Empirical Analysis of Security Awareness Campaign Effects on Employee Password Behaviour in Nigerian Telecom Companies

Security awareness campaigns are a primary organisational security investment, and empirically measuring their actual effect on employee password security behaviour in Nigerian telecommunications companies provides evidence for campaign design and resource allocation decisions. This study empirically evaluated the effect of a standardised 4-week security awareness campaign on password security behaviour among employees of three Nigerian telecommunications companies in Lagos, Kano, and Enugu. A pre-test and post-test quasi-experimental design was employed with 240 employees across the three companies. Password behaviour was assessed through a validated Password Security Behaviour Scale at baseline, immediately post-campaign, and at 8-week follow-up. Results showed significant improvement in all password behaviour dimensions at immediate post-test (p < 0.001 for all). Effect sizes were largest for MFA adoption (Cohen's d = 1.12) and password uniqueness (d = 0.94). At 8-week follow-up, improvement was retained for MFA adoption (p < 0.001) but showed partial decay for uniqueness and strength dimensions (p < 0.05). Technical staff showed faster behaviour change but similar long-term retention as non-technical staff. The study provides empirical evidence for short-term campaign effectiveness but partial decay and recommends reinforcement mechanisms including scheduled follow-up micro-training and gamified monthly security reminders to sustain behavioural improvements in Nigerian telecom workforces. Keywords: security awareness campaigns, password behaviour, telecommunications, Nigeria, employee security training