Digital vigilance in academia: a study of cybersecurity knowledge and practices in Kuwait’s higher education institutions

Purpose This study aims to examine the relationship between cybersecurity knowledge, cyber threat awareness and cybersecurity practices among staff and students in Kuwait’s higher education institutions (HEIs). It addresses a critical gap in understanding the human factors that influence cybersecurity resilience within Gulf higher education contexts. Design/methodology/approach A cross-sectional quantitative survey was conducted involving 270 participants from seven Kuwaiti HEIs. Data were analyzed using Spearman’s rank correlation, nonparametric group comparison tests, and ordinal logistic regression to examine the relationships between cybersecurity knowledge, threat awareness, demographic characteristics and cybersecurity practices. Findings Cybersecurity knowledge and cyber threat awareness were both significant predictors of cybersecurity practices. Moderate positive correlations among knowledge, threat awareness and secure behavior indicate that awareness alone is insufficient to promote secure practices without institutional support and behavioral reinforcement. Gender differences were significant in the bivariate analyses but became nonsignificant after controlling for cybersecurity knowledge and threat awareness, suggesting that disparities are mediated by sociocultural and educational factors rather than inherent behavioral differences. Age and institutional role were not independently associated with cybersecurity practices, indicating that the principal barriers to cybersecurity resilience are institutional rather than demographic. Practical implications The findings highlight the need for institutionally embedded cybersecurity governance that integrates leadership commitment, continuous awareness programmes, and culturally responsive training. Kuwaiti HEIs should move beyond compliance-based awareness initiatives toward strategic, governance-led approaches that align with Kuwait’s National Cybersecurity Strategy (2022). Originality/value This study contributes empirical evidence from the Gulf region by integrating Protection Motivation Theory, the Theory of Planned Behavior, and Socio-Technical Systems Theory to explain cybersecurity behavior in higher education. It demonstrates that cybersecurity resilience depends not only on individual knowledge but also on institutional governance, organizational culture and sociocultural context, thereby extending the predominantly Western evidence base and providing a foundation for future longitudinal and comparative research across the Gulf Cooperation Council.