Cybersecurity in Higher Education Institutions: Awareness, Policy, and Experience on Employee Behaviour

The digital transformation of higher education institutions (HEIs) has introduced unprecedented connectivity and operational efficiency, but it has also heightened their exposure to cyber threats. South African HEIs, in particular, face increasing vulnerability due to their reliance on technology, openness, and diverse user communities. This study examines the influence of the institutional cybersecurity environment on employee cybersecurity-compliant behaviour (CCB), emphasising the critical roles of awareness, policy engagement, and experience. Drawing on Protection Motivation Theory and the Theory of Planned Behaviour, a conceptual model was developed to explore how cybersecurity awareness, policy familiarity, and prior experience shape employees’ attitudes, subjective norms, perceived behavioural control, threat appraisal, and self-efficacy—ultimately driving CCB. Empirical data from 283 HEI employees were analysed using structural equation modelling, ANOVA, and post hoc procedures. Findings reveal that employees with greater awareness of institutional cybersecurity policies demonstrate significantly stronger cybersecurity competencies. The institutional environment has a posit