Exploring the perceived awareness–behaviour gap in AI-enabled phishing: a socio-technical perspective informed by complex adaptive systems

Artificial intelligence is reshaping phishing by enabling increasingly personalised, scalable, and psychologically persuasive attacks. Although cybersecurity awareness remains important, knowledge may not consistently translate into protective action when users encounter contextual pressures or insufficient institutional support. This study examines the perceived awareness–behaviour gap in an AI-enabled phishing context through a complex adaptive socio-technical systems perspective. A cross-sectional survey of 300 university students was analysed using partial least squares structural equation modelling (PLS-SEM). The individual-level analysis captured students’ perceptions of system awareness, institutional support, feedback and reinforcement, adaptive response capacity, and self-reported protective behaviour. System Awareness was positively associated with Adaptive Response Capacity (β = 0.612, p < 0.001), as was Perceived Institutional Support (β = 0.441, p < 0.001). Perceived Feedback and Reinforcement was positively associated with Self-Reported Protective Behaviour (β = 0.536, p < 0.001). These findings provide exploratory, perception-based evidence that students’ reported cybersecurity responses are associated with both individual awareness and perceived institutional conditions. The cross-sectional design does not directly capture temporal adaptation, co-evolution, system emergence, actual behaviour, or responses to experimentally presented AI-generated phishing attacks. Complex Adaptive Systems theory is therefore employed as an explanatory perspective rather than as a directly tested dynamic model. The study extends socio-technical cybersecurity research by integrating awareness, perceived institutional support, feedback, adaptive response capacity, and reported protective practices within a unified framework relevant to university-based cybersecurity interventions.