Prioritizing cybersecurity education: A needs assessment of Thai student digital behaviors and security competencies

Jiraphong Chanthaphot; Thiyaporn Kantathanawat; Paitoon Pimdee; Kanchana Boonphak; Mai Charoentham

doi:10.30935/cedtech/19937

Jiraphong Chanthaphot ¹, Thiyaporn Kantathanawat ¹ ^* , Paitoon Pimdee ¹, Kanchana Boonphak ¹, Mai Charoentham ¹

More Detail

CONT ED TECHNOLOGY, Volume 18, Issue 4, Article No: ep703

https://doi.org/10.30935/cedtech/19937

Submitted: 19 September 2026, Published Online: 11 November 2026

OPEN ACCESS 22 Views 14 Downloads

Download Full Text (PDF)

Abstract

Undergraduate university students are particularly susceptible to cyberattacks; however, increased awareness does not always translate into protective actions. To close this gap in cybersecurity behavior (CSB), this study identified priority needs for educational intervention among Thai undergraduate university students across six key dimensions: password (CSB-PW), social media (CSB-SM), application (CSB-AP), email (CSB-EM), mobile device security (CSB-MD), and security incident reporting (CSB-IR). A sample of 190 second-year Thai undergraduates completed a validated 60-item needs assessment questionnaire. Data were analyzed using SPSS 29/R 4.3 descriptive statistics, dependent-samples t-tests, and the modified priority needs index (PNI_modified). Results revealed a statistically significant gap (p < .001) between students’ current behavior (mean [M] = 3.303, standard deviation [SD] = 1.018, competence) and their desired behavior (M = 4.471, SD = 0.788, proficiency). The overall priority needs index was 0.354. Dimension rankings from highest to lowest priority were mobile device security (PNI_modified= 0.371), email security (PNI_modified= 0.366), security incident reporting (PNI_modified= 0.364), application security (PNI_modified= 0.363), social media security (PNI_modified= 0.359), and password security (PNI_modified= 0.298). These results raise doubts about the effectiveness of standard cybersecurity classes that teach how to manage passwords and imply that future educational interventions should focus on securing email and mobile devices through self-efficacy approaches.

Keywords: cybersecurity behavior, email security, mobile security, needs assessment, phishing, Thailand

References

Akeiber, H. J. (2025). The evolution of social engineering attacks: A cybersecurity engineering perspective. Al-Rafidain Journal of Engineering Sciences, 3(1), 294-316. https://doi.org/10.61268/r9c49865
Alqahtani, M. A. (2022). Factors affecting cybersecurity awareness among university students. Applied Sciences, 12(5), Article 2589. https://doi.org/10.3390/app12052589
Alsaad, A., & Al-Okaily, M. (2022). Acceptance of protection technology in a time of fear: The case of COVID-19 exposure detection apps. Information Technology & People, 35(3), 1116-1135. https://doi.org/10.1108/ITP-10-2020-0719
Aroonsiwagool, A., Tuntiwongwanich, S., Pimdee, P., Meedee, C., & Moto, S. (2025). Assessing instructors’ perceptions of critical skills in computational thinking and block-based programming: A needs assessment approach. International Journal of Instruction, 18(2), 245-260. https://doi.org/10.29333/iji.2025.18214a
Bandura, A. (2023). Cultivate self-efficacy for personal and organizational effectiveness. In E. A. Locke, & C. Pearce (Eds.), Principles of organizational behavior: The handbook of evidence-based management (3rd ed., pp. 113-135). Wiley. https://doi.org/10.1002/9781394320769.ch6
Beyer, C. (2014). Mobile security: A literature review. International Journal of Computer Applications, 97(8), 9-11. https://doi.org/10.5120/17025-7315
Bland, J. M., & Altman, D. G. (1995). Multiple significance tests: The Bonferroni method. BMJ, 310(6973), Article 170. https://doi.org/10.1136/bmj.310.6973.170
Borriraklert, A., & Kiattisin, S. (2021). User experience design (UXD) competency model: Identifying well-rounded proficiency for user experience designers in the digital age. Archives of Design Research, 34(3), 61-79. https://doi.org/10.15187/adr.2021.08.34.3.61
Chaihanchanchai, P., & Anantachart, S. (2024). Unveiling the uses and gratifications of social media: A comparative study of Thai generation Y Internet users in Bangkok and upcountry. Journal of Mekong Societies, 20(1), 48-72.
Chimnoy, W., Xupravati, P., & Siribanjitak, P. (2023). Academic management strategies of private elementary schools based on the concept of quality citizenship attributes in the 21^st century. Kasetsart Journal of Social Sciences, 44(4), 1039-1050. https://doi.org/10.34044/j.kjss.2023.44.4.08
Civaner, M. M., Uncu, Y., Bulut, F., Chalil, E. G., & Tatli, A. (2022). Artificial intelligence in medical education: A cross-sectional needs assessment. BMC Medical Education, 22, Article 772. https://doi.org/10.1186/s12909-022-03852-3
Datta, P., & Acton, T. (2025). Promises and perils of generative AI in cybersecurity. MIS Quarterly Executive, 24(2), 167-184. https://doi.org/10.17705/2msqe.00115
Daudi, M. (2024). Exploiting human trust in cybersecurity: Which trust development process is predominant in phishing attacks? Applied Cybersecurity & Internet Governance, 3, 1-22. https://doi.org/10.60097/acig/199452
Dodel, M., & Mesch, G. (2019). Cyber-victimization preventive behavior: A health belief model approach. Computers in Human Behavior, 94, 107-117. https://doi.org/10.1016/j.chb.2016.11.044
Hadlington, L. (2017). Human factors in cybersecurity: Examining the link between Internet addiction, impulsivity, attitudes towards cybersecurity, and risky cybersecurity behaviours. Heliyon, 3(7), Article e00346. https://doi.org/10.1016/j.heliyon.2017.e00346
Hoonsopon, D., Ketkaew, C., Puriwat, W., Viriyasitavat, W., & Tripopsakul, S. (2025). How digital health literacy affects willingness to adopt telemedicine in an emerging country: The case of Thailand. SAGE Open, 15(3), Article 21582440251378068. https://doi.org/10.1177/21582440251378068
House, N. (2026). Phishing statistics [2026]: Latest attack data & trends. StationX. https://app.stationx.net/articles/phishing-statistics
Hunsapun, N. (2023). Exploring trends and insights of information literacy education in Asian countries [PhD thesis, National Taiwan Normal University].
Intarakamhang, U., Tuntivivat, S., Pattrawiwat, K., Prasittichok, P., Pichaisamart, N., Thaksin, S., & Wongthong, P. (2025). Validity of measurement and causal model of online scam protection behavior among risk Thai students. European Journal of Educational Research, 14(2), 661-675. https://doi.org/10.12973/eu-jer.14.2.661
International Telecommunication Union. (2024). Facts and figures 2024. ITU. https://www.itu.int/itu-d/reports/statistics/2024/11/10/ff24-internet-use
Janpirom, C., Tuntiwongwanich, S., Pimdee, P., Kulworatit, C., & Moto, S. (2025). Lecturers’ perspectives on undergraduate students’ innovative thinking skills and creative problem-solving skills: A comparative needs analysis. International Journal of Instruction, 18(3), 121-140. https://doi.org/10.29333/iji.2025.1837a
Jittam, P., Sriwattanarothai, N., Ketpichainarong, W., Chenprakhon, P., & Pichitpornchai, C. (2026). From classroom to online learning during the COVID-19 transition in Thailand: A mixed-methods study of pedagogical transformation and digital resilience in science-based faculties. Journal of Innovative Learning, 2(1), 45-57.
Kemp, S. (2025). Digital 2026: Thailand. DataReportal. https://datareportal.com/reports/digital-2026-thailand
Khamcharoen, N., Kantathanawat, T., & Sukkamart, A. (2022). Developing student creative problem-solving skills (CPSS) using online digital storytelling: A training course development method. International Journal of Emerging Technologies in Learning, 17(11), 17-34. https://doi.org/10.3991/ijet.v17i11.29931
Khong-ngam, S., Wongwanich, S., & Piromsombat, C. (2014). Principals’ and teachers’ use of evaluation results for student learning in science. Procedia – Social and Behavioral Sciences, 116, 1902-1907. https://doi.org/10.1016/j.sbspro.2014.01.492
Kovačević, A., Putnik, N., & Tošković, O. (2020). Factors related to cyber security behavior. IEEE Access, 8, 125140-125148. https://doi.org/10.1109/ACCESS.2020.3007867
Kraiwanit, T., Limna, P., Sonsuphap, R., & Chutipat, V. (2025). Predictors of digital fraud: Evidence from Thailand. Journal of Risk and Financial Management, 18(12), Article 671. https://doi.org/10.3390/jrfm18120671
Krejcie, R. V., & Morgan, D. W. (1970). Determining sample size for research activities. Educational and Psychological Measurement, 30(3), 607-610. https://doi.org/10.1177/001316447003000308
Kruger, H. A., & Kearney, W. D. (2006). A prototype for assessing information security awareness. Computers & Security, 25(4), 289-296. https://doi.org/10.1016/j.cose.2006.02.008
La Barbera, F., & Ajzen, I. (2020). Control interactions in the theory of planned behavior: Rethinking the role of subjective norm. Europe’s Journal of Psychology, 16(3), 401-417. https://doi.org/10.5964/ejop.v16i3.2056
Lallie, H. S., Thompson, A., Titis, E., & Stephens, P. (2025). Analysing cyber attacks and cyber security vulnerabilities in the university sector. Computers, 14(2), Article 49. https://doi.org/10.3390/computers14020049
Lapmak, R. (2025). Industry outlook 2025-2027: Data center industry. Krungsri Research. https://www.krungsri.com/en/research/industry/industry-outlook/services/data-center/io/io-data-center-2025-2027
Li, L., Xu, L., & He, W. (2022). The effects of antecedents and mediating factors on cybersecurity protection behavior. Computers in Human Behavior Reports, 5, Article 100165. https://doi.org/10.1016/j.chbr.2021.100165
McCormac, A., Zwaans, T., Parsons, K., Calic, D., Butavicius, M., & Pattinson, M. (2017). Individual differences and information security awareness. Computers in Human Behavior, 69, 151-156. https://doi.org/10.1016/j.chb.2016.11.065
Mohsin, K. (2025). Cybercrime and privacy in the digital age: Legal frameworks, emerging challenges, and future trends. SSRN. https://doi.org/10.2139/ssrn.5169894
Nantha, C., Siripongdee, K., Siripongdee, S., Pimdee, P., Kantathanawat, T., & Boonsomchuae, K. (2024). Enhancing ICT literacy and achievement: A TPACK-based blended learning model for Thai business administration students. Education Sciences, 14(5), Article 455. https://doi.org/10.3390/educsci14050455
National Research Council of Thailand. (2024). Research standards & ethics: Strengthening quality, integrity and responsible research in Thailand. NRCT. https://en.nrct.go.th/hilghlight/detail/490
Parsons, K., McCormac, A., Butavicius, M., Pattinson, M., & Jerram, C. (2014). Determining employee awareness using the human aspects of information security questionnaire (HAIS-Q). Computers & Security, 42, 165-176. https://doi.org/10.1016/j.cose.2013.12.003
Pimdee, P., Sukkamart, A., Nantha, C., Kantathanawat, T., & Leekitchwatana, P. (2024). Enhancing Thai student-teacher problem-solving skills and academic achievement through a blended problem-based learning approach in online flipped classrooms. Heliyon, 10(7), Article e29172. https://doi.org/10.1016/j.heliyon.2024.e29172
Pimsalee, S., Sukkamart, A., Pimdee, P., & Meedee, C. (2026). Prioritizing software development skill needs for Thai pre-service computer technology teachers. Contemporary Educational Technology, 18(2), Article ep638. https://doi.org/10.30935/cedtech/18039
Pollini, A., Callari, T. C., Tedeschi, A., Ruscio, D., Save, L., Chiarugi, F., & Guerri, D. (2022). Leveraging human factors in cybersecurity: An integrated methodological approach. Cognition, Technology & Work, 24(2), 371-390. https://doi.org/10.1007/s10111-021-00683-y
Prasittichok, P., & Klaykaew, K. K. (2022). Meta-skills development needs assessment among undergraduate students. Heliyon, 8(1), Article e08787. https://doi.org/10.1016/j.heliyon.2022.e08787
Pushsapavardhana, N. (2025). Social media usage and cyberbullying: Experiences and coping strategies among secondary school students in Surat Thani, Thailand. Humanities, Arts and Social Sciences Studies, 25(3), 550-566. https://doi.org/10.69598/hasss.25.3.278093
Rosenberg, H., Blondheim, M., & Sabag-Ben Porat, C. (2025). Who in the world is generation Z? The rise of mobile natives and their socio-technological identity. Societies, 15(11), Article 314. https://doi.org/10.3390/soc15110314
Salahdine, F., & Kaabouch, N. (2019). Social engineering attacks: A survey. Future Internet, 11(4), Article 89. https://doi.org/10.3390/fi11040089
Samae, N., Boonmongkol, P., Ojanen, T. T., Samakkeekharom, R., & Guadamuz, T. E. (2014). Youth perceptions on cyberbullying. Journal of Behavioral Science for Development, 6(1), 1-14.
Shahid, J., Hameed, M. K., Javed, I. T., Qureshi, K. N., Ali, M., & Crespi, N. (2022). A comparative study of web application security parameters: Current trends and future directions. Applied Sciences, 12(8), Article 4077. https://doi.org/10.3390/app12084077
Siddiqi, M. A., Pak, W., & Siddiqi, M. A. (2022). A study on the psychology of social engineering-based cyberattacks and existing countermeasures. Applied Sciences, 12(12), Article 6042. https://doi.org/10.3390/app12126042
Singh, A. S., & Masuku, M. B. (2014). Sampling techniques and determination of sample size in applied statistics research: An overview. International Journal of Economics, Commerce and Management, 2(11), 1-22.
Sommestad, T., Karlzén, H., & Hallberg, J. (2015). The sufficiency of the theory of planned behavior for explaining information security policy compliance. Information and Computer Security, 23(2), 200-217. https://doi.org/10.1108/ICS-04-2014-0025
Sureeyatanapas, P., Srisawasdi, N., & Sureeyatanapas, P. (2024). A need analysis of English proficiency in engineering graduates: Perspectives of the world’s leading companies in Thailand. European Journal of Engineering Education, 49(6), 1179-1202. https://doi.org/10.1080/03043797.2024.2377314
Susyanto, S., Mulyanti, R. Y., & Rini, N. (2026). Extending protection motivation theory for organizational cybersecurity behavior: A systematic literature review. Jurnal Ilmiah Ilmu Terapan Universitas Jambi, 10(2), 1114-1131. https://doi.org/10.22437/jiituj.v10i2.54776
Tanti, R. (2024). Phishing attack: A case study and their prevention techniques. International Journal for Multidisciplinary Research, 6(5), 1-43. https://doi.org/10.36948/ijfmr.2024.v06i05.29087
Techagaisiyavanit, W., Mingmontchaikul, B., & Keitleartthum, S. (2026). Navigating ethical challenges in research ethics approval: A case study of social science research in Thailand. Research Ethics, 22(1), 81-104. https://doi.org/10.1177/17470161251336573
Verizon. (2026). 2026 data breach investigations report. Verizon Business. https://www.verizon.com/business/resources/reports/dbir/
Vishwanath, A., Herath, T., Chen, R., Wang, J., & Rao, H. R. (2011). Why do people get phished? Testing individual differences in phishing vulnerability within an integrated, information processing model. Decision Support Systems, 51(3), 576-586. https://doi.org/10.1016/j.dss.2011.03.002
Wongwanich, S., Sakolrak, S., & Piromsombat, C. (2014). Needs for Thai teachers to become a reflective teacher: Mixed methods needs assessment research. Procedia – Social and Behavioral Sciences, 116, 1645-1650. https://doi.org/10.1016/j.sbspro.2014.01.450
Wuttikamonchai, O., Pimdee, P., Ployduangrat, J., & Sukkamart, A. (2024). A needs assessment evaluation of information technology student mobile website design skills. Contemporary Educational Technology, 16(1), Article ep494. https://doi.org/10.30935/cedtech/14173
Yang, J., & Chuenterawong, P. (2025). Rethinking crisis response: Cross-cultural insights from comparing American and Korean corporate apologies. International Journal of Communication, 19, 47-69.
Yurayat, P., & Seechaliao, T. (2021). Needs assessment to develop online counseling program. International Education Studies, 14(7), 59-71. https://doi.org/10.5539/ies.v14n7p59
Zimba, A., Phiri, K., Kashale, C., & Phiri, M. (2025). Unveiling deception: A socio-economic analysis of smishing attacks on mobile money transaction users. Humanities and Social Sciences Communications, 12, Article 1880. https://doi.org/10.1057/s41599-025-06141-8

Citation

Chanthaphot, J., Kantathanawat, T., Pimdee, P., Boonphak, K., & Charoentham, M. (2026). Prioritizing cybersecurity education: A needs assessment of Thai student digital behaviors and security competencies. Contemporary Educational Technology, 18(4), Article ep703. https://doi.org/10.30935/cedtech/19937

Chanthaphot, J., Kantathanawat, T., Pimdee, P., Boonphak, K., and Charoentham, M. (2026). Prioritizing cybersecurity education: A needs assessment of Thai student digital behaviors and security competencies. Contemporary Educational Technology, 18(4), ep703. https://doi.org/10.30935/cedtech/19937

Chanthaphot J, Kantathanawat T, Pimdee P, Boonphak K, Charoentham M. Prioritizing cybersecurity education: A needs assessment of Thai student digital behaviors and security competencies. CONT ED TECHNOLOGY. 2026;18(4), ep703. https://doi.org/10.30935/cedtech/19937

Chanthaphot, Jiraphong, Thiyaporn Kantathanawat, Paitoon Pimdee, Kanchana Boonphak, and Mai Charoentham. "Prioritizing cybersecurity education: A needs assessment of Thai student digital behaviors and security competencies". Contemporary Educational Technology 2026 18 no. 4 (2026): ep703. https://doi.org/10.30935/cedtech/19937

Chanthaphot, Jiraphong et al. "Prioritizing cybersecurity education: A needs assessment of Thai student digital behaviors and security competencies". Contemporary Educational Technology, vol. 18, no. 4, 2026, ep703. https://doi.org/10.30935/cedtech/19937

Chanthaphot J, Kantathanawat T, Pimdee P, Boonphak K, Charoentham M. Prioritizing cybersecurity education: A needs assessment of Thai student digital behaviors and security competencies. CONT ED TECHNOLOGY. 2026;18(4):ep703. https://doi.org/10.30935/cedtech/19937