Purpose The purpose of this research study was set to address the problem of cyberattacks, such as phishing delivered via short message service (SMS) or SMiShing, targeted towards senior citizens. In 2023, they lost over $36m to such attacks. Phishing success increases when attackers use persuasion principles that bypass logical decision-making and rely on heuristics. Security education, training, and awareness (SETA) programs can reduce susceptibility, yet little research investigated SETA programs that incorporate these principles. Design/methodology/approach This research was conducted in three phases, beginning with Subject Matter Experts’ evaluation of SMiShing messages operationalizing these persuasion principles for use in this study’s instrument. The next phase was a pilot study. The third phase was the main data collection and analysis phase. This research employed a pretest-posttest design to evaluate the efficacy of its novel SETA program. The SETA program used Behavioral Skills Training methodology with 118 senior citizens from South Florida and Central Massachusetts. Findings The experimental results indicated a statistically significant mean difference between pretest and posttest group scores (F = 6.604, df = 5, p = 0.011) in identifying SMiShing messages that operationalize the principles of persuasion used in social engineering. Specifically, the pretest group’s mean score was 73.62, and the posttest group’s mean score was 79.28. The calculated effect size (η2 = 0.054) nears the threshold for a medium effect (η2 = 0.06). Practical implications Recognizing persuasion in SMiShing messages helped senior citizens better detect these cyberattacks. Practical implications include incorporating persuasion principles into the SETA framework to address evolving cyberattacks (e.g. deepfakes, vishing) that are being enhanced by generative artificial intelligence. Social implications As a group, senior citizens have lost millions to cyberattacks. SETA programs that incorporate principles of persuasion appear to help reduce the financial losses this group incurs from cyberattacks and may also improve senior citizens’ confidence and reduce fear when using communication technology. Originality/value This research’s original contribution is the integration of persuasion principles into cybersecurity training programs, helping senior citizens quickly recognize the malicious intent of SMiShing messages, which apply psychological pressures to achieve the attacker’s goals.
Purpose This paper aims to examine whether perceived public Wi-Fi risk and declarative familiarity with wireless-network security concepts translate into consistent protective behavior. It focuses on the cybersecurity knowledge–behavior discrepancy in public Wi-Fi usage and contextualizes this discrepancy alongside exposure to rogue access points (RAPs). Design/methodology/approach The study applies an exploratory mixed-methods design consisting of two analytically separate components: a cross-sectional survey of primarily working-age respondents (n = 177) and a zero-payload observational field experiment. The survey examined perceived public Wi-Fi risk, wireless-security familiarity, virtual private network (VPN) usage, service set identifier (SSID) verification and auto-connect configuration. The field component deployed non-capturing RAPs in public locations to observe aggregate Layer-2 device-association events without linking observed devices to survey respondents or collecting credentials, payload content, direct personal identifiers or application-layer traffic. Findings Although 71.2% of respondents identified unsecured public Wi-Fi as a cybersecurity risk, many risk-aware respondents still reported inconsistent protective behavior, including irregular VPN usage and infrequent SSID verification. Non-parametric analyses indicated significant behavioral differences across threat-perception categories, but stronger threat perception did not eliminate risky operational behavior. The field component recorded 27 device-association events, including both user-initiated and automated association events. These observations are interpreted as contextual evidence of exposure mechanisms, not as prevalence estimates or population-level susceptibility rates. Practical implications The paper contributes to behavioral information security by distinguishing between user-level mitigation inconsistency and device-level structural exposure in public Wi-Fi environments. Originality/value The paper contributes to behavioral information security by contextualizing the cybersecurity knowledge–behavior discrepancy in public Wi-Fi environments. It juxtaposes survey-based evidence of self-reported awareness and mitigation behavior with contextual observational evidence of RAP associations, while explicitly distinguishing between user-level mitigation inconsistency and device-level structural exposure.
Purpose Cybersecurity fatigue is an important organisational issue, especially in high-pressure operational contexts such as Software-as-a-Service environments. As organisations implement stricter security controls and mandatory training, this can inadvertently place psychological strain on employees. This study/paper aims to identify specific operational demands and workflow characteristics contributing to employee cybersecurity fatigue and analyse the subsequent behavioural implications. Design/methodology/approach This study adopted an interpretivist, qualitative approach, using semi-structured interviews with employees from various departments to explore the causes and behavioural impacts of cybersecurity fatigue. A single organisation was used as case study. Findings The findings identified several key contributors: workflow disruption, cybersecurity decision overload, work overload and poor understanding of risk. These were associated with secondary elements such as repetitive access requests, security checks overload, a lack of real-world examples and generic training. The study also examined how these factors impact employee behaviour, revealing that fatigue often leads to disengagement, neglect of protocol and abandonment of cybersecurity tasks, especially training. Originality/value Attitudinal fatigue, employees’ negative perceptions of cybersecurity, emerged as a critical influence on compliance and overall cyber resilience. A conceptual model is proposed by integrating the study’s findings with the four-component model of cybersecurity fatigue, offering a foundation for future research. This model may be useful for examining cybersecurity fatigue and developing targeted interventions to reduce its impact. The authors recommend implementing contextualised training with real-world examples and streamlining security processes to reduce workflow disruption and frustration.
Purpose This study aims to address the information security governance issues associated with the use of AI in HRM by developing the artificial intelligence–human resource management (AI-HRM) cybersecurity architecture (AHCA), a novel domain-specific architecture. Design/methodology/approach The review followed the PRISMA 2020 principles, and 72 peer-reviewed papers were obtained from journals indexed in Scopus and IEEE Xplore, or from CORE-ranked journals, for the years 2020–2025, with citation chaining in Google Scholar. Three research questions guided the synthesis, covering threat conceptualisation, security implications and governance. This study then created the AHCA following an iterative design science process, using each component directly from literature reviews, and constructed a structured rubric with explicit anchoring examples to enable replication of the comparative evaluation. Findings The review identified six categories of AI-HRM security threats: data breaches (T1), exploitation of algorithmic bias (T2), insider threat amplification (T3), model poisoning attacks (T4), regulatory non-compliance (T5) and governance and audit failures (T6). There is a wide disparity in the attention these subjects receive in the literature: algorithmic bias (43.1 %) and governance and audit failure (51.4 %) together account for 94.4 % of the corpus whose primary focus could be coded, while data breaches (1.4 %), insider threat (1.4 %) and regulatory non-compliance (2.8 %) sit at the margins, and no study takes model poisoning as its primary focus. In addition, most governance-oriented research identifies accountability gaps but stops short of architectural solutions. The AHCA is designed to address this structural deficit, pairing four-layer architecture with a 14-indicator security performance indicator (SPI) framework. Research limitations/implications The corpus is limited to English-language publications from 2020 to 2025 that appear in journals in the AHCA’s Q1 or Q2 tiers, and the AHCA itself is a design artefact that will be tested in practice through Delphi panels of experts and longitudinal case studies. The technical security literature emerged when searching IEEE Xplore and Scopus; a complementary search of the ACM Digital Library is planned as a future extension. Practical implications The AHCA and its SPI framework offer HR practitioners and policymakers an AI-HRM-specific blueprint for general data protection regulation (GDPR) compliant, high-risk employment systems in accordance with the provisions of the European Union AI Act. Originality/value The AHCA incorporates GDPR and EU AI Act compliance-by-design principles into a single HRM-specific security architecture that is currently in the early phases of development. It is the only benchmark that addresses the HRM-specific and EU AI Act dimensions, which are not addressed by sector-agnostic comparators, and it performs well in the generic HRM security dimensions on a replicable nine-dimension rubric, benchmarked against NIST AI RMF, MITRE ATLAS, ISO 27001 and NIST CSF.
Purpose This study aims to examine the influence of knowledge, attitudes and behaviour on compliance intentions towards Uganda’s Data Protection and Privacy Act (DPPA) among staff in Ugandan higher education institutions (HEIs). It further investigates the moderating role of educational attainment in the relationships between knowledge, attitudes, behaviour and compliance intentions. Design/methodology/approach A quantitative cross-sectional survey was conducted among 384 staff members at a large public university in Uganda. Data were analysed using Statistical Package for Social Sciences Version 26 through descriptive statistics, Pearson correlation, multiple regression and hierarchical moderated regression analysis. Findings The results show that knowledge, attitude and behaviour each had a significant positive influence on compliance intentions towards the DPPA. Behaviour emerged as the strongest predictor (ß = 0.434, p < 0.001), followed by attitude (ß = 0.268, p = 0.002) and knowledge (ß = 0.159, p = 0.026). The model explained 56.7% of the variance in compliance intentions (R2 = 0.567). Educational attainment significantly moderated the relationships between knowledge, attitude, behaviour and compliance intentions, increasing the explained variance to 60.7% (R2 = 0.607). These findings suggest that routine privacy-protective behaviour is more influential than knowledge alone in shaping compliance intentions towards the DPPA, and that the effectiveness of these factors varies according to employees’ educational attainment. Practical implications HEIs should prioritise behaviour-focused data protection interventions, tailor staff training to different educational levels and integrate DPPA requirements into institutional policies and routine operational practices to strengthen compliance intentions and promote a sustainable culture of data protection. Originality/value This study extends the information security compliance literature by demonstrating that educational attainment moderates the relationships between knowledge, attitudes, behaviour and compliance intentions towards the DPPA. To the best of the authors’ knowledge, this study provides one of the first empirical examinations of these relationships within Ugandan HEIs, offering context-specific insights for strengthening data protection compliance.
