Evaluating the influence of cybersecurity policies and cybersecurity behavior on institutional security performance in remote learning: the moderating role of technological readiness

Remote learning has reshaped higher education by expanding access and flexibility, while also exposing institutions to heightened cybersecurity risks. Educational organizations face a mix of technical and behavioral vulnerabilities, making them attractive targets for ransomware, phishing, and other attacks. These challenges are particularly acute in Technical and Vocational Education and Training (TVET) institutions, which often lack robust policies and resources to address cyber threats. This study investigates the impact of cybersecurity policies and behavior on institutional security performance in a remote learning context, with technological readiness examined as a moderating factor. Guided by institutional theory and protection motivation theory, a structural model was developed and tested using data from 429 TVET trainers in Kenya. Hypotheses were evaluated through structural equation modeling. Findings reveal that strong cybersecurity policies enhance institutional security performance, while proactive user behavior significantly increases cyber resilience. Moreover, technological readiness positively moderates the relationship between cybersecurity behavior and security performance, indicating that institutions with advanced digital infrastructure and resources achieve stronger outcomes. These insights carry theoretical and practical implications. Theoretically, combining institutional theory with protection motivation theory highlights how organizational arrangements and individual motivations jointly shape cybersecurity. Practically, the study identifies gaps in policy formulation, enforcement, user training, and technological preparedness. Addressing these gaps can help TVET institutions build safer digital learning environments, safeguard sensitive teaching data, and protect proprietary information. Ultimately, institutions that integrate strong policies, foster secure behaviors, and invest in technological capacity are better positioned to mitigate risks and enhance cybersecurity resilience.