacy, information security awareness, information security achievement and cybersecurity implementation. The model was tested using the robust maximum likelihood estimator with bias-corrected bootstrapping (5,000 resamples) to assess direct and indirect associations. Findings Results indicate that digital literacy has significant direct effects on information security awareness, information security achievement and cybersecurity implementation. Both information security awareness and information security achievement significantly predict cybersecurity implementation and operate as parallel partial mediators in the relationship between digital literacy and cybersecurity behaviour. The findings support a KAP-consistent associative pathway in which digital literacy is linked to awareness, awareness is associated with applied security competence and competence is associated with cybersecurity implementation. Originality/value This study advances the cybersecurity behaviour literature by empirically integrating digital literacy, awareness and achievement within a single KAP-based structural model. By identifying dual mediating mechanisms, it offers a more comprehensive account of how digital competencies are statistically associated with secure practices and provides a robust theoretical and practical framework for designing cyber education and awareness interventions.
Purpose This study aims to explore the knowledge and skills practitioners consider important for cyber threat intelligence (CTI) practice in organizations. Design/methodology/approach Semi-structured interviews with 14 CTI practitioners and cybersecurity leaders were analyzed using deductive qualitative analysis. Socio-technical systems theory informed interpretation, while the NICE Workforce Framework for Cybersecurity supplied organizing categories. Interview excerpts were coded for knowledge, skills, tasks and work roles and tagged to collection, processing, analysis and dissemination. The mapping was refined through member checking with four original participants selected for complementary areas of expertise. Findings The analysis identifies four knowledge areas: cybersecurity and IT domain knowledge, intelligence tradecraft knowledge, situational awareness and business context knowledge. Eleven operational skills encompass technical, analytical, communicative and interpersonal capabilities. Reported competency associations vary across lifecycle activities, with some spanning all four stages. Two practitioner profiles emerged: technical-operational and intelligence-analytical. Practical implications The competencies and mapping provide a starting point for recruitment, training, mentoring and team design, subject to contextual adaptation and further evaluation. Originality/value The study contextualizes established CTI competencies through practitioner accounts and connects reported knowledge and skills to lifecycle activities. It offers an exploratory mapping rather than evidence of effects on intelligence quality or organizational performance.
Purpose The purpose of this research study was set to address the problem of cyberattacks, such as phishing delivered via short message service (SMS) or SMiShing, targeted towards senior citizens. In 2023, they lost over $36m to such attacks. Phishing success increases when attackers use persuasion principles that bypass logical decision-making and rely on heuristics. Security education, training, and awareness (SETA) programs can reduce susceptibility, yet little research investigated SETA programs that incorporate these principles. Design/methodology/approach This research was conducted in three phases, beginning with Subject Matter Experts’ evaluation of SMiShing messages operationalizing these persuasion principles for use in this study’s instrument. The next phase was a pilot study. The third phase was the main data collection and analysis phase. This research employed a pretest-posttest design to evaluate the efficacy of its novel SETA program. The SETA program used Behavioral Skills Training methodology with 118 senior citizens from South Florida and Central Massachusetts. Findings The experimental results indicated a statistically significant mean difference between pretest and posttest group scores (F = 6.604, df = 5, p = 0.011) in identifying SMiShing messages that operationalize the principles of persuasion used in social engineering. Specifically, the pretest group’s mean score was 73.62, and the posttest group’s mean score was 79.28. The calculated effect size (η2 = 0.054) nears the threshold for a medium effect (η2 = 0.06). Practical implications Recognizing persuasion in SMiShing messages helped senior citizens better detect these cyberattacks. Practical implications include incorporating persuasion principles into the SETA framework to address evolving cyberattacks (e.g. deepfakes, vishing) that are being enhanced by generative artificial intelligence. Social implications As a group, senior citizens have lost millions to cyberattacks. SETA programs that incorporate principles of persuasion appear to help reduce the financial losses this group incurs from cyberattacks and may also improve senior citizens’ confidence and reduce fear when using communication technology. Originality/value This research’s original contribution is the integration of persuasion principles into cybersecurity training programs, helping senior citizens quickly recognize the malicious intent of SMiShing messages, which apply psychological pressures to achieve the attacker’s goals.
Purpose This paper aims to examine whether perceived public Wi-Fi risk and declarative familiarity with wireless-network security concepts translate into consistent protective behavior. It focuses on the cybersecurity knowledge–behavior discrepancy in public Wi-Fi usage and contextualizes this discrepancy alongside exposure to rogue access points (RAPs). Design/methodology/approach The study applies an exploratory mixed-methods design consisting of two analytically separate components: a cross-sectional survey of primarily working-age respondents (n = 177) and a zero-payload observational field experiment. The survey examined perceived public Wi-Fi risk, wireless-security familiarity, virtual private network (VPN) usage, service set identifier (SSID) verification and auto-connect configuration. The field component deployed non-capturing RAPs in public locations to observe aggregate Layer-2 device-association events without linking observed devices to survey respondents or collecting credentials, payload content, direct personal identifiers or application-layer traffic. Findings Although 71.2% of respondents identified unsecured public Wi-Fi as a cybersecurity risk, many risk-aware respondents still reported inconsistent protective behavior, including irregular VPN usage and infrequent SSID verification. Non-parametric analyses indicated significant behavioral differences across threat-perception categories, but stronger threat perception did not eliminate risky operational behavior. The field component recorded 27 device-association events, including both user-initiated and automated association events. These observations are interpreted as contextual evidence of exposure mechanisms, not as prevalence estimates or population-level susceptibility rates. Practical implications The paper contributes to behavioral information security by distinguishing between user-level mitigation inconsistency and device-level structural exposure in public Wi-Fi environments. Originality/value The paper contributes to behavioral information security by contextualizing the cybersecurity knowledge–behavior discrepancy in public Wi-Fi environments. It juxtaposes survey-based evidence of self-reported awareness and mitigation behavior with contextual observational evidence of RAP associations, while explicitly distinguishing between user-level mitigation inconsistency and device-level structural exposure.
Purpose Cybersecurity fatigue is an important organisational issue, especially in high-pressure operational contexts such as Software-as-a-Service environments. As organisations implement stricter security controls and mandatory training, this can inadvertently place psychological strain on employees. This study/paper aims to identify specific operational demands and workflow characteristics contributing to employee cybersecurity fatigue and analyse the subsequent behavioural implications. Design/methodology/approach This study adopted an interpretivist, qualitative approach, using semi-structured interviews with employees from various departments to explore the causes and behavioural impacts of cybersecurity fatigue. A single organisation was used as case study. Findings The findings identified several key contributors: workflow disruption, cybersecurity decision overload, work overload and poor understanding of risk. These were associated with secondary elements such as repetitive access requests, security checks overload, a lack of real-world examples and generic training. The study also examined how these factors impact employee behaviour, revealing that fatigue often leads to disengagement, neglect of protocol and abandonment of cybersecurity tasks, especially training. Originality/value Attitudinal fatigue, employees’ negative perceptions of cybersecurity, emerged as a critical influence on compliance and overall cyber resilience. A conceptual model is proposed by integrating the study’s findings with the four-component model of cybersecurity fatigue, offering a foundation for future research. This model may be useful for examining cybersecurity fatigue and developing targeted interventions to reduce its impact. The authors recommend implementing contextualised training with real-world examples and streamlining security processes to reduce workflow disruption and frustration.
