Empirical Investigation of Cybersecurity Incident Reporting Behaviour Among University Students in North East Nigeria

Cybersecurity incident reporting by university students is critical for institutional security management, and understanding the factors that inhibit or facilitate this behaviour in North East Nigerian universities fills an important organisational security research gap. This study empirically examined factors influencing cybersecurity incident reporting intention among undergraduate students at the University of Maiduguri and Gombe State University, North East Nigeria. A cross-sectional survey based on the Theory of Planned Behaviour extended with privacy concerns was conducted among 280 students using stratified random sampling. Structural equation modelling was applied to a model including attitude toward reporting, subjective norms, perceived behavioural control, privacy concerns, trust in institutional response, and reporting intention. Results showed that trust in institutional response was the strongest predictor of reporting intention (beta = 0.52, p < 0.001), followed by perceived behavioural control (beta = 0.41, p < 0.001) and subjective norms (beta = 0.29, p < 0.01). Privacy concerns significantly negatively moderated the trust-intention relationship. The model explained 59.3 percent of variance in reporting intention. The study fills an empirical gap in North East Nigerian security behaviour research and recommends confidential anonymous reporting channels, transparent institutional response communication, and peer champion reporting culture campaigns to improve student security reporting behaviour at both universities. Keywords: cybersecurity reporting behaviour, university students, Theory of Planned Behaviour, North East Nigeria, incident reporting