Research Article

Prioritizing cybersecurity education: A needs assessment of Thai student digital behaviors and security competencies

Jiraphong Chanthaphot 1 , Thiyaporn Kantathanawat 1 * , Paitoon Pimdee 1 , Kanchana Boonphak 1 , Mai Charoentham 1
More Detail
1 School of Industrial Education and Technology, King Mongkut’s Institute of Technology Ladkrabang, Bangkok, THAILAND* Corresponding Author
Contemporary Educational Technology, 18(4), October 2026, ep703, https://doi.org/10.30935/cedtech/19937
Published: 11 November 2026
OPEN ACCESS   19 Views   14 Downloads
Download Full Text (PDF)

ABSTRACT

Undergraduate university students are particularly susceptible to cyberattacks; however, increased awareness does not always translate into protective actions. To close this gap in cybersecurity behavior (CSB), this study identified priority needs for educational intervention among Thai undergraduate university students across six key dimensions: password (CSB-PW), social media (CSB-SM), application (CSB-AP), email (CSB-EM), mobile device security (CSB-MD), and security incident reporting (CSB-IR). A sample of 190 second-year Thai undergraduates completed a validated 60-item needs assessment questionnaire. Data were analyzed using SPSS 29/R 4.3 descriptive statistics, dependent-samples t-tests, and the modified priority needs index (PNImodified). Results revealed a statistically significant gap (p < .001) between students’ current behavior (mean [M] = 3.303, standard deviation [SD] = 1.018, competence) and their desired behavior (M = 4.471, SD = 0.788, proficiency). The overall priority needs index was 0.354. Dimension rankings from highest to lowest priority were mobile device security (PNImodified = 0.371), email security (PNImodified = 0.366), security incident reporting (PNImodified = 0.364), application security (PNImodified = 0.363), social media security (PNImodified = 0.359), and password security (PNImodified = 0.298). These results raise doubts about the effectiveness of standard cybersecurity classes that teach how to manage passwords and imply that future educational interventions should focus on securing email and mobile devices through self-efficacy approaches.
Keywords: cybersecurity behavior, email security, mobile security, needs assessment, phishing, Thailand

CITATION (APA)

Chanthaphot, J., Kantathanawat, T., Pimdee, P., Boonphak, K., & Charoentham, M. (2026). Prioritizing cybersecurity education: A needs assessment of Thai student digital behaviors and security competencies. Contemporary Educational Technology, 18(4), ep703. https://doi.org/10.30935/cedtech/19937

REFERENCES

  1. Akeiber, H. J. (2025). The evolution of social engineering attacks: A cybersecurity engineering perspective. Al-Rafidain Journal of Engineering Sciences, 3(1), 294-316. https://doi.org/10.61268/r9c49865
  2. Alqahtani, M. A. (2022). Factors affecting cybersecurity awareness among university students. Applied Sciences, 12(5), Article 2589. https://doi.org/10.3390/app12052589
  3. Alsaad, A., & Al-Okaily, M. (2022). Acceptance of protection technology in a time of fear: The case of COVID-19 exposure detection apps. Information Technology & People, 35(3), 1116-1135. https://doi.org/10.1108/ITP-10-2020-0719
  4. Aroonsiwagool, A., Tuntiwongwanich, S., Pimdee, P., Meedee, C., & Moto, S. (2025). Assessing instructors’ perceptions of critical skills in computational thinking and block-based programming: A needs assessment approach. International Journal of Instruction, 18(2), 245-260. https://doi.org/10.29333/iji.2025.18214a
  5. Bandura, A. (2023). Cultivate self-efficacy for personal and organizational effectiveness. In E. A. Locke, & C. Pearce (Eds.), Principles of organizational behavior: The handbook of evidence-based management (3rd ed., pp. 113-135). Wiley. https://doi.org/10.1002/9781394320769.ch6
  6. Beyer, C. (2014). Mobile security: A literature review. International Journal of Computer Applications, 97(8), 9-11. https://doi.org/10.5120/17025-7315
  7. Bland, J. M., & Altman, D. G. (1995). Multiple significance tests: The Bonferroni method. BMJ, 310(6973), Article 170. https://doi.org/10.1136/bmj.310.6973.170
  8. Borriraklert, A., & Kiattisin, S. (2021). User experience design (UXD) competency model: Identifying well-rounded proficiency for user experience designers in the digital age. Archives of Design Research, 34(3), 61-79. https://doi.org/10.15187/adr.2021.08.34.3.61
  9. Chaihanchanchai, P., & Anantachart, S. (2024). Unveiling the uses and gratifications of social media: A comparative study of Thai generation Y Internet users in Bangkok and upcountry. Journal of Mekong Societies, 20(1), 48-72.
  10. Chimnoy, W., Xupravati, P., & Siribanjitak, P. (2023). Academic management strategies of private elementary schools based on the concept of quality citizenship attributes in the 21st century. Kasetsart Journal of Social Sciences, 44(4), 1039-1050. https://doi.org/10.34044/j.kjss.2023.44.4.08
  11. Civaner, M. M., Uncu, Y., Bulut, F., Chalil, E. G., & Tatli, A. (2022). Artificial intelligence in medical education: A cross-sectional needs assessment. BMC Medical Education, 22, Article 772. https://doi.org/10.1186/s12909-022-03852-3
  12. Datta, P., & Acton, T. (2025). Promises and perils of generative AI in cybersecurity. MIS Quarterly Executive, 24(2), 167-184. https://doi.org/10.17705/2msqe.00115
  13. Daudi, M. (2024). Exploiting human trust in cybersecurity: Which trust development process is predominant in phishing attacks? Applied Cybersecurity & Internet Governance, 3, 1-22. https://doi.org/10.60097/acig/199452
  14. Dodel, M., & Mesch, G. (2019). Cyber-victimization preventive behavior: A health belief model approach. Computers in Human Behavior, 94, 107-117. https://doi.org/10.1016/j.chb.2016.11.044
  15. Hadlington, L. (2017). Human factors in cybersecurity: Examining the link between Internet addiction, impulsivity, attitudes towards cybersecurity, and risky cybersecurity behaviours. Heliyon, 3(7), Article e00346. https://doi.org/10.1016/j.heliyon.2017.e00346
  16. Hoonsopon, D., Ketkaew, C., Puriwat, W., Viriyasitavat, W., & Tripopsakul, S. (2025). How digital health literacy affects willingness to adopt telemedicine in an emerging country: The case of Thailand. SAGE Open, 15(3), Article 21582440251378068. https://doi.org/10.1177/21582440251378068
  17. House, N. (2026). Phishing statistics [2026]: Latest attack data & trends. StationX. https://app.stationx.net/articles/phishing-statistics
  18. Hunsapun, N. (2023). Exploring trends and insights of information literacy education in Asian countries [PhD thesis, National Taiwan Normal University].
  19. Intarakamhang, U., Tuntivivat, S., Pattrawiwat, K., Prasittichok, P., Pichaisamart, N., Thaksin, S., & Wongthong, P. (2025). Validity of measurement and causal model of online scam protection behavior among risk Thai students. European Journal of Educational Research, 14(2), 661-675. https://doi.org/10.12973/eu-jer.14.2.661
  20. International Telecommunication Union. (2024). Facts and figures 2024. ITU. https://www.itu.int/itu-d/reports/statistics/2024/11/10/ff24-internet-use
  21. Janpirom, C., Tuntiwongwanich, S., Pimdee, P., Kulworatit, C., & Moto, S. (2025). Lecturers’ perspectives on undergraduate students’ innovative thinking skills and creative problem-solving skills: A comparative needs analysis. International Journal of Instruction, 18(3), 121-140. https://doi.org/10.29333/iji.2025.1837a
  22. Jittam, P., Sriwattanarothai, N., Ketpichainarong, W., Chenprakhon, P., & Pichitpornchai, C. (2026). From classroom to online learning during the COVID-19 transition in Thailand: A mixed-methods study of pedagogical transformation and digital resilience in science-based faculties. Journal of Innovative Learning, 2(1), 45-57.
  23. Kemp, S. (2025). Digital 2026: Thailand. DataReportal. https://datareportal.com/reports/digital-2026-thailand
  24. Khamcharoen, N., Kantathanawat, T., & Sukkamart, A. (2022). Developing student creative problem-solving skills (CPSS) using online digital storytelling: A training course development method. International Journal of Emerging Technologies in Learning, 17(11), 17-34. https://doi.org/10.3991/ijet.v17i11.29931
  25. Khong-ngam, S., Wongwanich, S., & Piromsombat, C. (2014). Principals’ and teachers’ use of evaluation results for student learning in science. Procedia – Social and Behavioral Sciences, 116, 1902-1907. https://doi.org/10.1016/j.sbspro.2014.01.492
  26. Kovačević, A., Putnik, N., & Tošković, O. (2020). Factors related to cyber security behavior. IEEE Access, 8, 125140-125148. https://doi.org/10.1109/ACCESS.2020.3007867
  27. Kraiwanit, T., Limna, P., Sonsuphap, R., & Chutipat, V. (2025). Predictors of digital fraud: Evidence from Thailand. Journal of Risk and Financial Management, 18(12), Article 671. https://doi.org/10.3390/jrfm18120671
  28. Krejcie, R. V., & Morgan, D. W. (1970). Determining sample size for research activities. Educational and Psychological Measurement, 30(3), 607-610. https://doi.org/10.1177/001316447003000308
  29. Kruger, H. A., & Kearney, W. D. (2006). A prototype for assessing information security awareness. Computers & Security, 25(4), 289-296. https://doi.org/10.1016/j.cose.2006.02.008
  30. La Barbera, F., & Ajzen, I. (2020). Control interactions in the theory of planned behavior: Rethinking the role of subjective norm. Europe’s Journal of Psychology, 16(3), 401-417. https://doi.org/10.5964/ejop.v16i3.2056
  31. Lallie, H. S., Thompson, A., Titis, E., & Stephens, P. (2025). Analysing cyber attacks and cyber security vulnerabilities in the university sector. Computers, 14(2), Article 49. https://doi.org/10.3390/computers14020049
  32. Lapmak, R. (2025). Industry outlook 2025-2027: Data center industry. Krungsri Research. https://www.krungsri.com/en/research/industry/industry-outlook/services/data-center/io/io-data-center-2025-2027
  33. Li, L., Xu, L., & He, W. (2022). The effects of antecedents and mediating factors on cybersecurity protection behavior. Computers in Human Behavior Reports, 5, Article 100165. https://doi.org/10.1016/j.chbr.2021.100165
  34. McCormac, A., Zwaans, T., Parsons, K., Calic, D., Butavicius, M., & Pattinson, M. (2017). Individual differences and information security awareness. Computers in Human Behavior, 69, 151-156. https://doi.org/10.1016/j.chb.2016.11.065
  35. Mohsin, K. (2025). Cybercrime and privacy in the digital age: Legal frameworks, emerging challenges, and future trends. SSRN. https://doi.org/10.2139/ssrn.5169894
  36. Nantha, C., Siripongdee, K., Siripongdee, S., Pimdee, P., Kantathanawat, T., & Boonsomchuae, K. (2024). Enhancing ICT literacy and achievement: A TPACK-based blended learning model for Thai business administration students. Education Sciences, 14(5), Article 455. https://doi.org/10.3390/educsci14050455
  37. National Research Council of Thailand. (2024). Research standards & ethics: Strengthening quality, integrity and responsible research in Thailand. NRCT. https://en.nrct.go.th/hilghlight/detail/490
  38. Parsons, K., McCormac, A., Butavicius, M., Pattinson, M., & Jerram, C. (2014). Determining employee awareness using the human aspects of information security questionnaire (HAIS-Q). Computers & Security, 42, 165-176. https://doi.org/10.1016/j.cose.2013.12.003
  39. Pimdee, P., Sukkamart, A., Nantha, C., Kantathanawat, T., & Leekitchwatana, P. (2024). Enhancing Thai student-teacher problem-solving skills and academic achievement through a blended problem-based learning approach in online flipped classrooms. Heliyon, 10(7), Article e29172. https://doi.org/10.1016/j.heliyon.2024.e29172
  40. Pimsalee, S., Sukkamart, A., Pimdee, P., & Meedee, C. (2026). Prioritizing software development skill needs for Thai pre-service computer technology teachers. Contemporary Educational Technology, 18(2), Article ep638. https://doi.org/10.30935/cedtech/18039
  41. Pollini, A., Callari, T. C., Tedeschi, A., Ruscio, D., Save, L., Chiarugi, F., & Guerri, D. (2022). Leveraging human factors in cybersecurity: An integrated methodological approach. Cognition, Technology & Work, 24(2), 371-390. https://doi.org/10.1007/s10111-021-00683-y
  42. Prasittichok, P., & Klaykaew, K. K. (2022). Meta-skills development needs assessment among undergraduate students. Heliyon, 8(1), Article e08787. https://doi.org/10.1016/j.heliyon.2022.e08787
  43. Pushsapavardhana, N. (2025). Social media usage and cyberbullying: Experiences and coping strategies among secondary school students in Surat Thani, Thailand. Humanities, Arts and Social Sciences Studies, 25(3), 550-566. https://doi.org/10.69598/hasss.25.3.278093
  44. Rosenberg, H., Blondheim, M., & Sabag-Ben Porat, C. (2025). Who in the world is generation Z? The rise of mobile natives and their socio-technological identity. Societies, 15(11), Article 314. https://doi.org/10.3390/soc15110314
  45. Salahdine, F., & Kaabouch, N. (2019). Social engineering attacks: A survey. Future Internet, 11(4), Article 89. https://doi.org/10.3390/fi11040089
  46. Samae, N., Boonmongkol, P., Ojanen, T. T., Samakkeekharom, R., & Guadamuz, T. E. (2014). Youth perceptions on cyberbullying. Journal of Behavioral Science for Development, 6(1), 1-14.
  47. Shahid, J., Hameed, M. K., Javed, I. T., Qureshi, K. N., Ali, M., & Crespi, N. (2022). A comparative study of web application security parameters: Current trends and future directions. Applied Sciences, 12(8), Article 4077. https://doi.org/10.3390/app12084077
  48. Siddiqi, M. A., Pak, W., & Siddiqi, M. A. (2022). A study on the psychology of social engineering-based cyberattacks and existing countermeasures. Applied Sciences, 12(12), Article 6042. https://doi.org/10.3390/app12126042
  49. Singh, A. S., & Masuku, M. B. (2014). Sampling techniques and determination of sample size in applied statistics research: An overview. International Journal of Economics, Commerce and Management, 2(11), 1-22.
  50. Sommestad, T., Karlzén, H., & Hallberg, J. (2015). The sufficiency of the theory of planned behavior for explaining information security policy compliance. Information and Computer Security, 23(2), 200-217. https://doi.org/10.1108/ICS-04-2014-0025
  51. Sureeyatanapas, P., Srisawasdi, N., & Sureeyatanapas, P. (2024). A need analysis of English proficiency in engineering graduates: Perspectives of the world’s leading companies in Thailand. European Journal of Engineering Education, 49(6), 1179-1202. https://doi.org/10.1080/03043797.2024.2377314
  52. Susyanto, S., Mulyanti, R. Y., & Rini, N. (2026). Extending protection motivation theory for organizational cybersecurity behavior: A systematic literature review. Jurnal Ilmiah Ilmu Terapan Universitas Jambi, 10(2), 1114-1131. https://doi.org/10.22437/jiituj.v10i2.54776
  53. Tanti, R. (2024). Phishing attack: A case study and their prevention techniques. International Journal for Multidisciplinary Research, 6(5), 1-43. https://doi.org/10.36948/ijfmr.2024.v06i05.29087
  54. Techagaisiyavanit, W., Mingmontchaikul, B., & Keitleartthum, S. (2026). Navigating ethical challenges in research ethics approval: A case study of social science research in Thailand. Research Ethics, 22(1), 81-104. https://doi.org/10.1177/17470161251336573
  55. Verizon. (2026). 2026 data breach investigations report. Verizon Business. https://www.verizon.com/business/resources/reports/dbir/
  56. Vishwanath, A., Herath, T., Chen, R., Wang, J., & Rao, H. R. (2011). Why do people get phished? Testing individual differences in phishing vulnerability within an integrated, information processing model. Decision Support Systems, 51(3), 576-586. https://doi.org/10.1016/j.dss.2011.03.002
  57. Wongwanich, S., Sakolrak, S., & Piromsombat, C. (2014). Needs for Thai teachers to become a reflective teacher: Mixed methods needs assessment research. Procedia – Social and Behavioral Sciences, 116, 1645-1650. https://doi.org/10.1016/j.sbspro.2014.01.450
  58. Wuttikamonchai, O., Pimdee, P., Ployduangrat, J., & Sukkamart, A. (2024). A needs assessment evaluation of information technology student mobile website design skills. Contemporary Educational Technology, 16(1), Article ep494. https://doi.org/10.30935/cedtech/14173
  59. Yang, J., & Chuenterawong, P. (2025). Rethinking crisis response: Cross-cultural insights from comparing American and Korean corporate apologies. International Journal of Communication, 19, 47-69.
  60. Yurayat, P., & Seechaliao, T. (2021). Needs assessment to develop online counseling program. International Education Studies, 14(7), 59-71. https://doi.org/10.5539/ies.v14n7p59
  61. Zimba, A., Phiri, K., Kashale, C., & Phiri, M. (2025). Unveiling deception: A socio-economic analysis of smishing attacks on mobile money transaction users. Humanities and Social Sciences Communications, 12, Article 1880. https://doi.org/10.1057/s41599-025-06141-8