One-Hour Cybersecurity Training Shifts Turkish Teens’ Habits and Self-Perception

Turkey ranked among the most cyber-threatened countries in the world when researchers from Gebze Technical University set out to test whether a single hour of classroom instruction could change how teenagers behave online. According to a Kaspersky conference report cited in the study, 41.8 percent of Turkish users had been affected by online threats, the highest share in the Middle East, Turkey and Africa region, and a Surfshark analysis placed Turkey fifth globally in breached accounts during the second quarter of 2023. Against that backdrop, the research team delivered a standardized one-hour cybersecurity training to four different types of high schools in the Darica district and measured what changed in the same students before and after the session.

The study, published in Discover Education, is notable for how it defines its target. Rather than treating cybersecurity awareness as a single quality a person either has or lacks, the researchers grounded their survey in two behavioral models widely used in information security research: Protection Motivation Theory and the Health Belief Model. Protection Motivation Theory holds that people perform two appraisals before acting on a warning: a threat appraisal, weighing how serious and likely a danger is, and a coping appraisal, weighing whether the recommended behavior actually works and whether they can perform it. The Health Belief Model, originally developed to explain preventive health behavior, adds that people act when they believe they are susceptible, that the consequences are serious, that a behavior is beneficial, that barriers can be overcome, and that an external trigger, a cue to action, sets the process in motion. A structured training session, in this framing, is a deliberate cue to action aimed at shifting specific beliefs rather than raising one undifferentiated awareness level.

To measure those beliefs, the team administered a five-point Likert-type survey online to pilot high schools drawn from four school types: an Anatolian High School, a Girls’ Anatolian Imam Hatip High School, a Vocational and Technical Anatolian High School, and a Science High School. The first survey ran between November and December 2024. Instructors from the Department of Management Information Systems at Gebze Technical University, including research assistants and associate professors with expertise in information systems and cybersecurity, then delivered the same one-hour session in each school’s conference hall between February and March 2025. The training assumed no prior knowledge and covered basic cybersecurity concepts and terminology, personal security measures, and practical guidance on identifying fraudulent websites and misleading content, supported by examples, visual demonstrations and selected videos. The same survey was sent again in April 2025.

Of 1029 student responses before the training and 870 after, only students who completed both surveys and could be matched by school and student number were kept, producing a final paired sample of 601. The researchers acknowledge that this attrition was not random: chi-square comparisons between matched and unmatched students showed differences on gender, school and grade, and matching rates ranged from 15.6 percent to 86.7 percent across the four schools. The findings therefore describe the matched participants rather than the full baseline population.

The survey’s structure emerged from a principal component analysis on the pre-training responses, which produced a five-dimensional scale with acceptable overall internal consistency, Cronbach’s alpha of 0.86. The Kaiser-Meyer-Olkin measure of 0.905 and a significant Bartlett sphericity test confirmed the data were suitable for factor analysis, and the five factors, with initial eigenvalues of 6.24, 2.07, 1.30, 1.15 and 1.08, accounted for 56.42 percent of the total variance. The dimensions were conceptual awareness of cybersecurity, covering knowledge of malware, firewalls and social engineering; action-oriented behaviors, covering device authentication, email checking and password security; awareness of advanced protection mechanisms such as VPNs and two-factor authentication; security in online interactions and transactions, combining cyberbullying and card-security items; and digital risk tendency and privacy management, covering unsecured networks and credential sharing in gaming or streaming. Two-item subscales showed lower internal consistency and were interpreted with caution.

Paired-samples t-tests on the 601 matched students revealed a pattern the authors describe as mixed. Scores on action-oriented protective behaviors rose significantly, which the researchers interpret as a strengthening of coping appraisal in Protection Motivation Theory terms: students increasingly believed that protective measures were useful and within their reach. In contrast, self-reported scores on the conceptual-knowledge dimensions declined significantly, with a similar and more pronounced decrease on the advanced protection mechanisms factor. One plausible reading, the authors suggest, draws on the Dunning-Kruger effect: students who had overestimated their familiarity with cybersecurity terminology may have judged themselves more realistically after the training. Because the study measured only self-assessment and not actual knowledge, the same decline could equally reflect response-shift bias, the instability of a short self-report measure, or a real drop in reported confidence, so the interpretation is offered tentatively rather than as proven fact.

The most concrete evidence came from a practical task embedded at the end of the survey. Participants judged ten website screenshots, eight fraudulent and two genuine, designed from real-world attack cases and deliberately containing cues such as urgent requests, mismatches between displayed URLs and embedded hyperlinks, grammatical errors and abnormal visual design. McNemar tests showed that correct identification improved significantly on four of the fraudulent screens, for example rising from 50.4 percent to 63.9 percent on one item. The improvement was not uniform: no significant change appeared on two fraudulent screens, one of which 87.2 percent of students already identified correctly before the training, and correct identification decreased on two fraudulent screens that already had high pre-training rates. For the two genuine screens, accuracy did not improve and declined significantly on one, from 94.0 percent to 89.7 percent, meaning students became somewhat more likely to label legitimate pages as fraudulent. The authors suggest future training should give more attention to distinguishing fraudulent from genuine pages rather than treating every page as suspicious.

Demographic comparisons revealed differences that shifted in complex ways. Before the training, male students scored significantly higher on the knowledge-oriented dimensions, with the largest gap on conceptual awareness, where male students averaged 3.46 against 2.87 for female students, an effect size of d = 0.68. Female students scored higher on the online interaction and privacy dimensions. After the training, the gap on conceptual awareness disappeared, with female students averaging 2.47 and male students 2.39, while the difference on advanced protection mechanisms reversed in direction, reflecting a larger decline among male students rather than a gain among female students. Across schools, the Girls’ Anatolian Imam Hatip High School scored significantly lower than the other three schools on conceptual awareness before the training, yet after the training the school means converged, ranging from 2.29 to 2.47, and the between-school difference was no longer statistically significant. The authors caution that because the study included no control group and no time-by-school or time-by-gender interaction was tested, these are described as observed differences at each time point rather than as evidence that the training equalized the groups. Grade level, from 9th through 12th, was not a meaningful source of variation on any dimension.

The authors are careful about what the design can and cannot show. Because the same students were measured before and after without a comparison group, the results are interpreted as changes associated with the training rather than definitive proof of cause, and part of the measured change may reflect growing familiarity with the questions. The four pilot schools were purposively selected from a single district, each school type was represented by a single institution, and one all-girls school means the gender findings are partly confounded with school composition. Many statistical tests were conducted without correction for multiple comparisons, so individual significant results, especially the smaller between-group differences and the item-level screen comparisons, are treated as tentative, with more weight placed on the overall pattern.

Within those limits, the study supports integrating standardized cybersecurity training into secondary education. The training appears to have worked mainly as a cue to action in Health Belief Model terms, prompting students to apply protective measures, while strengthening the coping appraisal described by Protection Motivation Theory. The authors suggest that a single program spanning all high school grades may be a practical approach, given that grade-level means were similar before and after the training, and that standardized school-wide training may be more practical than curricula tailored to individual schools. They propose extending the research to pilot schools from different districts to examine the influence of school location, and to middle schools, since children are starting to use the internet at increasingly younger ages and the benefits of introducing cybersecurity education earlier remain to be examined.

Subject of Research: Cybersecurity

Article Title: Evaluation of cybersecurity awareness among high school students in Turkey before and after training

Article References: Cubukcu Cerasi, C., Erat, S., Huseynov, F., Kilic, A., Ozdenizci Kose, B., & Saritoprak, B. (2026). Evaluation of cybersecurity awareness among high school students in Turkey before and after training. Discover Education, 5(1), Article 1194. https://doi.org/10.1007/s44217-026-02338-4

Image Credits: AI Generated

DOI: 10.1007/s44217-026-02338-4

Keywords: cybersecurity awareness, high school students, Turkey, phishing, cybersecurity education, Protection Motivation Theory, Health Belief Model, digital literacy, Evaluation, cybersecurity, awareness, high