Assessment of Employees’ Cybersecurity Risk Behaviour in Telecommunication Companies in Abuja

Employee cybersecurity risk behaviours represent the most exploitable vulnerability in enterprise security systems, and assessing these behaviours in the telecommunications sector, which manages critical communication infrastructure, is important for workforce security management. This study assessed cybersecurity risk behaviours among employees in two major telecommunication companies operating in Abuja, Federal Capital Territory, Nigeria. A descriptive survey was conducted among 180 employees across technical, customer service, and administrative departments using stratified random sampling. The Cybersecurity Risk Behaviour Scale measured risky email practices, unmanaged shadow IT use, BYOD non-compliance, oversharing on social media, and violation of clean desk policy. Results showed that risky email practices were most prevalent (mean risk score 3.6 out of 5), including opening attachments from unverified senders (49.4 percent). Shadow IT use was reported by 41.1 percent. BYOD policy non-compliance was acknowledged by 36.7 percent. Social media oversharing of company information was practised by 31.7 percent. Employees who had received security training in the preceding 6 months showed significantly lower overall risk behaviour scores (p < 0.001). Departments with dedicated security supervision showed better compliance. The study concludes that risky behaviours are widespread and recommends mandatory quarterly security training, technical controls for shadow IT restriction, formalized BYOD management policies, and enhanced security monitoring in customer-facing departments in Abuja telecom operations. Keywords: cybersecurity risk behaviour, employees, telecommunications, Abuja, insider threat