Explore publications.

How users perceive and respond to cybersecurity warning messages under cognitively demanding conditions can result in unintended cybersecurity failures. Digital banking environments can create cognitively demanding conditions, as users are required to make quick decisions while managing many other routine tasks. This can lead to cognitive overload and pressure to comply with cybersecurity warning messages. This study examined how cybersecurity messages are framed and how this framing could influence behavioural responses under cognitively demanding conditions. The study draws on behavioural and psychological perspectives, including the Cognitive Bias Theory, the Framing Effect, and the Cognitive Load Theory, offering critical insights into compliance cybersecurity behaviour. A quantitative survey was administered to 267 South African users in digital banking environments. Path analysis, an extension of multiple regression analysis, was used to examine the relationships among message framing, mental load, and familiarity bias, and how these factors influence behaviour, thereby impacting digital banking resilience. Findings showed that, for organisations in digital banking to be cybersecurity resilient, such resilience is largely shaped by message framing and cognitive processing load. This means message framing is a central behavioural mechanism that shapes behaviour and an organisation's overall cybersecurity posture. Similarly, mental load affects behaviour change, meaning that concerted cognitive pressures will influence users’ ability to engage with cybersecurity warnings. Familiarity bias was negatively associated with desired behaviour change, highlighting a risk of habitual reliance on familiar cybersecurity messages. The study contributes to ongoing cybersecurity research on aligning cybersecurity communication with users’ cognitive capacity, prompting institutions to rethink and redesign clear, cognitively efficient security messages that support decision-making under pressure.

Cybersecurity threats pose a growing challenge for organizations in digitally dependent economies, with South African organizations facing increasing incidents of data breaches and ransomware, among other threats. This study investigates how organizations can enhance cybersecurity resilience by aligning data privacy regulations with business resilience strategies. A quantitative survey of 201 professionals across multiple industries in South Africa was conducted, guided by Protection Motivation Theory (PMT), Diffusion of Innovation Theory (DIT), and Resilience Theory. Analysis revealed that while organizations perceive the severity of cyber threats, internal threat perception alone does not drive innovation. Instead, external regulatory and institutional pressures emerged strong driver of cybersecurity innovation, which in turn strengthens cybersecurity resilience. Based on these insights, a Cybersecurity Resilience Model was developed as a defence mechanism against cybersecurity threats and attacks.

Cybersecurity is an urgent concern for small and medium enterprises (SMEs) in Uganda, driven by the rapid digital transformation of businesses and increasing dependence on online platforms. This study explores Ugandan SMEs' cybersecurity challenges, highlighting prevalent cyber threats, risk exposure, and a cyber maturity typology to mitigate cybercrime effectively. Using a qualitative, descriptive research design based on secondary data and a literature review, the study examines how Digital, Blended, and Traditional Business Models influence SMEs' cybersecurity preparedness. A key contribution of this research is the development of a context-sensitive typology of SME cyber maturity, which categorises businesses as Traditional, Transitioning, Digitally Enabled, and Digitally Mature, aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework but adapted to Uganda's unique environment. The study identifies ongoing issues such as data breaches, financial fraud, and weak digital infrastructure, as well as gaps in policy enforcement and the disconnect between cybersecurity regulations and SME operators' literacy levels, as key cybersecurity threats. Informal responses to cybercrime, including vigilante actions, are also highlighted. This study provides a maturity typology for SMEs that guides policymakers and business owners in improving cybersecurity practices in Ugandan SMEs. The study calls for multi-stakeholder collaboration, stronger regulatory enforcement, and scalable awareness programs to build a more resilient SME sector. Overall, this study contributes to the discourse on SME cybersecurity by proposing literacy-sensitive interventions tailored to the needs of Uganda and offering a foundation for future research into the effectiveness of Uganda's cybersecurity frameworks.

The Payment Card Industry Data Security Standard (PCI DSS) was introduced in 2004.  It aimto strengthen payment card security and reduce fraud through a set of global requirements for entities that process, store, or transmit cardholder data. Despite widespread adoption, payment card data breaches remain common, raising questions about the effectiveness of PCI DSS as a comprehensive security solution. Institutional theory is used to explain how organisations may adopt PCI DSS for symbolic legitimacy rather than substantive security, leading to a disconnect between formal compliance and operational resilience. By reviewing academic literature, industry reports and case studies, including regional perspectives from South Africa and Botswana, this paper examines the challenges of PCI DSS. Findings show that big breaches often happen when companies fail to follow the PCI DSS. The study further shows that, in some cases, firms that pass compliance checks may still be at risk since audits may not capture real-world weaknesses in their everyday security practices. Despite its importance, PCI DSS faces notable limitations. Compliance can be resource-intensive, requiring significant financial, human and technical investment, which poses challenges mostly for smaller organisations. Further, the standard often lags behind evolving cyber threats, creating a gap between formal compliance and actual security effectiveness. Based on the findings, this paper suggests that PCI DSS should not be seen as a complete solution; companies require additional compliance to guard their safety. The study recommends the strengthening of the PCI DSS to incorporate emerging technologies, shifting focus from compliance to resilience and fostering a security culture supported by adaptive monitoring and regional enforcement.