CYBERSECURITY AWARENESS IN EDUCATIONAL INSTITUTIONS: A CRITICAL SOCIO-TECHNICAL REVIEW OF BEHAVIOURAL, PEDAGOGICAL AND GOVERNANCE INTERVENTIONS

Abstract

The increasing reliance on cloud services, learning management systems and connected devices has expended opportunities for teaching and learning within educational institutions. However, it also causes the risk of phishing, ransomware, data misuse and social engineering. So, this critical literature review examines cybersecurity awareness across primary, secondary and higher education from a socio-technical perspective. A structured search of academic research databases including Scopus, Web of Science, IEEE Xplore and ERIC, identified peer-reviewed studies published between 2021 and 2026. 15 studies have retained for thematic synthesis after duplicate elimination and staged screening. The analysis integrates Protection Motivation Theory (PMT) and Socio-Technical Systems (STS) theory to capture both individual and contextual influences on secure behaviour. PMT was used to interpret individual threat perception, coping appraisal and self-efficacy, while STS theory to examine how institutional and technological conditions influence secure behaviour. A persistent gap between recognizing cybersecurity risks and knowing how to respond to the risk has been highlighted from the synthesis. Although, interactive and gamified interventions generally report improvements in short-term knowledge or awareness, the reviewed studies show that this evidence of sustained behavioural change remains limited. The reviewed studies also indicate that teacher capability, governance arrangements and institutional readiness influence whether cybersecurity knowledge is translated into practice. Across the literature, continuous assessment and role-specific training are presented more consistently as components of sustained cybersecurity practice than isolated awareness activities. These findings also question the adequacy of the “human firewall” metaphor, which places considerable responsibility on individual users while giving less attention to system design, governance and resource constraints. Cybersecurity awareness is therefore better understood in this review as an outcome of interactions among threat appraisal, self-efficacy, institutional support and secure system design.