Introduction

Technology plays a significant role in modern organizations, like educational institutions as it enhances the efficiency of communication, efficiency, and data management. While facing the advantages and reliance of educational institutions into digital systems, it also exposes institutions to cyberattacks such as phishing, ransomware, and unauthorized access.

Huge amounts of confidential information such as documents, records, and data were controlled and managed by educational institutions. Because of factors mentioned, educational institutions become frequent targets of cyberattacks. Studies and reports indicate that human error is one of the primary causes of data breaches, emphasizing the importance of employee awareness and cybersecurity practices.

In the Philippine context, rapid digitalization in education has further increased exposure to cyber risks. Despite technological advancements, gaps in employee awareness and training remain a concern. Therefore, assessing cybersecurity awareness is essential to identify vulnerabilities and develop effective training programs.

Cybersecurity awareness in this study is viewed as a multidimensional construct consisting of knowledge, skills, and attitude, while demographic variables serve as possible influencing factors. Additionally, selected demographic variables may serve as intervening factors that can influence the level of cybersecurity awareness of employees.

Review of Related Literature

Human error plays a critical role in cyberattacks, often due to negligent employee actions that lead to data breaches. Research, including AlKuwari (2024), emphasizes inadequate training and awareness as major contributors to these threats, particularly concerning social engineering tactics like phishing. The National Privacy Commission of the Philippines identifies human error as a primary cause of data breaches in sectors like education, highlighting the necessity for institutions to implement protective measures and comply with the Data Privacy Act of 2012 (RA 10173). Furthermore, Martínez-Peláez et al. (2024) demonstrate that improved cybersecurity training can reduce employee susceptibility to attacks, stressing the importance of integrating cybersecurity education into regular operations.

Moreover, the research highlights that understanding human factors is essential, as employees can be both an organization’s greatest asset and its weakest link in terms of cybersecurity. Nonum et al. (2025) argue that organizations often overlook the importance of employee behavior and decision-making in cybersecurity, leading to vulnerabilities that attackers exploit through trust and authority.

Despite advancements in technical safeguards, human error, particularly in phishing attacks, remains a critical concern, as noted by Alqahtani and Alshahrani (2021). Phishing is a prevalent method of cyberattacks, exploiting cognitive biases and a lack of awareness among employees, which can lead to severe consequences such as data theft and ransomware. This highlights the necessity for organizations to adopt a human-centered cybersecurity strategy that encompasses behavioral science to effectively complement existing technical defenses.

In recent incidents of data breaches involving educational institutions, the University of the Philippines Tacloban College (UPTC) experienced a breach of its Learning Management System, compromising over 1,600 student records. UPTC has implemented preventive actions with guidance from UP Diliman, while the UP System introduced privacy guidelines. Pamantasan ng Lungsod ng Maynila’s official Facebook page was hacked due to phishing, prompting alerts from the Manila City Government. Romblon State University reported a breach leaking sensitive information, leading to collaborations with law enforcement and cybersecurity strategies. Similarly, BTECH’s Facebook Admissions page faced unauthorized access, and Ifugao State University experienced hacking incidents, calling for improved cybersecurity measures. The Department of Education’s Ilocos Norte Division reported a breach affecting three million records, stressing the need for enhanced cybersecurity training in educational institutions.

Ongoing training and simulations are crucial for reducing phishing risks and enhancing cybersecurity awareness among employees. A study by Toth (2025) found that continuous training can reduce phishing attacks by $50\mathrm{\%}$ within six months. Customized training targeting specific departments is also essential, as evidenced by Alenzi and Rusho (2024), which indicated that tailored training can reduce human error incidents by $45\mathrm{\%}-65\mathrm{\%}$ , particularly in non-technical departments lacking cybersecurity knowledge.

Further research by Roy and Francis (2023) highlighted that persistent training diminishes data breaches by addressing human-related factors. Additionally, structured awareness training significantly influences employee behavior, leading to fewer phishing and data mishandling incidents, as noted by Hadlington and Parsons (2021). Creating a supportive training environment that considers cultural factors and using engaging simulation exercises can enhance employee alignment with cybersecurity principles while making learning enjoyable.

Statement of the Problem

This study aims to determine the level of cybersecurity awareness among teaching and non-teaching BTECH employees and to examine whether significant differences and relationships exist among selected variables. The study was specifically designed to address the questions listed below:

1. What is the profile of BTECH employees in terms of:

   1. Age

   2. Sex

   3. Position

   4. Nature of work

   5. Employment status, and

   6. Length of service?

2. What is the level of cybersecurity awareness of employees in terms of:

   1. Knowledge

   2. Skills, and

   3. Attitude?

3. Is there a significant difference in the level of cybersecurity awareness of employees when grouped according to selected demographic variables such as age, sex, position, nature of work, employment status or length of service?

4. Is there a significant relationship among employees’ cybersecurity knowledge, skills, and attitudes with their overall level of cybersecurity awareness?

5. What cybersecurity training programs may be proposed to address the needs of BTECH employees in terms of cybersecurity?

Null Hypothesis $({\mathsf{H}}_0)$

1. There is no significant difference in the level of cybersecurity awareness of employees when grouped according to age, sex, position, nature of work, employment status, and length of service.

2. There is no significant relationship between employees’ level of cybersecurity awareness and their cybersecurity knowledge, skills and attitudes.

Alternative Hypothesis $({\mathsf{H}}_1)$

1. There is a significant difference in the level of cybersecurity awareness of employees when grouped according to age, sex, position, nature of work, employment status, and length of service.

2. There is a significant relationship between employees’ level of cybersecurity awareness and their cybersecurity knowledge, skills and attitudes.

Theoretical and Conceptual Framework

This study examines the intersection of individual behaviors, organizational practices, and attitudes towards cybersecurity, positing that employees’ actions are influenced by their knowledge, skills, and attitudes regarding cyber threat protection. It references the Unified Learning Model (ULM) which suggests that various factors, such as prior knowledge, motivation, and cognitive processing, shape how individuals acquire and utilize knowledge. The ULM implies that an employee’s cybersecurity awareness increases through training and practical experience with institutional systems and tasks.

Additionally, Protective Motivation Theory (PMT) is highlighted, explaining how individuals protect themselves from perceived threats by evaluating the severity and likelihood of those threats (Threat Appraisal) and their ability to respond (Coping Appraisal). The study indicates that employees’ cybersecurity knowledge relates to their awareness of potential cyberattacks and that their skills are indicative of their confidence in employing protective measures. Finally, the study introduces a conceptual framework linking cybersecurity awareness to three vital factors: knowledge (understanding of cybersecurity concepts), skills (ability to apply protective measures), and attitude (perceptions and responsibility towards cybersecurity). A positive attitude enhances the likelihood of adopting precautionary security behaviors.

Paradigm of the Study

Figure [fig:paradigm] illustrates the input-process-output (IPO) model in the context of cybersecurity employee training. The input includes employee profiles along with their knowledge, skills, and attitudes regarding cybersecurity. The process involves the distribution of surveys and statistical analysis aimed at identifying relationships among these variables. The study’s findings catalyzed the formulation of a proposed cybersecurity training program, the main output of this research. This program seeks to enhance participants’ knowledge, bolster their cybersecurity skills, and foster a positive attitude towards cybersecurity, ultimately improving their overall cybersecurity awareness. According to IBM Security (2025), organizations that provide cybersecurity training and educate their employees about various cyberattacks are less likely to experience significant data breaches, thereby highlighting the critical role of human factors in cybersecurity.

Method

Research Design

This study employed a descriptive-quantitative design with comparative and correlational elements to assess the cybersecurity awareness of BTECH employees regarding their knowledge, skills, and attitudes.

The descriptive approach generated an overview of employees’ understanding of sensitive data usage, information protection, password management, and cyberattack identification. Utilizing a Likert scale, the research evaluated employees’ knowledge, skills and attitude. While the comparative aspect investigated differences in awareness across demographic variables such as age, sex, and length of service, analyzed using the independent samples t-test and ANOVA.

Additionally, the study explored correlations between employees’ knowledge, skills, attitudes, and overall cybersecurity awareness via the Pearson Product-Moment Correlation Coefficient, ultimately providing insights into factors influencing cybersecurity readiness among BTECH employees.

Respondents/Participants

The respondents consisted of 190 teaching and non-teaching BTECH employees who are exposed to digital systems and institutions data. This study utilized purposive sampling, this approach ensures that the respondents were relevant to the research objectives by giving accurate information about their current cybersecurity knowledge, skills, and attitudes.

Before obtaining the data needed from the respondents, the researchers informed them regarding the objective of study and asked for their consent. Respondents who declined participation were excluded, while responses found to be invalid or incomplete were removed and not considered in the final analysis. This thorough selection process makes sure that the information mirrors the engagement of employees who are actively engaged with the institution’s digital system and sensitive information.

Questionnaire/Survey Tool

An adopted-modified version of a validated research questionnaire by Nikel and Amaechi (2021) was utilized to assess BTECH employees’ cybersecurity awareness, encompassing their knowledge, skills, and attitudes. Following modifications, the questionnaire was validated by three experts, each with advanced qualifications in relevant fields. Feedback was solicited based on criteria such as clarity, organization, and content adequacy, leading to further enhancements of the instrument to align with the research objectives.

A pilot study involving 30 teaching and non-teaching employees (not the actual respondents of the study) was conducted to evaluate the questionnaire’s reliability, internal consistency, and clarity, providing insights for refinements prior to the main study. The instrument aimed to gauge employees’ knowledge of cybersecurity, their skills in safeguarding institutional data, and their attitudes towards cybersecurity practices. It specifically assessed understanding of cyberattacks, security policies, and principles of data protection, alongside practical skills like secure password management and safe handling of sensitive information.

Furthermore, the instrument measured attitudes towards cybersecurity, highlighting responsibility, risk awareness, and compliance with security measures. The methodology employed a Likert Scale format for responses, facilitating easy analysis and ensuring reliability and validity based on respondents’ perceptions, ultimately offering a thorough evaluation of cybersecurity awareness within the institution.

Subscale Scoring. Each dimension contains 10 items

Scoring Method

Interpretation of Scores per Dimension (Knowledge / Skill / Attitudes)

Overall Cybersecurity Awareness Interpretation

Validation of the Instrument

When all 30 items were analyzed collectively, the instrument obtained a Cronbach’s Alpha of 0.86, indicating good internal consistency. An alpha coefficient above 0.70 suggests that the items are correlated and consistently measure the intended constructs. This result confirms that the questionnaire is reliable and suitable for use in the study. Table [tab:reliability-construct] shows the reliability per construct.

Reliability Per Construct

The reliability analysis results, as presented in Table [tab:reliability-construct], demonstrate an overall Cronbach’s alpha coefficient of 0.86 for the instrument, indicating good internal consistency. This suggests that the items within the constructs of knowledge, skills, and attitude reliably measure the intended constructs. Among these dimensions, attitude exhibited the highest reliability with a coefficient of 0.95, followed by skills at 0.84 and knowledge at 0.78. All reliability values surpass the minimum acceptable threshold of 0.70, confirming the instrument’s statistical reliability for both research and academic purposes.

Results and Discussion

This chapter presents the data gathered from the respondents, along with the analysis and interpretation of the results. The data were obtained through a survey questionnaire distributed to both teaching and non-teaching employees of BTECH. The presentation of data is organized according to the objectives of the study, which include the profile of the respondents, the level of cybersecurity knowledge, skills, and attitude, and the relationship between variables.

The researchers analyzed the profiles of the participants based on several criteria, including age group, sex, position, nature of work, employment status, and length of service. Additional details such as the type of device used for work, the amount of cybersecurity training received, the frequency of attending training, and the level of familiarity with institutional cybersecurity policies were included in the survey instrument.

Distribution of Respondents According to Age

Table [tab:dist-age] shows that most respondents are 41-50 years old (69 respondents, 36.32%), followed closely by 31-40 years old (66 respondents, 34.74%). Respondents aged 21-30 years accounted for 15.79% (30 respondents), 51-60 years for 8.95% (17 respondents), and only 4.21% (8 respondents) were 61 years and above. This distribution reflects the workforce composition of BTECH, where mid-career employees dominate.

Distribution of Respondents According to Sex

The majority of respondents were female (105 respondents, 55.26%), while males comprised 44.74% (85 respondents). Including sex as a demographic variable is important for analyzing potential differences in workplace behavior and cybersecurity awareness (Robbins & Judge, 2017).

Distribution of Respondents According to Position

Most respondents were faculty members (139 respondents, 73.16%), followed by administrative staff (41 respondents, 21.58%). Head Office personnel accounted for 7 respondents (3.68%), while Program Directors were the smallest group with 3 respondents (1.58%).

Distribution of Respondents According to Nature of Work

A majority of respondents (152 respondents, 80%) were engaged in teaching-related work, while 38 respondents (20%) performed non-teaching tasks. Teaching employees frequently interact with computers, institutional databases, and online platforms, highlighting their relevance in assessing cybersecurity knowledge and practices (DoE, 2020; Flores, 2025).

Distribution of Respondents According to Length of Service

Respondents with 5 or more years of service comprised 47.37% (90 respondents), followed by those with 3-4 years at 37.37% (71 respondents). This indicates that employees generally stay long-term in the institution, likely due to job stability, organizational support, and job satisfaction (Camlian & Baron, 2025; Anog, 2024).

Distribution of Respondents According to Employment Status

Most respondents were part-time employees (105 respondents, 55.26%), while permanent employees comprised 44.74% (85 respondents). Including both groups provides a broader understanding of cybersecurity awareness (Pugong, 2025).

Distribution of Respondents According to Device Used

The majority of respondents primarily used desktop computers (97 respondents, 51.05%), followed by laptops (69 respondents, 36.32%) and tablets (24 respondents, 12.63%).

Distribution of Respondents According to Attendance in Cybersecurity Training

Out of 190 respondents, 88 (46.32%) reported having attended cybersecurity training, while 102 (53.68%) had not. This highlights a gap in formal cybersecurity education.

Distribution of Respondents According to Frequency of Training Attendance

Among respondents, 53.68% (102) had never attended training. This demonstrates low participation in regular cybersecurity training.

Awareness of Existing Cybersecurity Policy in the Institution

A majority, 105 respondents (55.26%), reported not being aware of the institution’s cybersecurity policy.

Familiarity with Existing Cybersecurity Policy in the Institution

The majority of respondents (105, 55.26%) were not familiar with the policy.

Weighted Mean for Cybersecurity Knowledge of BTECH Employees

The overall composite mean for knowledge was 3.29 (moderate). Respondents demonstrated high awareness of general practices but remained neutral on technical aspects like firewalls and antivirus updates.

Weighted Mean for Cybersecurity Skills of BTECH Employees

The composite mean for skills was 3.88 (high). Respondents expressed strong recognition of the need for training.

Cybersecurity Attitude of BTECH Employees

The overall composite mean for attitude was 3.47 (moderate). Respondents showed a positive attitude regarding shared responsibility.

Overall Cybersecurity Awareness Summary

The grand mean was 3.55 (moderate). Skills ranked highest, followed by attitude and knowledge.

T-Test comparing Awareness based on Sex

There was no significant difference in cybersecurity awareness based on sex ($p=0.887$).

T-Test Comparing Awareness between Teaching and Non-Teaching Employees

Awareness is consistent across teaching and non-teaching employees ($p=0.195$).

T-Test Comparing Awareness between Permanent and Part-Time Employees

Employment status does not significantly influence cybersecurity awareness ($p=0.486$).

One-Way ANOVA across Different Age Groups

No significant differences in cybersecurity awareness among different age groups ($p=0.287$).

One-Way ANOVA Comparing Awareness across Different Positions

There is a significant difference in cybersecurity awareness based on employees’ positions ($p=0.008$).

One-Way ANOVA based on Length of Service

No significant difference in awareness based on length of service ($p=0.331$).

Correlation Matrix (Relationship among Knowledge, Skills, Attitude, and Awareness)

Correlation analysis indicated a significant positive relationship between overall cybersecurity awareness and each dimension. Skills showed the strongest association with overall awareness.

The study employs the Unified Learning Model (ULM) and Protection Motivation Theory (PMT) to interpret findings. It reveals that awareness is more significantly shaped by common institutional experiences than by demographic factors. Differences between job positions highlight that role impacts exposure to cybersecurity tasks. The findings underscore the necessity for structured and ongoing training programs that enhance knowledge, skills, and attitudes effectively.

Conclusion

A moderate level of cybersecurity awareness among BTECH employees was revealed in this study. While employees generally demonstrate positive attitudes toward cybersecurity practices, there are still gaps in their knowledge and skills that may increase susceptibility to cyberthreats.

Furthermore, the significant relationship among knowledge, skills, attitude, and overall cybersecurity awareness emphasizes the importance of strengthening these factors to enhance employees’ preparedness. Additionally, the relationship between these dimensions confirms that cybersecurity awareness is multidimensional. The results also suggested a significant knowledge gap regarding training and policies, as the majority had never had formal training and were unfamiliar with institutional guidelines.

Given these findings, to enhance employees’ cybersecurity awareness and promote responsible digital behavior, this study proposes a structured cybersecurity training program. This program can contribute to the improvement of the institution’s cybersecurity posture and minimize risks associated with cyberattacks. This highlights the need for making policies more accessible and providing structured training to address the knowledge gap.

This study is limited to employees of a single institution, which may restrict the generalizability of the findings. Future studies may explore additional factors influencing cybersecurity awareness and assess the effectiveness of proposed training programs within the organization.

The researchers would like to express their sincere gratitude to all the individuals who contributed to the successful completion of this research study.

First and foremost, the researchers extend their deepest appreciation to their research adviser, Mr. Jared P. Manalastas, LPT, MAED, for his guidance throughout the conduct of this study.

The researchers also express their heartfelt gratitude to Dr. Ma. Socorro N. Bartolom, DBA, CPA, Dean of the Institute of Business and Accountancy, for sharing her expertise to the researchers for the development of this study.

Sincere appreciation is also extended to Prof. Al-Lawrence G. Cruz, Vice President for Administration and Finance; Ms. Aida S. Ramos, Ed.D., Vice President for Academic Affairs and Research; Ms. Reina Rodie Lyn Cruz, LPT, Ms. Danica G. Camarino, Mr. John Nicole S. Vizcarra, and Atty. Marynelle A. Salinas-De Jesus, for their assistance in facilitating the dissemination of the survey questionnaires to the respondents of the study.

The researchers would also like to thank Mr. Renz Allan V. Canlas, MIT, for generously sharing his knowledge in information technology, which greatly contributed to this research.

Special thanks are extended to Ms. Ma. Niña I. Adriano, MPA, MALLE, for her significant assistance and valuable contributions that greatly helped in the completion of this study.

Heartfelt gratitude is also extended to Ms. Angelica F. Cando and Ms. Jonabeth B. Ingaran for their assistance that greatly contributed to the success of this study.

Sincere appreciation is given to Mr. Jhed Ting for the generous financial support extended throughout the conduct of this study.

The researchers likewise express their sincere appreciation to the teaching and non-teaching employees of BTECH for their voluntary participation and meaningful contribution to the successful completion of this research.

Above all, the researchers offer their deepest gratitude to God Almighty for granting them wisdom, strength, and guidance throughout the entire research process.