📄 social_science

Cybersecurity Awareness for AI-Enabled Learning Environments: Evidence from Higher Education Institutions in Kuwait

This study of 270 participants across seven Kuwaiti higher education institutions reveals that cybersecurity knowledge and cyber threat awareness are significant independent predictors of secure digital practices, highlighting the need for enhanced training to support trustworthy AI-enabled learning environments and align with national cybersecurity strategies.

Original authors: Abdullah F Alenezi

Published 2026-08-25

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Abdullah F Alenezi

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the modern university, learning has migrated into a vast digital ecosystem. Students submit essays through cloud-based platforms, professors grade assignments on tablets, and artificial intelligence tools help draft lesson plans or offer instant feedback on student work. This shift relies entirely on the flow of data: personal information, grades, and behavioral patterns moving through networks to create a personalized educational experience. However, this digital convenience creates a vulnerability. Just as a physical classroom needs locks on its doors, a digital learning environment needs protection from those who would steal data, disrupt classes, or trick users into revealing their secrets. This protection is known as cybersecurity. It is not merely a technical issue for computer experts; it is a human behavior problem. It depends on whether students and staff understand the risks, know how to spot a digital trap, and actually take the steps to keep their accounts safe. Without this human layer of defense, even the most advanced artificial intelligence tools become dangerous, potentially exposing private data or undermining the trust required for education to function.

A researcher from the Public Authority for Applied Education and Training in Kuwait set out to understand exactly how well the people in this digital classroom are handling these risks. Focusing on seven higher education institutions across Kuwait, the study examined the relationship between what people know about cybersecurity, what they know about specific threats, and what they actually do to stay safe. The researcher surveyed 270 students and staff members, asking them to rate their own understanding of security concepts, their awareness of common dangers like phishing emails or malware, and their daily habits, such as using strong passwords or updating software. The goal was to see if knowledge translates into action. In a world where universities are rapidly adopting artificial intelligence, the question is whether the people using these tools are equipped to protect them.

The results revealed a clear, positive connection between knowing and doing. The study found that individuals who possessed a stronger grasp of cybersecurity concepts and a better awareness of specific cyber threats were significantly more likely to engage in secure digital behaviors. When the researcher analyzed the data, the link was consistent: those who understood the rules of the road were more likely to drive safely. This relationship held true even when accounting for differences in age, gender, or whether the participant was a student or a staff member. The data showed that knowledge acts as a powerful predictor of behavior. If a person understands what a cyber threat looks like and knows the principles of keeping their data safe, they are statistically more likely to apply those principles in their daily digital life. This finding supports the idea that education is a critical tool for security; teaching people about risks does not just fill their minds with facts, it changes how they interact with technology.

However, the study also uncovered a gap between what people know and what they consistently do. While the link between knowledge and practice was strong, it was not perfect. The data showed that many participants reported moderate levels of knowledge but did not always translate that into flawless security habits. A significant portion of the respondents admitted they had never received any formal training on cybersecurity. This suggests that while knowing the rules helps, it is not a magic shield that guarantees perfect behavior. The environment matters. Even if a student knows they should use a strong password, they might not do it if the university does not make it easy, or if they do not see their professors modeling that behavior. The research indicated that gender played a role in these habits, with noticeable differences in how men and women reported their security practices, though age did not appear to be a major factor. This points to a need for training that is not just about information, but about building a culture where safe behavior is the norm.

The implications of these findings extend directly to the future of artificial intelligence in education. The study did not measure how well people could spot AI-specific tricks, such as deepfake audio or AI-generated phishing emails, because the survey focused on established, conventional threats. However, the researcher argues that the foundation laid by conventional security knowledge is essential for navigating these new risks. If a student cannot recognize a standard phishing email, they are unlikely to recognize a sophisticated, AI-generated one that looks even more convincing. The study suggests that universities cannot treat cybersecurity as a separate, technical checkbox. Instead, it must be woven into the fabric of digital and AI literacy. As institutions in Kuwait and beyond move toward a future where learning is powered by artificial intelligence, they must ensure that their students and staff are not just users of technology, but guardians of it.

The path forward involves more than just handing out passwords. It requires a shift in how universities approach education. The researcher proposes that cybersecurity awareness should be a core part of the learning experience, taught alongside how to use AI tools responsibly. This means regular, mandatory training for both students and staff, clear policies on how data is handled, and a commitment to modeling safe behavior. It also means recognizing that different groups may need different approaches to learning these skills. By strengthening the human element of security, universities can build a digital environment that is not only innovative but also resilient. In this way, the trust required for personalized, AI-driven learning can be maintained, ensuring that the digital transformation of education remains a force for good rather than a source of vulnerability.

=== SUMMARY ===

Technical Summary: Cybersecurity Awareness for AI-Enabled Learning Environments in Kuwait

1. Problem Statement

Higher education institutions (HEIs) in the Gulf Cooperation Council (GCC) region, specifically Kuwait, are undergoing rapid digital transformation driven by Artificial Intelligence (AI), learning analytics, and cloud-based platforms. While these technologies enable personalized learning and data-informed decision-making, they expand the attack surface for cyber threats. Despite the critical nature of secure digital environments for the trustworthiness of AI-enabled learning, there is a scarcity of empirical evidence regarding the human dimensions of cybersecurity within GCC HEIs.

Existing research often treats AI-in-education, learning analytics, and cybersecurity as separate tracks. Furthermore, while national strategies like Kuwait Vision 2035 emphasize digital transformation, there is limited empirical data on the specific levels of cybersecurity knowledge, threat awareness, and secure practices among students and staff in Kuwaiti HEIs. This study addresses the gap by investigating whether cybersecurity knowledge and cyber threat knowledge predict cybersecurity practices in this specific context, and discusses the implications of these findings for the safe adoption of AI in education.

2. Methodology

Research Design:
The study employed a quantitative, cross-sectional survey design. Data were collected between October and December 2025 from seven higher education institutions in Kuwait.

Participants:

Sample Size: 270 valid participants (after excluding 4 incomplete responses from an initial 274).
Demographics: Approximately 88% students and 12% staff. The sample was predominantly female (~86%) and aged 18–24.
Sampling Strategy: Convenience sampling was used due to practical constraints.

Instrument:
A structured online questionnaire with 15 items measured on five-point Likert scales, divided into four sections:

Demographics: Age, gender, role, field of study, institution, year of study.
Cybersecurity Knowledge (CK): Understanding of concepts, policies, and training.
Cyber Threat Knowledge (CTK): Awareness of threats (phishing, malware, ransomware, social engineering).
Cybersecurity Practices (CP): Routine behaviors (password management, updates, antivirus use).

Note: The instrument measured conventional cybersecurity constructs. It did not directly measure AI-specific threat recognition or AI literacy, which are treated as conceptual extensions in the discussion.

Reliability and Validity:

Content Validity: Established through review by subject specialists.
Reliability: Cronbach's alpha for the overall instrument was .870. Sub-scales showed acceptable to good reliability: CK (.724), CTK (.827), and CP (.764).

Analytical Approach:
Data were analyzed using IBM SPSS Statistics version 29. Due to non-normal distribution (confirmed by Kolmogorov–Smirnov and Shapiro–Wilk tests), non-parametric techniques were used:

Spearman's Rank Correlation: To examine relationships between constructs.
Ordinal Logistic Regression: To test the hypothesis that CK and CTK predict CP, controlling for demographic variables (age, gender, role, etc.).
Subgroup Analysis: Mann-Whitney U and Kruskal-Wallis H tests for gender, role, and age differences.

3. Key Results

Descriptive Statistics:
Respondents reported moderate mean levels for all three constructs (CK: M=2.87, CTK: M=2.83, CP: M=3.00 on a 5-point scale). A significant proportion of respondents reported no prior formal cybersecurity training, indicating a gap between the need for security and the provision of formal education.

Correlation Analysis:

CK and CTK: Moderate-to-strong positive correlation ( $\rho = .543, p < .001$ ).
CK and CP: Moderate positive correlation ( $\rho = .422, p < .001$ ).
CTK and CP: Moderate positive correlation ( $\rho = .420, p < .001$ ).
These results indicate that individuals with higher knowledge levels tend to exhibit more secure behaviors.

Ordinal Logistic Regression:
The regression model confirmed the study's central hypothesis (H1). Both Cybersecurity Knowledge and Cyber Threat Knowledge were significant, independent positive predictors of Cybersecurity Practices, even after controlling for demographic variables.

Cybersecurity Knowledge: $B = .943, p < .001$ .
Cyber Threat Knowledge: $B = .520, p < .001$ .
Model Fit Note: The model included six multi-level categorical covariates, leading to a high number of parameters relative to the sample size ( $N=270$ ). While this resulted in Hessian-matrix singularities for some demographic controls, the estimates for the focal predictors (CK and CTK) remained stable and statistically significant.

Exploratory Subgroup Differences:

Gender: Significant differences were found across all three constructs ( $p < .05$ ).
Role (Student vs. Staff): No significant difference in knowledge (CK or CTK), but a significant difference in Practices ( $p = .040$ ), suggesting that while students and staff possess similar knowledge, their actual security behaviors differ.
Age: No significant differences were found across age groups.

4. Key Contributions

The paper outlines five specific contributions:

Empirical Evidence: Provides the first known empirical data on cybersecurity knowledge, threat awareness, and practices within Kuwait's higher education sector, using a statistically validated model.
Integration of Literatures: Connects cybersecurity awareness research with AI-in-education and learning analytics literature, which have previously developed in isolation.
Theoretical Extension: Applies Protection Motivation Theory (PMT), Theory of Planned Behaviour (TPB), and Socio-Technical Systems Theory (STS) to the context of AI-supported higher education, demonstrating how these frameworks explain secure behavior in digital learning environments.
Conceptual Framework: Proposes a conceptual model (distinct from the tested empirical model) positioning cybersecurity awareness as a foundational capability for trustworthy AI-enabled learning, digital resilience, and educational quality.
Practical Guidance: Offers evidence-based recommendations for Kuwaiti HEIs, distinguishing between findings grounded in the current data and forward-looking recommendations for AI-specific governance.

5. Significance and Claims

The paper claims that cybersecurity knowledge and threat awareness are significant predictors of secure digital behavior in Kuwaiti HEIs. However, the author maintains a modest stance regarding the implications for AI:

Direct Findings: The study confirms that knowledge predicts practice in the context of conventional threats (phishing, malware, etc.).
Conceptual Extension (Not Directly Tested): The paper argues that while conventional knowledge is a necessary foundation, it may be insufficient for the specific risks posed by AI (e.g., deepfakes, prompt injection, AI-generated social engineering). The author explicitly states that the survey did not measure AI-specific threat recognition.
Implication: The gap between "knowing" and "doing" observed in the data suggests that cybersecurity training must move beyond one-off sessions to include modeling, practice, and institutional reinforcement.
Policy Relevance: The findings support the human-capability objectives of Kuwait's National Cybersecurity Strategy and Vision 2035, suggesting that future research and policy must explicitly address AI literacy and governance alongside traditional cybersecurity.

The study concludes that strengthening conventional cybersecurity awareness is a prerequisite for digital resilience, but that institutions must simultaneously develop new instruments and frameworks to measure and address the unique risks introduced by AI-enabled learning environments.