Explore publications.

How users perceive and respond to cybersecurity warning messages under cognitively demanding conditions can result in unintended cybersecurity failures. Digital banking environments can create cognitively demanding conditions, as users are required to make quick decisions while managing many other routine tasks. This can lead to cognitive overload and pressure to comply with cybersecurity warning messages. This study examined how cybersecurity messages are framed and how this framing could influence behavioural responses under cognitively demanding conditions. The study draws on behavioural and psychological perspectives, including the Cognitive Bias Theory, the Framing Effect, and the Cognitive Load Theory, offering critical insights into compliance cybersecurity behaviour. A quantitative survey was administered to 267 South African users in digital banking environments. Path analysis, an extension of multiple regression analysis, was used to examine the relationships among message framing, mental load, and familiarity bias, and how these factors influence behaviour, thereby impacting digital banking resilience. Findings showed that, for organisations in digital banking to be cybersecurity resilient, such resilience is largely shaped by message framing and cognitive processing load. This means message framing is a central behavioural mechanism that shapes behaviour and an organisation's overall cybersecurity posture. Similarly, mental load affects behaviour change, meaning that concerted cognitive pressures will influence users’ ability to engage with cybersecurity warnings. Familiarity bias was negatively associated with desired behaviour change, highlighting a risk of habitual reliance on familiar cybersecurity messages. The study contributes to ongoing cybersecurity research on aligning cybersecurity communication with users’ cognitive capacity, prompting institutions to rethink and redesign clear, cognitively efficient security messages that support decision-making under pressure.

Cybersecurity threats pose a growing challenge for organizations in digitally dependent economies, with South African organizations facing increasing incidents of data breaches and ransomware, among other threats. This study investigates how organizations can enhance cybersecurity resilience by aligning data privacy regulations with business resilience strategies. A quantitative survey of 201 professionals across multiple industries in South Africa was conducted, guided by Protection Motivation Theory (PMT), Diffusion of Innovation Theory (DIT), and Resilience Theory. Analysis revealed that while organizations perceive the severity of cyber threats, internal threat perception alone does not drive innovation. Instead, external regulatory and institutional pressures emerged strong driver of cybersecurity innovation, which in turn strengthens cybersecurity resilience. Based on these insights, a Cybersecurity Resilience Model was developed as a defence mechanism against cybersecurity threats and attacks.

As digitalization is on the increase, deposit money banks are faced with heightened exposure to cyber threats, which pose significant risks to their financial performance and operational stability. This study investigated how cybersecurity investment and cyber insurance affected the profitability of deposit money banks, to know whether preemptive cybersecurity management strategies and transfer of risk through insurance influence financial results in the banking sector. The results revealed that both cybersecurity investment and cyber insurance have significant positive effects on bank profitability, with coefficients of 7.832 (p < 0.01) and 17.08 (p < 0.05), respectively. The study also revealed that cybersecurity investment provides more accurate estimates than cyber insurance which is reflected in its narrower confidence intervals. The results emphasize the strategic role of cybersecurity investment and insurance to improve financial flexibility, reduce operational risk, and support enduring profitability. It concluded that banks that prioritize these strategies will not only mitigate possible losses from cyber incidents but also gain a competitive advantage through strengthened customer trust and operational efficiency. The study recommended that Nigerian deposit money banks should treat cyber insurance as a vital component of cyber risk management strategies. It is also recommended that bank management should treat cybersecurity expenditure as value-adding investments rather than operational costs.

Cybersecurity is an urgent concern for small and medium enterprises (SMEs) in Uganda, driven by the rapid digital transformation of businesses and increasing dependence on online platforms. This study explores Ugandan SMEs' cybersecurity challenges, highlighting prevalent cyber threats, risk exposure, and a cyber maturity typology to mitigate cybercrime effectively. Using a qualitative, descriptive research design based on secondary data and a literature review, the study examines how Digital, Blended, and Traditional Business Models influence SMEs' cybersecurity preparedness. A key contribution of this research is the development of a context-sensitive typology of SME cyber maturity, which categorises businesses as Traditional, Transitioning, Digitally Enabled, and Digitally Mature, aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework but adapted to Uganda's unique environment. The study identifies ongoing issues such as data breaches, financial fraud, and weak digital infrastructure, as well as gaps in policy enforcement and the disconnect between cybersecurity regulations and SME operators' literacy levels, as key cybersecurity threats. Informal responses to cybercrime, including vigilante actions, are also highlighted. This study provides a maturity typology for SMEs that guides policymakers and business owners in improving cybersecurity practices in Ugandan SMEs. The study calls for multi-stakeholder collaboration, stronger regulatory enforcement, and scalable awareness programs to build a more resilient SME sector. Overall, this study contributes to the discourse on SME cybersecurity by proposing literacy-sensitive interventions tailored to the needs of Uganda and offering a foundation for future research into the effectiveness of Uganda's cybersecurity frameworks.

Cybersecurity remains the priority of higher learning institutions owing to the growing cyber deviance against institution infrastructure as well its constituents and the implications those have on the institution. This section evaluates the cybersecurity defences, security policies which the institutions have in place to prevent and respond to emerging cybercrimes. This case study evaluates, Univen Information Communication Technology (ICT) officials who hold the mandate to manage cybercrimes within the institution. It therefore, evaluates if Univen have institutional framework for managing cybersecurity risk. It also assesses if it has been efficient to counteract cybercrimes impact against the university and students. The study discovered that Univen doesn’t have cybersecurity policy that is knowledgeable and consumable by all students. Students don’t know of avenues to report cybercrime. The students are failing to observe the terms of updating password for student ITS and Microsoft account, making their systems vulnerable and susceptible to cyberattacks. Qualitative approach is applied in the study; purposive sampling is applied to sample five (5) Univen ICT officials. The research utilises the routine activities theory and differential association theory of crime as the study problem framework. Sample was selected based on their suitability of contributing towards research; Focus group discussions was held with sample participants to collect data and Thematic Content Analysis (TCA), was used to analyse qualitative data. Ethical considerations observed in this study include: voluntary participation, confidentiality, obtain ethical clearance to conduct data. The study made findings and recommendations that inform adoption of framework to manage cybercrimes within higher education institutions (HEI) of South Africa and offer alternatives programmes that can positively address cyber incidents within academia.    

The Payment Card Industry Data Security Standard (PCI DSS) was introduced in 2004.  It aimto strengthen payment card security and reduce fraud through a set of global requirements for entities that process, store, or transmit cardholder data. Despite widespread adoption, payment card data breaches remain common, raising questions about the effectiveness of PCI DSS as a comprehensive security solution. Institutional theory is used to explain how organisations may adopt PCI DSS for symbolic legitimacy rather than substantive security, leading to a disconnect between formal compliance and operational resilience. By reviewing academic literature, industry reports and case studies, including regional perspectives from South Africa and Botswana, this paper examines the challenges of PCI DSS. Findings show that big breaches often happen when companies fail to follow the PCI DSS. The study further shows that, in some cases, firms that pass compliance checks may still be at risk since audits may not capture real-world weaknesses in their everyday security practices. Despite its importance, PCI DSS faces notable limitations. Compliance can be resource-intensive, requiring significant financial, human and technical investment, which poses challenges mostly for smaller organisations. Further, the standard often lags behind evolving cyber threats, creating a gap between formal compliance and actual security effectiveness. Based on the findings, this paper suggests that PCI DSS should not be seen as a complete solution; companies require additional compliance to guard their safety. The study recommends the strengthening of the PCI DSS to incorporate emerging technologies, shifting focus from compliance to resilience and fostering a security culture supported by adaptive monitoring and regional enforcement.