One research question researchers could study is: How does cybersecurity awareness training affect employees’ ability to recognize phishing and other social engineering attacks? I think this is an important question because a lot of cybersecurity incidents involve human behavior, not just problems with technology. Even if a company has strong security systems in place, an employee can still accidentally give away information, click on a malicious link, or respond to a fake message. Researchers could compare employees who receive regular cybersecurity training with employees who receive little or no training to see whether training actually changes how people respond to suspicious emails and messages. They could also study whether people remember what they learned several months after the training.

A second research question could be: How do workplace culture and peer behavior influence whether employees follow cybersecurity policies? Employees may understand security rules but still ignore them if those rules make their jobs more difficult or if coworkers regularly take shortcuts. For example, employees might reuse passwords, share login information, or avoid security procedures if that behavior seems normal in their workplace. Researchers could study whether employees are more likely to follow security policies when managers and coworkers take cybersecurity seriously. This could help organizations understand that cybersecurity is not only a technical issue. Social expectations, workplace habits, and individual behavior can also affect how secure an organization is.