Cybersecurity Training and Behavioural Risk in Higher Education: A Mixed-Methods Study with Benchmarked Predictive Modelling

Cybersecurity awareness and training programmes are widely implemented in higher education institutions, yet their association with employees’ behavioural risk remains insufficiently quantified. Using an explanatory sequential mixed-methods design, this study analysed survey responses from 167 faculty, staff and managers in United Arab Emirates higher education institutions and 22 semi-structured interviews. Behavioural risk was operationalised as a 0–100 score derived exclusively from five self-reported secure-behaviour items, so that no predictor contributed to the outcome. Respondents who reported attending institutional training had substantially lower behavioural risk than those who had not (13.4 vs. 40.8; Hedges’ g = 1.07), and training exposure explained 15.2% of additional variance after controlling for role. This association was transmitted through policy knowledge (indirect β = −0.52, 95% CI [−0.69, −0.35]) and was not independent of perceived cybersecurity culture and technical readiness; culture did not moderate it. In leakage-safe repeated cross-validation, simpler models predicted behavioural risk better (support vector regression, R2 = 0.73) than the proposed deep feedforward network (R2 = 0.28). Interviews described absent, optional or awareness-only training and a weak, compliance-oriented culture. Training appears to be associated with lower risk chiefly through policy knowledge, within a broader institutional security climate.