Aware but Vulnerable: The Student Cybersecurity Paradox Hiding in Class Group Chats

Every click a student makes on a class WhatsApp group, every file downloaded from a shared cloud folder, every online form completed under deadline pressure is not just an act of learning — it is a security decision. A new study from a public university in Ghana suggests that these decisions are far from uniform across the student body, and that the students most at risk of cyberattack are not the ones who know the least about cybersecurity. They are, paradoxically, the ones who know the most.

The research, published in Discover Education, surveyed 372 undergraduate students and applied a statistical technique called latent profile analysis to sort them into distinct cybersecurity risk profiles based on three measures: their social media usage patterns, their self-reported cybersecurity awareness, and their cybersecurity vulnerability — the frequency of risky digital practices such as weak password use, unsafe browsing, insecure account management, impulsive clicking and information oversharing. Rather than treating students as a single homogeneous risk group, the person-centred approach asked what types of students actually exist before any intervention is designed.

Four profiles emerged from the analysis. The largest group, the moderate baseline profile, showed comparatively near-average scores across all three indicators. The low-exposure low-risk profile captured students who used digital and social platforms less frequently and therefore encountered fewer risky situations. The digitally engaged protected profile was perhaps the most counterintuitive: these students were above-average social media users with slightly above-average awareness, yet they reported low vulnerability. High digital engagement, in other words, can coexist with safe practice.

But the profile that carries the greatest theoretical weight is the aware-but-vulnerable group, comprising over one-quarter of the sample. These students combined above-average social media use, high cybersecurity awareness and high cybersecurity vulnerability. They know that password reuse is dangerous, that suspicious links should be verified, that personal data submitted through online forms can be harvested — and they do these things anyway. The finding strikes directly at the founding assumption of most cybersecurity education: that greater awareness leads to safer behaviour.

Behavioural cybersecurity research has long hinted at this gap between knowing and doing. Protection Motivation Theory, originally proposed by Rogers, explains protective behaviour through two processes: threat appraisal, which is how seriously people judge a threat and their own exposure to it, and coping appraisal, which is whether they believe the recommended action will work, feel capable of performing it, and perceive the effort as manageable. A student may fully recognise that a link shared in a class group could be malicious, but click it anyway because it appears urgent, academic or posted by a trusted class representative. The secure action feels slower than the immediate one, and under academic pressure, immediacy wins.

The structure of platform-dependent higher education intensifies the problem. Students in the study context moved across institutional email, class messaging groups, social media platforms, cloud storage, online forms and peer-managed digital spaces to access materials, coordinate group work and respond to course information. Where formal learning management systems are rigid or unresponsive, informal spaces — class WhatsApp groups, Telegram channels, peer-managed folders — become practical extensions of the learning environment. These spaces carry announcements, assignment alerts, note sharing and links to study resources, but they also normalise rapid, trust-based sharing in which link verification and source authentication become especially difficult. The boundary between official and peer-mediated communication blurs, and with it, the student’s ability to distinguish legitimate academic content from phishing, impersonation or deceptive forms.

Habit compounds the risk. Research on phishing susceptibility has shown that vulnerability is shaped not only by knowledge but by suspicion, cognition and automaticity — the tendency to carry out online actions with less cognitive engagement after repeating them in similar contexts. Students open emails, access links, download files and reply to messages many times a day, and the more repetitive these practices become, the more complacent and automatic they grow. Studies have also linked risky cybersecurity behaviour to impulsivity, problematic internet use and habitual social media use that promotes clicking and sharing without adequate risk appraisal. The aware-but-vulnerable profile is the empirical embodiment of this pattern: a student who knows that clicking phishing links is bad, but whose habits, learned through the structure of their digital life, drive unreflective clicks.

The statistical analysis revealed that profile membership differed significantly by academic level and college, but not by gender or age. Second-year and third-year students were significantly more likely than first-year students to belong to the aware-but-vulnerable profile, while fourth-year students did not differ significantly from first-years. A plausible interpretation is that middle-year students engage more heavily in group work, online submissions, peer coordination, internship preparation and platform switching, increasing their exposure to links, files and informal digital communication while already possessing enough experience to recognise risks. The cross-sectional design means this should be read as an association rather than evidence of developmental change, but the practical implication is clear: cybersecurity support cannot be confined to first-year orientation.

The findings argue for a fundamental redesign of cybersecurity education in higher education. General awareness campaigns may raise average knowledge, but they are unlikely to help the aware-but-vulnerable student, who does not need more information — they need structured, practice-based opportunities to translate awareness into secure behaviour during realistic academic tasks. That might mean scenario-based exercises on checking links shared in class groups, identifying suspicious online forms, verifying sender authenticity, managing passwords across academic accounts, enabling multi-factor authentication and reporting suspicious messages through clear institutional channels. Universities could also govern the informal spaces students already rely on, using verified course-representative accounts, lecturer-approved communication protocols, official link markers indicating institutional origin and standard labelling for official forms, so students can distinguish legitimate academic communication from suspicious content.

The study also carries a broader message about digital literacy. Online safety is increasingly framed as a core component of responsible digital participation in competence frameworks such as DigComp 2.2, positioning cybersecurity not as a specialist technical issue but as part of the competence required for learning and communication. Yet a digitally literate student may still act unsafely if the surrounding environment promotes convenience, urgency and trust-based sharing. The problem is not a deficit of intelligence or skill, but a gap between knowledge and context. Safe digital participation, the researchers argue, is a task for both the individual and the environment: students must be knowledgeable and confident, but institutions must also build safer communication channels, robust reporting mechanisms and guidance embedded in the everyday learning spaces where security decisions are actually made.

The research has limitations. The data were self-reported and cross-sectional, collected at a single public university in Ghana, and the awareness measure captured security orientation rather than objectively tested technical knowledge. The confirmatory factor analysis showed mixed model fit, and the researchers caution that the awareness and vulnerability measures should be read as broad composite indicators rather than narrow unidimensional constructs. Future work should validate the four-profile structure across other institutions, disciplines and national contexts, use longitudinal designs to track how students move between profiles, and incorporate behavioural tasks such as phishing simulations rather than relying solely on self-report.

Still, the core finding is hard to dismiss. In a higher education system increasingly organised through overlapping formal and informal digital platforms, cybersecurity vulnerability is not simply a lack of knowledge. It is a situated pattern of behaviour shaped by academic progression, platform dependence, peer-mediated communication and routine digital practice. The students who most need help are not the uninformed — they are the informed, the engaged and the overwhelmed, clicking through the same group chats where they learn. Until cybersecurity education meets them there, in the platforms and pressures of their actual academic lives, the paradox will persist.

Subject of Research: Cybersecurity

Article Title: Cybersecurity risk profiles of undergraduate students in platform dependent higher education

Article References: Appau, E., Essel, H. B., Techie-Menson, A., Akuteye, A. D., & Amagyei, B. (2026). Cybersecurity risk profiles of undergraduate students in platform dependent higher education. Discover Education, 5(1), Article 1181. https://doi.org/10.1007/s44217-026-02308-w

Image Credits: AI Generated

DOI: 10.1007/s44217-026-02308-w

Keywords: cybersecurity, higher education, latent profile analysis, digital learning, phishing, social media, behavioral science, risk, profiles, undergraduate, students, platform