The Impact of Structured Cybersecurity Training on Behavioural Risk in Higher Education

1. Introduction

Cybersecurity scholarship has progressively shifted from infrastructure-centric paradigms toward socio-technical interpretations that recognise human behaviour as the decisive locus of vulnerability. While sophisticated technical safeguards continue to evolve, empirical evidence consistently demonstrates that breaches frequently originate from behavioural lapses rather than technological insufficiencies. Hadlington [1] empirically links impulsivity and maladaptive internet usage patterns to risky cybersecurity practices, illustrating that behavioural predispositions significantly mediate compliance outcomes. Such findings reinforce the argument that cybersecurity is fundamentally behavioural before it is technical.

The behavioural turn in cybersecurity research is further substantiated by Parsons et al. [2], who developed the Human Aspects of Information Security Questionnaire (HAIS-Q) to quantify awareness, attitudes, and behavioural compliance. Their work reveals a persistent divergence between knowledge and practice, indicating that awareness, although necessary, is insufficient to guarantee secure behaviour. Behaviour is mediated by motivation, organisational reinforcement, and contextual constraints.

Albladi and Weir [3] and Frauenstein & Flowerday [4] extend this behavioural framing by demonstrating that user characteristics significantly shape susceptibility to social engineering attacks. Cognitive bias, overconfidence, and contextual trust heuristics influence decision-making under uncertainty, thereby increasing vulnerability even among ostensibly informed users. Collectively, these studies converge on a critical theoretical insight: cybersecurity risk is emergent from complex human, system interactions, where behavioural tendencies, organisational signals, and technological affordances intersect.

Thus, human behaviour must be treated not as a peripheral compliance variable but as the structural core of cybersecurity governance.

Higher education institutions (HEIs) amplify behavioural vulnerabilities due to their distinctive socio-technical architecture. Universities operate as open knowledge ecosystems prioritising accessibility, decentralisation, and collaborative autonomy. While these characteristics are epistemically essential, they simultaneously expand digital attack surfaces. Zwilling et al. [5] and Badreddine et al. [6,7] demonstrate substantial inconsistencies in cybersecurity awareness and behavioural adherence within educational contexts. Their comparative study reveals that knowledge disparities and attitudinal variation significantly influence security practices. Importantly, these variations persist despite formal policy frameworks, suggesting that policy presence alone does not ensure behavioural convergence.

HEIs are particularly susceptible to social engineering and phishing attacks due to high email traffic, frequent external collaboration, and the coexistence of diverse user groups (faculty, staff, students, contractors). The decentralised IT governance structures common in universities further complicate enforcement consistency. In such environments, behavioural risk cannot be mitigated through rigid control mechanisms alone; it requires cultural integration and institutional alignment. Consequently, higher education institutions exemplify socio-technical systems in which behavioural governance becomes inseparable from cybersecurity resilience.

Within this socio-technical framing, cybersecurity training is conventionally positioned as the principal instrument for mitigating behavioural vulnerability. However, the theoretical and empirical foundations of this assumption remain contested.

Taherdoost [8] critically reviews existing cybersecurity awareness frameworks and concludes that many models lack behavioural validation, longitudinal measurement, and integration with organisational performance systems. Training is frequently delivered as episodic awareness modules rather than sustained behavioural interventions. This structural weakness limits its transformative capacity. Bada, Sasse, and Nurse [9] advance a more critical position, arguing that cybersecurity awareness campaigns often fail because they emphasise information transmission rather than behavioural change mechanisms. Without addressing motivational drivers, habit formation processes, and contextual reinforcement, awareness initiatives risk becoming symbolic compliance artefacts rather than effective behavioural regulators.

Alnajim et al. [10] and Badreddine et al. [11] explore advanced pedagogical approaches, including virtual and augmented reality-based training. While immersive technologies enhance engagement and experiential learning, empirical evidence linking such modalities to measurable behavioural risk reduction remains nascent. The proliferation of innovative training techniques does not necessarily equate to demonstrable behavioural impact.

This body of literature exposes a theoretical paradox: training is institutionally valorised as a risk mitigation mechanism, yet its behavioural efficacy is rarely operationalised through predictive modelling. Most evaluations rely on self-reported awareness metrics rather than quantifiable behavioural outcomes.

Training does not function within a vacuum; its impact is mediated by institutional culture. Alshaikh [12] and Khalifa et al. [13] conceptualise cybersecurity culture as the constellation of shared values, beliefs, leadership practices, and governance norms that shape employee behaviour. From this perspective, training serves as a cultural signal, communicating organisational priorities and reinforcing behavioural expectations. However, culture may either amplify or neutralise training effects. In institutions where cybersecurity is perceived as peripheral to professional identity, training initiatives may be interpreted as administrative formalities rather than behavioural imperatives. Conversely, where leadership commitment and accountability mechanisms are robust, training can catalyse sustained behavioural change.

The tension between training and culture is therefore analytically significant. Training may operate as:

• A catalytic mechanism, strengthening an already supportive security culture; or
• b. A compensatory mechanism, attempting to correct deficits within a weak cultural environment.

If culture remains underdeveloped, characterised by limited feedback channels, minimal leadership modelling, and absence of accountability, training risks becoming performative rather than transformative.

This tension reveals a deeper governance question: is cybersecurity training a behavioural determinant, or merely an institutional ritual?

The emergence of machine learning provides methodological tools capable of resolving this paradox. Sarker [14] outlines the capacity of machine learning algorithms to identify complex, non-linear relationships within high-dimensional datasets. In cybersecurity contexts, predictive modelling enables the operationalisation of behavioural constructs into measurable risk scores.

However, while AI-based intrusion detection and anomaly detection systems are extensively researched, behavioural risk modelling remains comparatively underdeveloped, particularly within higher education. Few studies integrate organisational variables (e.g., training exposure, cultural perception) into predictive frameworks.

The absence of predictive behavioural modelling represents a significant methodological gap. Without quantifying the behavioural impact of training deficiency, institutional decision-making remains speculative rather than evidence driven.

1.1. Research Problem

Despite the widespread implementation of cybersecurity policies within higher education institutions, behavioural compliance remains uneven. Empirical studies demonstrate persistent discrepancies between awareness and secure practice [2,5,13,14,15,16]. Training programmes, when present, are frequently optional, infrequent, or not structurally embedded within performance evaluation systems [8,17,18].

Furthermore, while cybersecurity culture has been identified as a determinant of employee behaviour [12], the interaction between training exposure and cultural reinforcement remains insufficiently theorised and empirically modelled. Existing research predominantly adopts descriptive survey methodologies rather than predictive analytics.

Three critical limitations are evident in the current literature:

i.

Behavioural Measurement Gap: Most studies measure awareness or attitudes rather than predictive behavioural risk.

ii.

Training Efficacy Gap: Limited empirical modelling exists to quantify whether structured training significantly reduces behavioural risk scores.

iii.

Methodological Fragmentation: Few studies triangulate predictive modelling outcomes with qualitative institutional evidence to validate cultural interpretations.

Consequently, the quantitative behavioural impact of structured cybersecurity training within higher education remains underexplored. The absence of integrated predictive and qualitative analysis restricts both theoretical advancement and policy formulation.

This study addresses these gaps by operationalising cybersecurity behaviour through deep learning modelling and examining the measurable influence of structured training exposure, supported by institutional interview data.

1.2. Research Questions

In response to the identified theoretical and empirical gaps, this study investigates:

RQ1. 

Does structured cybersecurity training significantly reduce behavioural risk scores in higher education institutions?

RQ2. 

How does training deficiency interact with institutional cybersecurity culture to influence behavioural compliance?

RQ3. 

Can deep learning modelling reliably quantify behavioural differences between trained and untrained groups within socio-technical academic systems?

1.3. Contributions

This study advances the literature in four principal ways:

i.

Theoretical Contribution: It reframes cybersecurity training as a structural behavioural determinant embedded within institutional culture, rather than as an isolated educational intervention.

ii.

Methodological Contribution: It integrates deep learning-based behavioural risk modelling with qualitative institutional analysis, addressing methodological fragmentation in prior research.

iii.

Empirical Contribution: It quantifies the behavioural impact of training exposure within higher education, providing evidence-based insight into training efficacy.

iv.

Governance Contribution: It demonstrates how AI-driven predictive analytics can inform institutional cybersecurity policy and training reform, moving governance from symbolic compliance toward measurable behavioural risk reduction.

2. Literature Review

2.1. Behavioural Foundations of Cybersecurity Compliance

Cybersecurity risk is increasingly conceptualised as a behavioural phenomenon rather than a purely technical failure. Empirical research demonstrates that cognitive, psychological, and contextual factors significantly influence secure and insecure digital practices. Hadlington [1] identifies impulsivity and problematic internet use as predictors of risky cybersecurity behaviour, suggesting that behavioural predispositions mediate compliance independently of technical safeguards. Similarly, Parsons et al. [2] demonstrate measurable discrepancies between awareness and actual behavioural adherence using the HAIS-Q instrument, indicating that knowledge does not automatically translate into practice.

Protection Motivation Theory (PMT) offers a structured explanatory framework for such inconsistencies. PMT posits that protective behaviour emerges from threat appraisal (perceived severity and vulnerability) and coping appraisal (response efficacy and self-efficacy). Ifinedo [18] empirically confirms that perceived vulnerability, response efficacy, and self-efficacy significantly predict policy compliance. Crucially, self-efficacy, often targeted through training, emerges as a decisive behavioural determinant.

However, while PMT explains individual motivation, it does not fully account for persistent non-compliance in organisational settings. To address this limitation, the Theory of Planned Behaviour (TPB) introduces subjective norms and perceived behavioural control as additional determinants. Ifinedo [18] demonstrates that organisational support and normative expectations shape compliance intentions. Within higher education institutions, where professional autonomy is high and disciplinary cultures vary, subjective norms may be fragmented, thereby weakening compliance signals.

Consequently, behavioural cybersecurity must be understood as a product of both cognitive appraisal and social reinforcement.

2.2. Cybersecurity Training: Awareness, Efficacy, and Limitations

Cybersecurity training is widely positioned as the principal intervention for mitigating behavioural vulnerability. Yet empirical evaluations reveal mixed outcomes. Taherdoost [8] critiques prevailing awareness frameworks for lacking behavioural validation and longitudinal assessment. Training initiatives frequently emphasise knowledge acquisition without demonstrating sustained behavioural change.

Bada, Sasse, and Nurse [9] provide further evidence that awareness campaigns often fail because they target information deficits rather than behavioural conditioning. Informational exposure, without motivational reinforcement or contextual integration, produces superficial compliance.

Emerging pedagogical approaches attempt to address engagement deficits. Alnajim et al. [10] review immersive training modalities such as virtual and augmented reality, highlighting their potential to enhance experiential learning. However, while engagement improves, empirical modelling of behavioural risk reduction remains limited.

The literature therefore reveals a structural paradox: training is institutionally valorised as risk mitigation, yet its behavioural impact is rarely quantified. Most studies rely on self-reported awareness measures rather than predictive behavioural scoring. This methodological limitation constrains evidence-based governance decisions.

2.3. Habit Formation and the Durability of Secure Behaviour

Beyond cognitive intention, behavioural durability is shaped by habit formation. Vance, Siponen, and Pahnila [19] and Badreddine et al. [16] demonstrate that habitual behaviour significantly predicts security compliance. Secure practices become automated through repetition in stable contexts, reducing reliance on conscious deliberation.

This insight exposes a critical limitation of episodic training models. One-off or annual awareness sessions may enhance short-term knowledge but are unlikely to reshape habitual digital routines. Hadlington [1] further illustrates that entrenched behavioural tendencies, such as impulsivity, can override rational threat appraisal, reinforcing the need for continuous reinforcement mechanisms.

Thus, effective cybersecurity training must operate not merely at the informational level but at the behavioural conditioning level, embedding secure practices within daily workflows.

2.4. Deterrence and Enforcement Climate

Deterrence theory introduces an additional dimension to behavioural governance. D’Arcy, Hovav, and Galletta [20] demonstrate that awareness of monitoring and sanction mechanisms significantly reduces misuse. Compliance is influenced not only by knowledge but also by perceived enforcement certainty. Bulgurcu, Cavusoglu, and Benbasat [21] further show that rational cost-benefit evaluations shape compliance intention, particularly when organisational climate signals clear expectations and consequences.

Within higher education institutions, enforcement mechanisms are often comparatively weak due to decentralised governance and professional autonomy. Moreover, higher individual security awareness and stronger deterrence mechanisms significantly reduce information security breaches [22,23]. Training may lack deterrent reinforcement, reducing behavioural impact as shown in Figure 1 according to Burns et al. [24].

This interaction highlights a structural tension:

• Training enhances knowledge and potentially self-efficacy (PMT),
• Normative reinforcement shapes intention (TPB),
• Habit formation ensures durability,
• Deterrence shapes rational compliance decisions.

If any of these mechanisms remain weak, behavioural risk persists.

2.5. Cybersecurity Culture as Behavioural Infrastructure

Cybersecurity culture integrates these theoretical mechanisms into a cohesive organisational framework. Alshaikh [12] conceptualises cybersecurity culture as the shared values and practices that signal institutional commitment to secure behaviour. Culture determines whether training is interpreted as essential professional practice or bureaucratic ritual.

Zwilling et al. [5] demonstrate variability in awareness and behaviour across institutional contexts, suggesting that cultural factors mediate compliance consistency. Where leadership modelling, accountability systems, and participatory governance are absent, training may fail to generate normative reinforcement.

The analytical tension between training and culture is therefore central. Training without cultural embedding risks symbolic compliance; culture without structured training risks informational deficiency. Sustainable behavioural risk reduction requires alignment between educational intervention and organisational reinforcement.

2.6. AI-Based Behavioural Modelling and the Quantification Gap

Despite theoretical richness, much of the behavioural cybersecurity literature remains analytically descriptive. Advances in machine learning provide an opportunity to operationalise behavioural constructs into predictive risk models. Sarker et al. [25] and Omari et al. [26] highlight the capacity of machine learning algorithms to detect complex, non-linear relationships in behavioural datasets.

However, behavioural risk modelling within higher education remains underdeveloped. Existing studies largely measure awareness or intention rather than predicting behavioural risk scores based on training exposure and cultural perception.

The absence of integrated predictive modelling constitutes a critical gap. Without quantifying behavioural differences between trained and untrained groups, institutional cybersecurity governance remains reliant on perception-based assumptions rather than empirical evidence.

2.7. Research Gap

Existing scholarship provides substantial insight into the psychological and organisational determinants of cybersecurity behaviour. Prior studies demonstrate that behavioural intention and compliance are influenced by threat appraisal, subjective norms, habit formation, and deterrence mechanisms [17,18,19,20]. At the organisational level, cybersecurity culture has been shown to shape the consistency and depth of compliance practices [5,9,12]. Moreover, while training programmes are widely implemented across institutions, systematic evaluations of their behavioural efficacy remain inconsistent and often limited to awareness metrics rather than measurable behavioural outcomes [8,9,10,11,12,13,14,17]. Parallel to this, predictive modelling and machine learning approaches have been identified as promising methodological advancements for cybersecurity analytics, yet their application within behavioural training research remains underdeveloped [14].

Despite these contributions, the literature remains fragmented. No integrated study has simultaneously (1) operationalised cybersecurity behaviour through deep learning modelling, (2) quantified the behavioural impact of structured training exposure beyond cognitive awareness measures, and (3) triangulated predictive findings with qualitative institutional cultural analysis. Consequently, the field lacks a unified empirical framework linking training intensity, institutional culture, and measurable behavioural risk within a single systems-based model.

To address this gap, the present study develops and empirically tests the integrated framework illustrated in Figure 2, which conceptualises structured training and cybersecurity culture as interacting governance mechanisms shaping behavioural risk in higher education institutions.

3. Methods

This study adopts a rigorous mixed-methods design integrating quantitative deep learning-based behavioural modelling with qualitative institutional analysis. The methodological architecture is structured to ensure theoretical coherence and statistical robustness.

Research Design

An explanatory sequential mixed-methods design was employed, whereby quantitative modelling preceded and informed qualitative analysis. This design enables empirical testing of behavioural relationships while contextualising statistical findings within institutional realities. The integration logic follows established mixed-method principles of complementarity and triangulation; whereby quantitative results are interpreted through qualitative validation to strengthen inference credibility [27].

The study proceeds in three sequential phases:

• Quantitative behavioural risk modelling via deep learning.
• Qualitative thematic analysis of institutional interviews.
• Integration and triangulation of findings.

3.1. Quantitative Phase

The quantitative phase involved the collection of structured survey data from employees within higher education institutions, with the instrument designed to capture core constructs derived from behavioural cybersecurity theory. Specifically, the survey measured cybersecurity training exposure, policy knowledge, best-practice adherence, technical readiness, risk tolerance, and perceived cybersecurity culture. These constructs were operationalised using structured Likert-type scales and categorical indicators to ensure both theoretical alignment and statistical tractability. Following data cleaning, preprocessing, and dataset expansion procedures to enhance variability and modelling robustness, the final analytical dataset comprised 250 records suitable for predictive modelling.

To translate theoretical constructs into computationally tractable inputs, a systematic feature engineering process was undertaken. Composite behavioural indices were derived from the raw survey indicators, resulting in the construction of:

• Cyber policy knowledge level,
• Cybersecurity best practices level,
• Technical readiness level,
• Cybersecurity culture level,
• and Risk tolerance level.

These constructs were computed using weighted aggregation techniques combined with dispersion-sensitive adjustments to preserve behavioural heterogeneity across respondents. Categorical encoding procedures were subsequently applied to ensure compatibility with machine learning algorithms and to avoid information loss during model training.

Two dependent variables were operationalised for predictive modelling: a Cybersecurity Behaviour Score and a Behavioural Risk Percentage. These outcome measures were calculated through structured combinations of behavioural and attitudinal indicators, allowing for the quantification of compliance patterns and the estimation of behavioural vulnerability within the institutional context. This operationalisation enabled the transformation of abstract behavioural theory into measurable outputs suitable for advanced statistical analysis and deep learning prediction.

3.2. Deep Learning Model Development

The deep learning phase began with careful data preprocessing. Categorical variables were converted using one-hot encoding so that nominal differences were preserved without creating artificial ranking. Numerical features were standardised using z-score normalisation to ensure scale consistency and stable optimisation [28]. The dataset was then split into training (80%) and testing (20%) subsets. This allowed the model to be evaluated on unseen data and reduced the risk of biased performance estimates [29].

A multi-layer feedforward neural network was developed using TensorFlow/Keras. The input layer reflected the encoded feature space. Several hidden layers were added with ReLU activation functions to capture non-linear relationships. Dropout layers (30-40%) were included to reduce overfitting by randomly disabling neurons during training. L2 regularisation was also applied to penalise large weights and improve generalisation. The output layer used linear activation, as the task involved predicting continuous behavioural risk scores [30].

The model was trained using the Adam optimiser with a learning rate of 0.001, selected for its efficiency and adaptive learning properties. Mean Squared Error (MSE) was used as the primary loss function and Mean Absolute Error (MAE) was reported as a complementary metric to improve interpretability. Early stopping and adaptive learning rate scheduling were implemented to prevent overfitting and stabilise convergence. To further strengthen reliability, five-fold cross-validation was conducted. The dataset was divided into five subsets, and the model was trained on four while validated on the remaining fold in rotation. Final performance metrics were calculated as the mean across all folds to ensure robust and reproducible evaluation.

3.3. Model Evaluation

Model performance was evaluated using a combination of regression and classification metrics to provide a comprehensive assessment of predictive quality. Regression accuracy was examined through Mean Absolute Error (MAE), Mean Squared Error (MSE), Root Mean Squared Error (RMSE), and the coefficient of determination (R²), which together capture average deviation, error magnitude, and variance explained by the model. In addition, classification-oriented measures, Precision, Recall, and the F1-score, were calculated to assess the model’s reliability in correctly identifying behavioural risk categories.

3.4. Qualitative Phase

Semi-structured interviews were conducted with faculty and staff members to explore perceptions of cybersecurity training, institutional culture, and behavioural compliance.

• Interview protocols were designed to examine:
• Training adequacy and structure
• Perceived enforcement mechanisms
• Cultural reinforcement of cybersecurity practices
• Institutional support and feedback systems

Interview data were then analysed using inductive thematic coding. Patterns were identified through iterative categorisation, enabling the extraction of dominant themes.

3.5. Integration and Triangulation

Quantitative and qualitative findings were integrated through methodological triangulation in order to enhance inferential robustness and strengthen the credibility of the conclusions [26]. Convergence between predictive modelling outputs and institutional interview narratives was examined to determine whether higher predicted behavioural risk corresponded with reported training deficiencies, whether weak cybersecurity culture was associated with elevated risk patterns, and whether institutional perceptions were consistent with statistically derived outcomes. This integrative approach reflects a systems-oriented methodological stance, recognising that behavioural cybersecurity risk does not arise from isolated variables but from the dynamic interaction of training structures, cultural reinforcement, governance mechanisms, and individual cognitive factors.

3.6. Ethical Considerations

Participation was voluntary, and responses were anonymised prior to analysis. Data were stored securely and used exclusively for research purposes. No personally identifiable information was retained in the modelling dataset.

4. Results

This section presents the integrated quantitative and qualitative findings structured around the research questions. The quantitative analysis evaluates the statistical relationship between structured cybersecurity training and behavioural risk using group comparisons, multivariate modelling, mediation and moderation testing, and predictive validation. The qualitative analysis provides explanatory depth through thematic interpretation of institutional narratives. The section concludes with a unified systems-based synthesis.

To address the first research question: Does Structured Cybersecurity Training Significantly Reduce Behavioural Risk? predicted behavioural risk scores (0-100%) were generated using the validated deep learning model. Participants who reported structured interactive cybersecurity training exhibited substantially lower behavioural risk scores (M = 34.8%, SD = 6.2) compared to those without structured training (M = 58.3%, SD = 9.7).

Figure 3. Boxplot of Behavioural Risk by Training Status.

Figure 3. Boxplot of Behavioural Risk by Training Status.

The difference of 23.5 percentage points represents a substantial behavioural shift.

Independent samples t-test:

t (123) = -11.84, p < 0.001

Using Cohen’s d = 2.15, the effect size indicates an exceptionally large practical impact. In behavioural research, this magnitude is rare and suggests that structured training operates as a dominant determinant rather than a marginal improvement factor. The non-overlapping confidence intervals reinforce statistical robustness.

Figure 4. Histogram of Risk Score Distribution.

Figure 4. Histogram of Risk Score Distribution.

Dose-Response Effect of Training Intensity

A one-way analysis of variance (ANOVA) was conducted to examine differences in behavioural risk across three training intensity groups (No Training, Basic Awareness, and Structured Interactive Training). The analysis revealed a statistically significant effect of training intensity on behavioural risk, F (2,122) = 68.37, p < 0.001. The effect size was large (η² = 0.53), indicating that 53% of the total variance in behavioural risk scores is attributable to differences in training intensity. This magnitude of explained variance suggests a strong dose–response relationship, whereby higher-quality training is associated with substantially lower behavioural risk. Post-hoc comparisons further demonstrated that participants who received structured interactive training exhibited significantly lower behavioural risk than those in both the no-training and basic awareness groups (p < 0.001 for both comparisons). No meaningful reduction in risk was observed between the no-training and awareness-only conditions, indicating that passive awareness mechanisms do not produce significant behavioural improvement.

Figure 5. Training Intensity.

Figure 5. Training Intensity.

An independent samples t-test revealed a statistically significant difference in behavioural risk between employees with basic policy knowledge and those with higher knowledge levels (t = 8.50, p < 0.001, d = 1.05), indicating a large effect. Employees with higher knowledge demonstrated significantly lower predicted behavioural risk.

Figure 6. Behavioural Risk by Policy Knowledge level.

Figure 6. Behavioural Risk by Policy Knowledge level.

Correlation Structure

Pearson correlation analysis was conducted to examine the bivariate associations between training exposure, policy knowledge, best-practice adherence, and behavioural risk. The results indicate a strong and statistically significant negative relationship between training exposure and behavioural risk (r = -0.72, p < 0.001), suggesting that increased exposure to structured cybersecurity training is associated with substantially lower predicted behavioural risk. Similarly, policy knowledge demonstrated a strong negative correlation with behavioural risk (r = -0.65, p < 0.001), indicating that greater institutional understanding of cybersecurity policies corresponds with reduced vulnerability. Best-practice adherence was also significantly and negatively associated with behavioural risk (r = -0.67, p < 0.001), reinforcing the importance of consistent compliance behaviours in mitigating risk.

The findings confirm that training-related and knowledge-based variables are strongly inversely related to behavioural risk outcomes. However, given the conceptual overlap among these predictors, multivariate modelling was required to disentangle their independent contributions and determine whether training exerts an effect beyond policy knowledge and behavioural adherence mechanisms.

Hierarchical Regression

A hierarchical regression analysis was conducted to examine whether training predicts behavioural risk beyond cognitive predictors. Model 1, including policy knowledge, best-practice adherence, and risk tolerance, explained 79% of the variance in behavioural risk (R² = 0.79). When training exposure was added in Model 2, the explained variance increased significantly to R² = 0.88, representing a meaningful improvement (ΔR² = 0.09, p < 0.001).

Training remained a significant independent predictor (β = -0.41, p < 0.001), indicating that higher levels of structured training are associated with a 0.41 standard deviation reduction in behavioural risk after controlling for cognitive variables. This result suggests that training contributes effects beyond informational knowledge, reflecting structural behavioural reinforcement rather than solely cognitive transmission.

Mediation Analysis

A mediation analysis was conducted to examine whether policy knowledge explains the relationship between training and behavioural risk. The indirect effect of training on behavioural risk through policy knowledge was statistically significant (β = -0.18, p = 0.002), indicating that part of training’s impact operates through improved knowledge acquisition.

However, the persistence of a significant direct effect suggests that training also reduces behavioural risk independently of knowledge. This finding supports a multi-pathway behavioural model in which training influences risk both through cognitive enhancement and through additional structural or behavioural reinforcement mechanisms.

Quantitative Moderation

A moderation analysis was conducted to examine whether cybersecurity culture influences the relationship between training and behavioural risk. The interaction term between training and cybersecurity culture was statistically significant (β = −0.19, p = 0.014), indicating that the effect of training on behavioural risk varies as a function of institutional culture strength. Specifically, the protective impact of training was more pronounced in institutions characterised by stronger cybersecurity culture, whereas its effect was comparatively attenuated in weaker cultural environments. This finding suggests that cybersecurity culture operates as an amplifying mechanism, reinforcing the behavioural benefits of structured training and strengthening its capacity to reduce organisational risk.

Figure 7. Training by Cybersecurity Culture Interaction.

Figure 7. Training by Cybersecurity Culture Interaction.

Qualitative Findings: Thematic Analysis

A reflexive thematic analysis was undertaken to explore the organisational mechanisms underlying the statistical relationships identified in the quantitative phase. Through iterative coding, pattern identification, and theoretical abstraction, four dominant themes emerged. These themes illuminate how structural training deficiencies and institutional culture interact to shape behavioural cybersecurity risk. Rather than merely describing perceptions, the findings reveal embedded governance dynamics that contextualise and substantiate the predictive modelling results.

Theme 1:

Structural Absence of Institutionalised Training

Participants consistently described a systemic absence of structured cybersecurity training. Training was not embedded within onboarding, professional development pathways, or routine institutional practice. This omission reflects a governance deficiency in which behavioural reinforcement mechanisms are neither formalised nor strategically prioritised. From a behavioural standpoint, such absence weakens coping appraisal, reduces perceived institutional commitment, and limits the signalling function that cybersecurity constitutes an organisational expectation.

“There is no structured cybersecurity training in my institution, and to my knowledge there has never been a formal programme implemented.” (Participant 6)

“In the three years I have worked here, I have never attended a cybersecurity workshop or any structured training session.” (Participant 4)

“When I joined the institution, cybersecurity was not part of the onboarding process at all.” (Participant 10)

“Nobody really talks about cybersecurity unless something goes wrong or there has been a reported incident.” (Participant 2)

Theme 2:

Symbolic Awareness Without Behavioural Depth

A second theme highlighted the distinction between symbolic awareness initiatives and substantive behavioural training. Participants frequently described institutional efforts as limited to informational reminders rather than experiential or evaluative learning. Such initiatives were perceived as compliance-driven rather than capability-building. This aligns with the quantitative finding that awareness-only approaches do not significantly reduce behavioural risk, reinforcing the importance of interactive and structured training mechanisms.

“We only receive occasional phishing simulation emails, but there is no proper training that explains what to do or how to respond.” (Participant 9)

“It honestly feels like ticking a box for compliance rather than genuinely improving our understanding.” (Participant 15)

“There is no hands-on simulation, no scenario-based training, and no testing to check our practical understanding.” (Participant 3)

“Nobody follows up to see whether we actually understand the policies or if we are applying them correctly.” (Participant 18)

Theme 3:

Fragmented and Individualised Responsibility

Participants described cybersecurity practices as largely self-directed, with limited institutional coordination or standardisation. In the absence of structured guidance, employees relied on personal judgement and informal learning resources. This fragmentation generates heterogeneous behavioural norms across departments and reduces collective accountability, thereby sustaining variability in organisational risk exposure.

“I mainly rely on YouTube tutorials, online blogs, and external articles to improve my cybersecurity knowledge.” (Participant 7)

“Everyone handles cybersecurity in their own way because there isn’t a consistent institutional approach.” (Participant 11)

“There is no clear standard that everyone follows, so practices vary significantly across teams.” (Participant 14)

Theme 4:

Cultural Marginalisation of Cybersecurity

Finally, participants emphasised that cybersecurity is frequently marginalised within institutional governance. It is often framed as a technical or IT-specific concern rather than an organisation-wide responsibility. Leadership engagement was perceived as limited, and cybersecurity performance was rarely integrated into evaluation systems. These narratives provide explanatory depth to the moderation findings, indicating that training effectiveness depends on cultural reinforcement and strategic embedding.

“Cybersecurity is not included in our performance evaluations, so it doesn’t feel like a core responsibility.” (Participant 16)

“It is generally seen as an IT department issue rather than something that concerns all staff.” (Participant 8)

“Leadership rarely addresses cybersecurity in meetings or strategic discussions.” (Participant 13)

“It doesn’t appear to be treated as a strategic priority at the institutional level.” (Participant 19)

The thematic analysis demonstrates that behavioural cybersecurity risk emerges from systemic institutional deficiencies rather than isolated individual lapses. The qualitative findings substantiate the quantitative moderation and regression results, reinforcing the conclusion that structured training must be embedded within a supportive and strategically reinforced cybersecurity culture to produce sustained behavioural change.

Deep Learning Model Validation

The deep learning model demonstrated exceptionally strong predictive performance in estimating behavioural risk. The final model achieved a coefficient of determination of R² = 0.94, indicating that 94% of the variance in behavioural risk scores is explained by the model’s feature set. In practical terms, this level of explanatory power reflects near-complete capture of systematic behavioural variance within the dataset. Error metrics further support the model’s accuracy, with a Mean Absolute Error (MAE) of 2.64 and a Root Mean Squared Error (RMSE) of 4.01. These relatively low error values indicate that predicted risk scores deviate minimally from observed values, demonstrating high precision in continuous outcome estimation.

To assess generalisability and mitigate concerns regarding overfitting, five-fold cross-validation was conducted. The mean cross-validated coefficient of determination was R² = 0.941, closely aligning with the primary model performance. The minimal discrepancy between training and cross-validation performance indicates model stability and robust generalisation capacity. This consistency suggests that the model is not merely memorising training patterns but is capturing structurally meaningful behavioural relationships.

Figure 8. Learning Curve.

Figure 8. Learning Curve.

Figure 9. Predicted versus Actual Behaviour Risk.

Figure 9. Predicted versus Actual Behaviour Risk.

5. Discussion

This study set out to interrogate a long-standing assumption within cybersecurity governance: that training reduces behavioural risk. While prior literature has frequently advocated awareness programmes, empirical demonstrations of large-scale behavioural impact have remained limited or methodologically constrained. The present findings complicate the awareness narrative and suggest that what matters is not the presence of training per se, but its structural depth, institutional embedding, and cultural reinforcement.

A first critical observation concerns magnitude. The effect sizes observed in this study are substantially larger than those typically reported in awareness research. Systematic reviews have repeatedly noted that awareness campaigns often fail to generate durable behavioural change [9,17], and Taherdoost [8] explicitly critiques the predominance of framework-level discussions without rigorous behavioural validation. In contrast, the current analysis demonstrates that structured, interactive training produces transformational rather than incremental reductions in behavioural risk. This finding challenges the implicit equivalence in the literature between “awareness” and “training.” The qualitative themes reinforce this distinction: participants differentiated superficial communication from immersive skill development. This resonates with Alnajim et al. [10], who argue that experiential modalities (e.g., simulation-based or immersive approaches) enhance engagement and retention compared to passive delivery. The present findings extend that claim by demonstrating measurable behavioural consequences.

The hierarchical regression results further clarify that training operates beyond cognitive knowledge transmission. Although policy knowledge partially mediates the training–risk relationship, training remains an independent predictor after controlling for knowledge, best-practice adherence, and risk tolerance. This nuance is important. Ifinedo’s integration of PMT and TPB [18] highlights coping appraisal and subjective norms as central drivers of compliance, yet the current results suggest that structured training may influence behavioural execution mechanisms that are not fully captured by cognitive constructs alone. Chen et al. [31] and Sommestad et al. [32] emphasise the role of habit formation in security compliance, arguing that repetition and behavioural rehearsal are necessary for sustained adherence. The qualitative themes describing the absence of simulation and testing align directly with this insight. Where training lacks behavioural reinforcement, compliance remains episodic rather than routinised.

The moderation effect of cybersecurity culture offers an additional layer of theoretical refinement. Alshaikh [12] conceptualises cybersecurity culture as a practice-based phenomenon shaped by leadership commitment, policy clarity, and reinforcement structures. The present findings empirically support this framing: training is significantly more effective in institutions characterised by stronger cultural embedding. This suggests that training effectiveness is conditional rather than universal. In environments where cybersecurity is marginalised or siloed, training risks being absorbed as a symbolic gesture rather than an operational norm. This aligns with Bulgurcu et al. [21], Alraja et al. [33] and Moody et al. [34], who both emphasise that policy compliance is shaped by organisational context, not merely individual intention. The current study moves this insight forward by statistically demonstrating culture as a moderating variable rather than a background correlate.

The qualitative themes also complicate deterrence assumptions. Classical deterrence research emphasises certainty and severity of sanctions as behavioural regulators [20,35]. However, participants in this study described limited evaluative integration and minimal performance linkage. In such contexts, deterrence signals are weak, which may explain the limited impact of passive awareness approaches. The findings therefore suggest that training without governance reinforcement may lack normative weight. This interpretation is consistent with D’Arcy et al. [20], who demonstrate that awareness of countermeasures influences misuse behaviour when perceived consequences are credible. The present study indicates that credibility depends on cultural and structural embedding.

Methodologically, the integration of deep learning modelling addresses a persistent limitation in cybersecurity behaviour research. Much of the literature relies on self-reported awareness scales (e.g., HAIS-Q [2]) or cross-sectional perceptual measures [36]. While valuable, these approaches often lack predictive validation. Sarker et al. [25] argue that cybersecurity data science should translate behavioural constructs into operational predictive systems. The high explanatory power and cross-validation stability observed here suggest that behavioural cybersecurity risk can be modelled with considerable reliability. Importantly, this does not imply that behavioural risk is mechanistically determined; rather, it demonstrates that institutional variables contain predictive signal. In this sense, the study operationalises Kuhn et al.’s [22] notion of organisations as complex adaptive systems in which governance mechanisms shape emergent behavioural outcomes.

The findings also engage critically with the awareness–behaviour gap highlighted by Hadlington [1] and Albladi and Weir [3], both of whom demonstrate that individual characteristics and cognitive biases influence risky behaviour. The current results suggest that institutional design can attenuate, though not eliminate, such variability. Structured training appears to narrow behavioural dispersion, whereas fragmented, self-directed approaches amplify heterogeneity. Zwilling et al. [5] report cross-national differences in awareness and behaviour, indicating contextual influence. The present study complements this by demonstrating intra-institutional variation conditioned by cultural strength.

Taken together, the evidence supports a systems-based interpretation of behavioural cybersecurity governance. Training enhances coping appraisal (PMT), clarifies subjective norms (TPB), supports habit formation, and signals enforcement expectations, but these mechanisms are amplified or constrained by institutional culture. In the absence of structural embedding, cybersecurity becomes symbolically acknowledged yet behaviourally peripheral. Thus, higher education institutions should conceptualise training not as an isolated intervention but as a governance subsystem integrated with leadership signalling, evaluative mechanisms, and reinforcement structures.

The contribution of this study lies not only in demonstrating that structured training reduces behavioural risk, but in empirically specifying the conditions under which it does so. By integrating behavioural theory with predictive modelling, the study bridges the conceptual computational divide identified in emerging cybersecurity data science literature [14,25,30,37]. In doing so, it reframes cybersecurity training from a compliance formality into a measurable governance lever whose effectiveness depends on cultural architecture and organisational design.

6. Conclusions and Future Research

This study demonstrates that structured, interactive cybersecurity training is associated with substantial reductions in behavioural risk within higher education institutions. Crucially, training effectiveness is not uniform: it is amplified by strong cybersecurity culture and operates both through enhanced policy knowledge and through broader structural reinforcement mechanisms. These findings reposition training from a peripheral awareness activity to a central governance instrument embedded within institutional systems. By integrating behavioural theory with predictive deep learning modelling, the study advances a systems-based framework in which training, culture, and analytics function interdependently.

The practical implications are clear. Institutions should mandate structured, role-specific training incorporating simulation and assessment; embed cybersecurity within onboarding and performance evaluation systems; and adopt predictive risk dashboards to monitor behavioural trends. Passive awareness campaigns are insufficient. Without cultural reinforcement and governance integration, training risks remaining symbolic rather than transformative.

Limitations include the cross-sectional design and reliance on self-reported behavioural indicators, which constrain causal inference. Future research should employ longitudinal and experimental designs, extend analysis across sectors, and integrate behavioural telemetry and explainable AI techniques to enhance predictive transparency. Sustainable cybersecurity governance requires structurally embedded, data-informed strategies rather than episodic awareness initiatives.