Information security education: a thematic trend analysis

1. Introduction

As information technologies advance, information security risks also increase. Consequently, companies are increasingly concerned about cyber-attacks (Safa et al., 2015). Thus, information security has become one of the most important and debated topics among experts. Actions are being taken by implementing organizational information security procedures and policies, encouraging information security-conscious behavior, and promoting the sharing of information security knowledge (Safa et al., 2018).

Given the rapid technological evolution, continuous evaluation and constant innovation to improve security systems, such as multi-layer firewalls, have become essential. According to Torten et al. (Torten et al., 2018), cyberattacks often target the installation of ransomware, intellectual property infringement, theft of medical records, unauthorized banking transactions, and credit card misuse. Consequently, companies worldwide have placed a high priority on information systems risk management (Flores & Ekstedt, 2016).

Given the growing importance of protecting information systems within organizations, there has been an increased focus on developing human talent in cybersecurity in recent years as a key component of information technology education. This focus is reflected in both core and advanced curricula (Rowe et al., 2011). In addition, higher education plays a key role in society, particularly in terms of research, development, and education. Consequently, faculties are establishing their own Information Technology (IT) networks designed to support research, development, and teaching activities in the field of information security (Ulven & Wangen, 2021).

Therefore, several literature reviews have focused on investigating the fundamental knowledge, skills, and capabilities required by cybersecurity professionals (Jones et al., 2018), as well as analyzing information security curricula (Parrish et al., 2018). These studies have highlighted that information security has emerged as a crucial area of learning that demands specific professional education, particularly in areas such as secure programming, network security, and offensive security (Švábenský et al., 2020).

Information security education and training are critical for preparing both current and future IT professionals to adequately and effectively address real-world security risks and incidents (Beuran et al., 2016). Consequently, universities have acknowledged the necessity of maintaining currency with cyber threats and risks to provide students with contemporary cybersecurity tools and knowledge through innovative methodologies (Cheung et al., 2011). Furthermore, Bada and Nurse (2019) underscore the significance of devising cybersecurity education and awareness programs that are tailored to the specific needs of small- and medium-sized enterprises (SMEs), as these organizations frequently encounter unique challenges in safeguarding their systems. Their research underscores the necessity for accessible, practical training that can empower employees at all levels to understand and mitigate cybersecurity risks, which is imperative in fostering a culture of security awareness across diverse organizational sizes and sectors.

Thus, it has been evidenced that in the current era, where information is an invaluable asset and technology drives most human activities, information security has become a paramount concern (Burov et al., 2020). This concern is compounded by the increasing sophistication of cyber threats and the proliferation of cyber-attacks in both business and personal domains (Khaleefah & Al-Mashhadi, 2024). Therefore, the growing need for trained information security professionals is evident, making university programs dedicated to information security education essential (AlDaajeh et al., 2022).

Based on the background of the literature, the objective of this research is established: to identify the thematic trends in information security education. To this end, the following research questions are formulated:

2. Methods

A bibliometric analysis was used, a technique that allows for evaluating the quality and quantity of published scientific literature, as well as studying research trends and various citation analyses within a given field. It is considered a useful and productive tool for determining research trends across different disciplines (Buber & Koseoglu, 2022). To ensure data quality, the parameters of the PRISMA 2020 guidelines for systematic reviews and meta-analyses were followed. The PRISMA guidelines establish protocols for proper literature review, including a four-phase flowchart and a 27-item checklist (Selçuk, 2019). The phases followed in this study are detailed below.

2.4 Selection process

Once the search equations were applied in the databases, 261 records were obtained from Scopus and 44 from Web of Science, totaling 305 records. Subsequently, duplicates were removed, resulting in 271 documents that were then subjected to inclusion and exclusion criteria. After applying these eligibility criteria, 99 documents were selected for analysis. Figure 1 displays the flowchart of the document selection process.

Figure 1. PRISMA flow chart.

Own elaboration based on Scopus and Web of Science.

3. Results

First, an analysis of publications by year is conducted. As shown in Figure 2, a steady increase has been observed in recent years regarding the subject of this research. However, a decrease is noted in 2022, followed by an increase in 2023. Therefore, since 2013, there has been a continuous rise in the number of publications. Additionally, an analysis of quantity, quality, and structural indicators is performed.

Figure 2. Publications by year.

Own elaboration based on Scopus and Web of Science.

3.1 Analysis of the most important research actors

As stated in the first research question, the aim is to identify the most relevant research actors. Figure 3 displays the most influential authors. The blue color indicates the authors with the highest number of citations, while the green color represents the authors with the highest number of publications. Authors highlighted in yellow are those with both the highest number of publications and the highest number of citations.

Figure 3. Most relevant authors.

Own elaboration based on Scopus and Web of Science.

In the realm of information security education, numerous scholars have made substantial contributions to the field, particularly in the area of understanding the role of awareness and human behavior in adopting secure practices. In this context, Von Solms, Safa, and Furnell have been pivotal figures in propelling research on information security-conscious behaviors in organizations. Their seminal work has examined a myriad of factors influencing security behavior, including awareness, organizational policies, user attitudes, and self-efficacy (Safa et al., 2015). Building on these findings, Safa, Von Solms, and Furnell (2016) developed a compliance model for information security policies, underscoring the pivotal role of awareness and behavioral factors in adherence to security protocols. Moreover, Safa et al. (2019) put forward a deterrence- and prevention-based model to address insider threats, underscoring the necessity of proactive measures to mitigate security risks stemming from human factors.

Rezgui and Marks have also made significant contributions in this field of study. Their research is centered on the factors that influence information security awareness among university personnel, particularly those involved in decision-making processes concerning information systems, within the context of a developing nation. They have identified that variables such as meticulousness, cultural norms and beliefs, and social dynamics significantly influence staff attitudes and behaviors, both in their general professional conduct and in their level of awareness regarding information security (Rezgui & Marks, 2008). Additionally, Marks and Rezgui (2010) explored the role of IT leadership in higher education, emphasizing the importance of Chief Information Officers (CIOs) in formulating institutional security policies and promoting a culture of information security awareness.

Conversely, Vorakulpipat et al. (2011) conducted a comprehensive analysis of security and privacy concerns on social media from the perspective of the user, underscoring mounting concerns regarding the safeguarding of personal data and emphasizing the pivotal role of awareness in mitigating security vulnerabilities. Their research underscores the need to integrate educational and behavioral approaches into cybersecurity training programs to strengthen users’ resilience against emerging threats. Consequently, these contributions underscore the necessity of addressing both technological and human dimensions in information security education to cultivate a culture of awareness and compliance in security.

Figure 4 shows the journals with the greatest impact on the field of study. Among them, the journal Computers & Security stands out, having both the highest number of publications and the highest number of citations. Notably, the study by Safa et al. (Safa et al., 2015) has 226 citations and is recognized as one of the most relevant publications in this field. Additionally, the study by Rezgui and Marks (Rezgui & Marks, 2008) also warrants special attention, as it aligns with the trends identified in this research and has 138 citations.

Figure 4. Most relevant journals.

Own elaboration based on Scopus and Web of Science.

Additionally, the study by Rajab and Eydgahi (Rajab & Eydgahi, 2019), which has received 53 citations, is notable for presenting a theoretical framework that encompasses various behavioral theories. This framework focuses on assessing factors such as perceived vulnerability, response effectiveness, response cost, and information security compliance intentions in higher education, making it a significant contribution to the field. Likewise, the study conducted by Bongiovanni (Bongiovanni, 2019) deserves attention, as it currently has 44 citations and focuses on literature related to information security management in higher education.

The countries that have had the greatest impact on research in information security education are presented below. The United States stands out in the first place, both in terms of the number of citations and the number of publications related to this topic. Notable among these is the study by Rowe et al. (Rowe et al., 2011), which analyzes the crucial role of cybersecurity in IT education and argues for the integration of this topic into IT programs. Also noteworthy is the study by Conklin (Conklin, 2006), conducted in the United States, which proposes an active learning solution for a capstone course designed to enhance students’ competencies in cyberdefense and information security education.

Figure 5. Most relevant countries.

Own elaboration based on Scopus and Web of Science.

In addition, South Africa stands out due to the significant contributions of the study by Safa et al. (Safa et al., 2015), which has made a notable impact on the field of information security. Also highlighted is a study that provides operational definitions for information security education, information security training, and information security awareness. This research aims to help institutions determine when it is necessary to train or educate employees and when it is appropriate to implement information security awareness programs (Amankwa et al., 2014).

3.2 Thematic evolution analysis

The second research question focuses on the thematic evolution of the phenomenon under study. Figure 6 presents a count of the most frequent keywords from 2000 to 2024. Recently, there has been a significant increase in interest in the topic of security perception. In this context, the work of Mohr and Walter (Mohr & Walter, 2019) is notable, as it addresses information security education and users’ perceptions regarding the security of their personal information and online banking transactions. Another relevant topic is Higher Education, where there has been growing concern in recent years about individuals’ awareness of information security. This concern has led to the development of training programs in this area (Wahyudiwan et al., 2017).

Figure 6. Thematic evolution.

Own elaboration based on Scopus and Web of Science.

Another topic that has generated interest in recent years is Information Technologies, driven by the need to train personnel across various organizations and economic sectors on the security of information systems (Katsikas, 2000). Similarly, security behavior has gained relevance during this period. With the rise in cyber-attacks affecting business performance and reputation, as well as compromising intellectual property, human factors have been identified as the weakest link in the security posture of any networked system. Consequently, studies have been conducted to analyze the relationship between threat perception and the understanding of countermeasures concerning the adoption of secure behaviors (Torten et al., 2018).

In the last five years, data protection and data security have become highly relevant, particularly due to the increasing pressure on data storage. This rise, driven by massive data generation, has led to rapid development in the storage market. Consequently, data protection has become a critical issue for organizations (Yang et al., 2020).

3.3 Thematic cluster analysis

The third research question focuses on the thematic clusters present in the field of study. Figure 7 shows the keyword co-occurrence network, generated by the VOSviewer software (Van Eck and Waltman, 2010). In this representation, several clusters in the form of nodes are identified, with the largest cluster corresponding to information security education, which is the main topic of this research. This cluster is associated with topics such as e-learning and information assurance education. In this context, researchers such as Pastor et al. (Pastor et al., 2010) argue that the best way to enhance an individual’s response to security threats is through robust education, engaging hands-on training, and increased general awareness of information security.

Figure 7. Thematic clusters.

Own elaboration based on Scopus and Web of Science.

A significant cluster concentrates on higher education, particularly addressing issues such as awareness and human factors. As previously emphasized, these factors represent the most vulnerable element in information protection. Consequently, enhancing security awareness is paramount (Brill et al., 2013). This emphasis is further underscored in the information security awareness cluster, highlighting the need for research in this area (Lebek et al., 2014). This cluster is associated with topics such as gamification, which is a system that uses game-based elements to enhance motivation and learning outcomes. Consequently, gamification exhibits considerable potential for integration within security awareness and training programs (Gjertsen et al., 2017). Additionally, Silic and Lowry (2020) explore the application of design-science-based gamification to improve organizational security training and compliance. Their study underscores how gamification can foster enhanced engagement and compliance among employees by aligning training programs with motivational techniques that augment the learning experience and contribute to a culture of security awareness within organizations.

Generally spoken, it should look like this document. Using the styles of this document may make things easier for you, but you don’t need to use them.

In addition, the information security management cluster is highlighted due to the significant expansion of online business opportunities brought about by information technology. However, these opportunities have also introduced serious information security risks (Soomro et al., 2016). This cluster is related to topics such as information society, systems, and governance. It encompasses areas like social network analysis, distance education, and security culture. Similarly, an information security training cluster has emerged, addressing topics such as digital education and the impact of COVID-19. Consequently, research has been conducted to analyze information security behavior and awareness among Zoom application users, particularly during the COVID-19 pandemic (Candiwan et al., 2022).

3.4 Issues of currency and frequency

The fourth research question focuses on identifying the most frequent and relevant topics in the research area. Figure 8 displays four research quadrants. The first quadrant highlights the most frequent and relevant keywords, indicating topics that could guide future research on information security education. In this quadrant, the key topics are information security awareness and higher education. Notably, a study on the information security awareness of end users, including information systems decision-makers, within the context of three higher education environments is emphasized (Rezgui & Marks, 2008).

Figure 8. Most frequent and current topics.

Own elaboration based on Scopus and Web of Science.

The second quadrant highlights topics that, while less recurrent in the literature, are considered relevant, especially in recent years. Key aspects include information laws, higher education institutions (HEIs), risk assessment, cybersecurity, information security incidents, data analysis, security awareness, best practices, information technologies, information security policy, information security training, hacking, computer security, information security management, and security management. These keywords also hold significant potential for future research.

In quadrant three, less frequent and recurrent topics are identified, suggesting that they either need more momentum to become common and current or that researchers have lost interest over time. These themes include governance, information, and e-learning. Finally, quadrant four contains topics that are more frequent but less current, with evidence of a decreasing interest among researchers in recent years. Among these, awareness stands out.

3.5 Research agenda

Finally, a research agenda is proposed with potential future lines of inquiry based on the findings of this study, as visualized in Figure 9. One of the topics with significant future potential is the culture of information security. Continuous failures in information security within organizations have highlighted the importance of focusing on organizational culture. It is argued that developing an information security culture would subsequently lead to a more secure organization; therefore, this topic should be considered in the education of information security professionals (Tejay & Mohammed, 2023).

Figure 9. Research agenda.

Own elaboration based on Scopus and Web of Science.

Similarly, the potential of media is noteworthy, as it facilitates education in information security. Consequently, research has been developed to understand the current challenges in information literacy, analyze their causes, and offer solutions and strategies. These studies provide valuable references for future information literacy education through various communication channels (Tao, 2023). Additionally, the relevance of information regulations is highlighted. Information technology, as a regulated element, is interpreted differently across various sectors of security legislation. Therefore, research in this field is essential to promote consistency in the regulatory framework (Brinker, 2024).

Higher education institutions also emerge as a relevant topic for future research on compliance with information security policies. Although the literature in this area is still limited, it shows promising advancements (Hina & Dominic, 2020). Another crucial aspect is information security risk assessment, which is a fundamental component of business management practices. This assessment helps to identify, quantify, and prioritize risks based on risk acceptance criteria and organization-specific objectives. Therefore, education in this area is essential for information security professionals (Kuzminykh et al., 2021).

Information security management is a critical issue that must be continuously addressed in the future. As Merchan-Lima et al. (Merchan-Lima et al., 2021) emphasize, adopting effective information security management practices is imperative, especially in the context of higher education. Future professionals should be trained to design and implement these practices. Additionally, cybersecurity plays a significant role in the future of higher education. According to Kweon et al. (Kweon et al., 2021), security training and education are effective methods for detecting cyberattacks in both academic and industrial settings. Their research found a positive association between cybersecurity training and a reduction in cyberattacks within organizations.

Studies such as the Joint Task Force on Cybersecurity Education (2017) offer guidance to develop a comprehensive curriculum guide on cybersecurity education based on theoretical and conceptual knowledge essential to understanding the discipline, and opportunities to develop the practical skills that support the application of that knowledge. Thus, the parameters for cybersecurity education have been set for the future based on the fourth industrial revolution, charting the way forward for cybersecurity-inspired education and skills development in the real world (Drevin et al., 2022). In that sense, the World Conference on Information Security Education (WISE) marks the future lines of knowledge, understanding and practice of computer security and information protection (Bishop et al., 2021).

Based on the identified potential topics, the following research questions are proposed for future research:

• • What are the main aspects of information security culture in organizations, and how do they influence the effectiveness of training programs?

• • What role does the media play in promoting information security awareness and education among the general public and industry professionals?

• • What are the most relevant international and national (e.g., Colombia) information security regulations, and how do they impact information security education programs?

• • How are higher education institutions integrating information security into their academic programs, and what pedagogical approaches are they using?

• • What are the key challenges in managing information security within organizations, and how can these challenges be addressed through education and staff training?

• • What are the essential competencies that information security professionals need to acquire, and how are these competencies being developed in education programs?

• • What strategies are organizations implementing to foster a culture of cybersecurity among their employees, and how are they evaluating the effectiveness of these strategies?

• • How are higher education institutions collaborating with industry and other organizations to ensure that information security training programs align with labor market needs?

• • What are the emerging trends in cybersecurity, and how are they being addressed in education programs to ensure relevance and up-to-date knowledge?

• • What is the impact of information security education on risk reduction and data protection within organizations and society at large?

4. Discussion

Information security education and awareness are crucial issues in today’s world. Similar to the study conducted by Amankwa et al. (2015), a literature review has been employed to evaluate models aimed at improving security education and awareness. These models focus on stakeholder domains such as end users, institutions, and industry. This study also identifies a research gap regarding the relationship between higher education institutions and industry (a key stakeholder), as well as other organizations, to ensure that information security education programs align with labor market needs.

Previous research aligns with the findings of this study on information security policies. For example, Alassaf and Alkhalifah (Alassaf & Alkhalifah, 2021) found that the literature lacks information on the positive and negative (direct or indirect) influences of human and organizational theories and their factors affecting information security policy compliance behavior. This study also identifies gaps in higher education related to information security policy education. Addressing these gaps is crucial to ensure that future professionals are prepared to design and implement secure practices within higher education institutions.

The results of this study are consistent with insights from other research, such as the systematic review by Hina and Dominic (2020) on compliance with information security policies. Their review emphasized that limited attention has been given to critical infrastructures, including higher education institutions, that are particularly vulnerable. They also examined the role of institutional governance in shaping protection motivation for information security. Similarly, this study underscores the importance of further exploring the intersection of information security policies and higher education. It also highlights the need for information security professionals to develop essential skills in policy implementation and gain a deeper understanding of how these policies are integrated into educational programs.

The findings of the study by Merchan-Lima et al. (Merchan-Lima et al., 2021), who conducted a systematic literature review on effective information security management practices in higher education institutions, align with the results of this research. These authors suggest that future research should focus on how to educate users and the mechanisms to help higher education institutions select the appropriate risk assessment models for their needs. This study similarly highlights the importance of information security management and risk assessment within the context of professional education, underscoring the need for further exploration in future studies. Additionally, it emphasizes the relevance of designing curricula that align with the current needs of organizations.

This study contributes from two fundamental perspectives. First, from a theoretical standpoint, it identifies the predominant trends in information security education research. Additionally, it explores emerging themes, underdeveloped areas, and persistent challenges. These findings provide a clearer picture of the structure of knowledge in the field of information security education, including the relationships between influential concepts, authors, journals, and countries. Second, the study highlights underexplored areas and topics that require further attention in future research. This information is valuable for formulating new hypotheses and raising relevant research questions. Ultimately, it contributes to the advancement and enhancement of information security practices in an increasingly digitized world.

In terms of practical implications, the findings of this research may be valuable as a guide and foundation for planning higher education training programs. These results offer relevant information on key topics, methods, and approaches in the field of information security, which may influence the design of academic and training programs.

In addition, these findings can support decision-making in both academia and business. They help to understand the needs in information security education and to allocate resources more effectively. By examining the existing literature, best practices in information security education based on currently relevant topics have been identified. This information can serve as a reference for the development and implementation of successful programs.

Additionally, evidence gathered from existing literature on the impact of information security education interventions, such as awareness programs or professional development initiatives, is valuable for informing future strategies. Finally, the findings of this study can be used as input for designing international benchmarking and comparison reports. By comparing scientific output in information security education across different countries, institutions, and sectors, opportunities for collaboration and mutual learning can be identified (Escuela Europea de Excelencia, 2021).

Similarly, the study has some limitations. First, it is based on the Scopus and Web of Science databases, which are the most widely used in academia. However, it would be beneficial to explore other databases, such as IEEE, that focus on engineering topics, including information security. Second, the selection criteria were not extremely specific, so future research could define more detailed criteria and carry out a systematic literature review to deepen the research topic. Third, although the study analyzes thematic trends, it does not focus as much on research gaps. Despite this, a research agenda is provided to guide future studies.

A critical limitation of this study pertains to the inclusion criteria employed in the selection of documents. While the search was conducted using key terms such as “information security,” “education,” and “training,” additional terms like “awareness” and “human behavior” in the context of information security were not included. This omission may have constrained the scope of the included studies, particularly in relation to the impact of human behavior on the adoption of best practices and the development of information security awareness. As these factors are critical to the effectiveness of information security education, future research could expand the search criteria to include these terms, allowing for a more comprehensive view of thematic evolution in this field.

The following Table ( Table 1) presents a summary of the gaps identified in the research, these gaps cover various aspects, from the integration of information security in academic programs to the lack of standardized assessment methodologies and the need for an interdisciplinary perspective, each gap is accompanied by a brief justification and questions to guide future research in the field, this table provides an overview of the critical areas that require attention and development to advance information security education.

Integrating information security into higher education programs is crucial for ensuring that students are equipped with the necessary skills to address modern cyber threats. This integration helps bridge the gap between theoretical knowledge and practical application, preparing graduates to handle real-world security challenges effectively. Developing detailed curricula that include up-to-date practices and emerging technologies could greatly enhance students’ readiness for the evolving landscape of information security.

Another significant gap lies in the lack of standardized methodologies for evaluating the effectiveness of information security training programs, without a consistent evaluation framework, it is difficult to determine which pedagogical approaches are most effective and how to improve the quality of the training offered, this gap highlights the need to develop robust evaluation tools that can measure the real impact of information security training on risk reduction and data protection.

Furthermore, the paucity of data and metrics available to measure the impact of information security education programs presents an additional challenge. The lack of quantitative and qualitative information limits our understanding of the effectiveness of these programs and makes it difficult to identify areas for improvement, it is critical to address this gap by systematically collecting relevant data and developing robust metrics that can guide informed decision-making in the design and implementation of information security education programs.

Your analysis highlights crucial areas where further research and development are needed. Addressing these gaps can significantly enhance the effectiveness and relevance of information security education programs. By focusing on integration, standardized evaluation, data collection, and interdisciplinary approaches, future research can contribute to a more comprehensive and robust framework for preparing professionals to tackle the evolving challenges in information security.

5. Conclusion

The increasing complexity and frequency of cyber threats underscore the critical need for robust information security education. Universities play a pivotal role in this by preparing future professionals with the necessary skills and knowledge to combat these threats effectively. As technology evolves and cyber risks become more sophisticated, higher education institutions must adapt their programs to ensure they align with current and future demands. This includes not only teaching technical skills but also fostering a deep understanding of organizational policies, risk management, and the broader context of information security.

The objective of this research was to identify thematic trends in the field of information security education. To achieve this, five research questions were formulated. The first question made it possible to identify the research actors, i.e., the most influential authors, journals, and countries in this field. Authors Von Solms R, Safa NS, and Furnell S, as well as Rezgui Y and Marks A, stand out as the most influential due to their large number of publications and citations recorded. In terms of journals, Computers & Security stands out as the most influential, with a high volume of publications and citations on this topic. In addition, the United States and South Africa are the most relevant countries in this context. This leads to the conclusion that the aforementioned actors are the ones that generate the most impact within the field of education research in information security.

The second research question focused on the thematic evolution in recent years within the research field. Through an analysis of the most recurring keywords for each year, significant researcher interest was identified in the following topics: security perception, higher education, information technology, security behavior, data protection, and data security. The third research question addressed thematic research clusters. In this analysis, the following information security relevant clusters were identified: information security education, information security awareness, higher education, information security management, cybersecurity, and information security training.

In the fourth research question, an analysis of the currency and frequency of keywords related to the research topic was conducted. The findings revealed that the most frequent and current topics are information security awareness and higher education. This suggests that future research can be oriented towards these two topics. Finally, from the fifth question, a research agenda was proposed that identifies potential in the following thematic areas: information security culture, media, information security regulations, higher education institutions, information security management, and cybersecurity. From these thematic areas, research questions were proposed that could be answered in future research.

Ethics and consent

Ethical approval and consent were not required.

Disclosure statement. No.