This study examines hypothetical cybersecurity-application utilisation interventions for Computer Science undergraduates in Enugu State, Nigeria. Five author-supplied datasets, each containing 364 cases, provide audited sex-specific calibration moments for a hybrid agent-based and system-dynamics model. Seven portfolios are compared over 24 months using 400 paired replications; additional experiments examine dose, effect assumptions, targeting, academic calendars, turnover and peer structure. A 1,200-point Latin-hypercube design is applied to every original scenario. Across 37,600 runs, the main-model median proportions meeting the survey utilisation criterion are 26.4%, 48.6% and 50.3% for status quo, universal combined and equity-adaptive provision. However, matching nominal dose reduces the corresponding intervention medians to approximately 34%, and equalising effects and schedules removes the universal combined advantage. Need-only targeting reduces the sex gap under matched aggregate input, while closures, turnover and bidirectional peer influence reduce projected attainment. A transparent relative-resource analysis does not favour combined provision per resource unit. These results describe conditional utilisation projections, not observed intervention effects or verified security protection. Full code, coefficients, input reconciliation and replication outputs accompany the article. The model identifies assumptions requiring empirical evaluation rather than an optimal institutional programme.
The rapid integration of artificial intelligence into enterprise software has introduced a critical governance challenge: Shadow AI, the unmanaged and often invisible adoption of AI tools and features by employees outside formal IT oversight. Unlike traditional Shadow IT, which centers on unauthorized data storage and infrastructure, Shadow AI operates at the knowledge and decision-making layer, introducing probabilistic risks including data leakage, agentic misalignment, and indirect prompt injection that existing security frameworks are ill-equipped to address. This paper presents a Systematic Literature Review (SLR) synthesizing 38 peer-reviewed and industry sources to investigate three research questions: how organizational visibility gaps into embedded and employee-used AI increase cybersecurity and data privacy risk; what cybersecurity incident types are most commonly associated with ungoverned AI-enabled applications; and what risks employee interactions with AI pose to sensitive, proprietary, and regulated data. The analysis identifies a critical visibility deficit created by AI capabilities embedded within vendor-managed platforms, the semantic opacity of large language model interactions, and employees' utilitarian bypass of security policies. A taxonomy of six AI-specific incident types is presented, encompassing data leakage, prompt injection, credential compromise, agentic misuse, phishing augmentation, and insecure plugin exploitation. Findings demonstrate that existing governance mechanisms, including data loss prevention systems, identity and access management frameworks, and static risk assessments, are structurally misaligned with the dynamic nature of generative AI. The paper recommends a transition to dynamic, risk-based governance integrating continuous monitoring, cross-functional oversight, and AI TRiSM frameworks.
Harvest-now, decrypt-later (HNDL) assumes that encrypted secrets stolen today will remain worth decrypting when quantum computers eventually make that possible. But what if they do not? This paper models HNDL from the attacker’s perspective by asking a different question: how much will a stolen secret still be worth when it can finally be decrypted? We develop a conditional retained-value framework combining probabilistic Q-day timing, information depreciation, and adversary-access delay. The results reveal a sharp divide. Rapidly depreciating secrets can lose much of their strategic value before quantum decryption becomes useful, while persistent secrets can retain substantial attacker payoff even under relatively early postquantum cryptography (PQC) migration. A stylised aerospace defence analogue demonstrates the effect, while an exploratory citation-based persistence analysis examines whether long horizon information persistence can be observed empirically. The findings expose a blind spot in calendar-based PQC planning: the same quantum timeline does not create the same HNDL risk for every secret. HNDL exposure depends not only on when quantum decryption arrives, but on what remains worth stealing when it does.
The digital transformation of public and private institutions across the Global South has produced a paradox: as states digitize government services, financial systems, and citizen records, an increasing share of this data is hosted on servers physically located in the United States, the European Union, and other developed economies. This article develops a taxonomy of the cybersecurity and sovereignty risks generated by this dependency, distinguishing deliberate risks, arising from extraterritorial legal instruments such as the United States CLOUD Act, foreign surveillance regimes, and a concentrated hyperscale cloud market, from non-deliberate risks, arising from undersea cable failures, hyperscaler outages, misconfiguration, and abrupt commercial withdrawal. Using Mozambique as an illustrative case, and situating it within a broader Global South comparative frame that includes Nigeria’s tiered data-localization regime and the African Union’s Malabo Convention, the article shows how an incomplete domestic legal framework, limited local hosting capacity, and heavy reliance on undersea cables transiting a small number of chokepoints compound both categories of risk simultaneously. The analysis draws on legal instruments, regulatory policy documents, and recent infrastructure incidents to argue that digital sovereignty cannot be achieved through data protection legislation alone; it requires parallel investment in domestic hosting capacity, regional interconnection, and reciprocal legal arrangements. The article concludes with a policy framework combining risk-tiered data localization, sovereign and hybrid cloud investment, and regional cooperation mechanisms suited to resource-constrained states, together with implications for cybersecurity education and professional practice.
Governments, insurers, and defenders increasingly rely on published capability claims about AI cybersecurity agents to inform procurement, regulation, and risk assessment. Yet a striking pattern runs through the organizations with the most at stake: enterprises and technology companies deploying frontier AI agents against real production infrastructure consistently decline to publish the accuracy metrics that academic and vendor benchmarks compete to report. This paper investigates that pattern as an economic, organizational, and policy problem rather than a purely technical one. We audit eleven independently published AI cybersecurity benchmarks and deployments using a five-dimension integrity rubric and find that benchmarks relying on outcome-only grading, such as binary flag capture or multiple-choice accuracy, verify the intended method behind a reported success in only a small minority of cases, while benchmarks using process-aware grading verify method in nearly all cases, a separation unlikely to be due to chance within this corpus. We identify a second, largely invisible source of inflation: several benchmarks reuse practice applications or competition archives with extensive public solution write-ups, and we show, drawing on an independent study that quantified this effect directly, that this alone can roughly double a reported score regardless of grading design. We then show that five organizations in our wider corpus, spanning a major payment network, two technology-company security research programmes, and two further vulnerability-discovery efforts, are the only sources that decline to publish any headline accuracy number at all, instead reporting discrete, externally confirmed findings or a custom process metric. We interpret this divergence through the lens of information asymmetry in markets for quality-uncertain goods, and through the organizational-trust literature on human reliance on automation, arguing that unaudited capability claims function similarly to unverifiable quality signals in other markets, while noting that existing certification institutions from adjacent security markets have not yet reached this one. We close with the societal stakes of this dynamic, since a government-backed synthesis report already cites unaudited capability figures from our corpus in a policy-facing document, and offer concrete recommendations for procurement officers, insurers, regulators, and benchmark designers.
