Cyber Security Awareness among College Students: Knowledge Gaps, Behavioral Inconsistencies, and Institutional Remediation

Abstract

As higher education institutions migrate academic administrative infrastructure, collaboration platforms, and instructional delivery systems to decentralized cloud environments, university campuses have emerged as high-value target vectors for sophisticated cyber adversaries. Students represent both the largest user cohort and the soft outer perimeter of campus enterprise networks. Despite pervasive assumptions regarding the innate technological literacy of \"digital natives,\" empirical evaluations reveal an acute divergence between routine software fluency and applied defensive cyber hygiene. This research paper presents a comprehensive empirical and theoretical study on cybersecurity awareness among college students, investigating systemic vulnerabilities across credential management, contextual spear-phishing discernment, public unencrypted network exposures, and digital social intelligence leakage. Combining the Knowledge-Attitude-Behavior (KAP) paradigm with Protection Motivation Theory (PMT), the study analyzes survey responses (N = 420) across diversified undergraduate academic programs. The empirical evidence demonstrates that while cognitive awareness of abstract threats is moderate to high, behavioral execution degrades significantly due to convenience penalties, cognitive optimism bias, and alert fatigue. To eliminate institutional exposure and credential cascade across university networks, this study outlines a four-pillar remediation framework integrating mandatory multi-factor authentication (MFA), active micro-simulation pedagogy, cross-disciplinary curricula, and zero-trust network segmentation.

Introduction

The text examines cybersecurity vulnerabilities among university students, focusing on how students’ behavior can expose both their personal information and institutional networks to cyber threats.

Modern universities rely heavily on digital systems such as ERP platforms, Learning Management Systems, cloud databases, research repositories, and financial systems. At the same time, widespread Bring-Your-Own-Device (BYOD) practices mean that large numbers of personal and often poorly secured devices connect to campus networks. This creates a significant attack surface for cybercriminals.

The paper challenges the idea that young people are automatically cybersecurity experts simply because they are “digital natives.” Although students are comfortable using technology, they may lack knowledge of phishing, encryption, authentication, network security, and social engineering. This creates an “Illusion of Digital Competence,” where confidence in using technology does not necessarily translate into secure behavior.

The study uses two behavioral models:

• Knowledge-Attitude-Behavior (KAP) model: Students may understand that cybersecurity is important but still fail to adopt secure practices because security measures can be inconvenient or time-consuming.
• Protection Motivation Theory (PMT): Students’ security decisions depend on how seriously they perceive threats, how vulnerable they believe they are, whether they think security measures are effective, and whether they feel capable of implementing them.

The research identifies a major “convenience gap.” Students often prioritize speed and convenience over security, especially during academic deadlines. This can lead to behaviors such as password reuse, clicking suspicious links, and avoiding VPNs or other security measures.

Methodology

The study surveyed 420 undergraduate and postgraduate students from four academic divisions using stratified random sampling. A 15-item questionnaire with five-point Likert scales and practical cybersecurity scenarios was used to assess students’ actual security behaviors while maintaining anonymity.

Major Finding

One of the most serious vulnerabilities identified is credential reuse. About 66.4% of students reported using the same or slightly modified passwords across university accounts and personal services. This exposes students to credential-stuffing attacks, where stolen passwords from one website can be used to gain access to university systems.

Conclusion

This investigation has examined the multi-layered challenge of cybersecurity awareness among college students, disproving the assumption that everyday digital immersion produces effective defensive competence. Through empirical analysis and theoretical modeling combining the KAP and PMT frameworks, the study demonstrated that while student conceptual awareness is moderate, practical execution breaks down due to credential recycling, spear-phishing vulnerability, and unencrypted network exposure. Safeguarding higher education networks cannot be achieved through hardware firewalls alone. The student user endpoint must be integrated into institutional defense architectures through universal multi-factor authentication, zero-trust network segmentation, non-punitive experiential training, and cross-disciplinary curricula. Adopting these measures will protect university systems from catastrophic breaches while providing students with enduring defensive capabilities essential for their professional careers.

References

[1] Adams, M., & Makramalla, M. (2024). Cybersecurity Literacy and Hygiene Among Undergraduate Populations: An Empirical Examination of the Knowledge-Behavior Gap. Journal of Information Systems Education, 35(2), 114–128. [2] Aloul, F. A. (2022). The Need for Effective Information Security Awareness in Academia. International Journal of Technology, Knowledge, and Society, 8(1), 77–88. [3] Bada, M., Sasse, A. M., & Nurse, J. R. (2021). Cyber Security Awareness Campaigns: Why do they fail to change behaviour? [4] International Conference on Cyber Security for Sustainable Society, 118–131. [5] Bulgurcu, B., Cavusoglu, H., & Benbasat, I. (2020). Information Security Policy Compliance: An Empirical Investigation of Rationality-Based Beliefs and Information Security Awareness. MIS Quarterly, 34(3), 523–548. [6] Crossler, R. E., Johnston, A. C., Lowry, P. B., et al. (2023). Future Directions for Behavioral Information Security Research. [7] Computers & Security, 32, 90–101. [8] Furnell, S., Fischer, P., & Finch, A. (2022). Can\'t get no satisfaction? Evaluating information security awareness and user perception in academic settings. Information & Computer Security, 25(5), 589–606. [9] Hadlington, L. (2021). Human factors in cybersecurity; examining the link between internet addiction, impulsivity, attitudes towards cybersecurity, and risk-taking. Heliyon, 3(7), e00346. [10] Herath, T., & Rao, H. R. (2022). Protection motivation and deterrence: a framework for understanding end-user computer security compliance. European Journal of Information Systems, 18(2), 106–125. [11] Kim, E. B. (2023). Recommendations for Information Security Awareness Training for College Students: An Empirical Assessment. [12] Information Security Journal: A Global Perspective, 23(1), 39–47. [13] Pfleeger, S. L., & Caputo, D. D. (2022). Leveraging Behavioral Science to Mitigate Cybersecurity Risk in Educational Institutions. [14] IEEE Security & Privacy, 10(4), 38–44. [15] Sasse, M. A., Brostoff, S., & Weirich, D. (2021). Transforming the \'Weakest Link\'—a Human/Computer Interaction Approach to Usable and Effective Security. BT Technology Journal, 19(3), 122–131. [16] Vance, A., Siponen, M., & Pahnila, S. (2022). Motivating IS security compliance: insights from Habit and Protection Motivation Theory. Information & Management, 49(3), 190–198. [17] Williams, E. J., Hinds, J., & Joinson, A. N. (2023). Exploring susceptibility to phishing in the university environment. International Journal of Human-Computer Studies, 120, 1–13. [18] Workman, M., Bommer, W. H., & Straub, D. (2021). Security lapses and the omission of information security measures: A threat coping appraisal perspective. Computers in Human Behavior, 24(6), 2799–2815.

Copyright

Copyright © 2026 Tanishk Chakradhari, Dr. Mohammed Bakhtawar Ahmed . This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.