# Chatbots: A Framework for Improving Information Security Behaviours using ChatGPT

Tapiwa Gundu

► To cite this version:

Tapiwa Gundu. Chatbots: A Framework for Improving Information Security Behaviours using ChatGPT. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.418-431, 10.1007/978-3-031-38530-8_33. hal-05462092

HAL Id: hal-05462092

https://inria.hal.science/hal-05462092v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Chatbots: A Framework for Improving Information Security Behaviours using ChatGPT

Tapiwa Gundu✉ ID

Nelson Mandela University, Gqeberha, South Africa
tapiwag@mandela.ac.za

**Abstract.** This paper proposes a framework for improving information security behaviours using ChatGPT, a natural language processing chatbot. The framework leverages the Theory of Planned Behaviour (TPB) and the Persuasion Theory to promote secure behaviours through targeted interventions such as education, training, gamification, security tips, reminders, and nudges. ChatGPT can provide personalized and interactive training on information security best practices, deliver relevant threat alerts and tips, and assist with security assessments. Gamification can be used to increase engagement and retention of information security knowledge. The use of nudges and reminders can help sustain secure behaviours over time. Overall, the ChatGPT framework offers a promising approach for organizations looking to enhance their cybersecurity posture by promoting a culture of information security and empowering individuals with the knowledge and tools to protect sensitive information. The framework was then validated by prompting ChatGPT to raise awareness. The responses were then validated by experts to verify if the content from ChatGPT was good.

**Keywords:** ChatGPT · Chatbot · Information security awareness · security training · cybersecurity

## 1 Introduction

The increasing dependence on technology and digital platforms has brought about significant advancements in many aspects of our lives, including communication, commerce, and social interaction. However, this reliance on technology has also led to an increase in cybersecurity threats, including hacking, malware, phishing, and identity theft. Despite the implementation of various security measures, such as firewalls, antivirus software, and encryption, the human factor remains a significant vulnerability in cybersecurity. Individuals and employees often lack awareness and understanding of cybersecurity threats, making them easy targets for cybercriminals. In recent years, the number of cyberattacks has increased significantly, resulting in substantial financial losses and reputational damage to organizations. Many of these attacks are preventable, but a lack of awareness and education about information security is a significant contributing factor.
Traditional methods of information security education typically involve formal training programs and policies that are designed to promote information security awareness and best practices among employees [1]. These methods may include classroom-style training, online training modules, and employee handbooks or manuals that outline organizational policies and procedures related to information security [2–4]. In-classroom training sessions may involve presentations, lectures, and demonstrations by information security professionals, and may cover a range of topics, including password management, data encryption, phishing awareness, and social engineering [2]. Online training modules may use interactive and multimedia elements, such as videos, quizzes, and simulations, to engage learners and reinforce key concepts. Employee handbooks or manuals may provide guidance on how to handle sensitive information, as well as outline the consequences of violating organizational policies and procedures [5].

These Traditional methods, however, may have limitations in terms of engaging learners and sustaining behaviour change over time [5] and costs of facilitating training. Newer approaches, such as those that incorporate chatbots and gamification, may offer more personalized and engaging ways to promote information security awareness and behaviour change [6]. Chatbots are computer programs designed to simulate conversation with human users, typically through text or voice interactions [6]. Chatbots can be used for a variety of purposes, such as customer service, sales, and information retrieval. ChatGPT is a type of chatbot that uses natural language processing (NLP) to generate human-like responses to user queries [7]. ChatGPT is a deep learning algorithm that can generate coherent and contextually relevant responses to a wide range of queries [7].

The remainder of the paper is ordered as follows; Next in Sect. 2, the theoretical underpinnings of this study will be discussed. This will be followed by the introduction of the dimensions of this study in Sects. 3–7. Section 8 will then discuss the methods followed for this study, then Sect. 9 will introduce the proposed framework. Results, Discussion, and conclusion will then follow concurrently in Sects. 10, 11 and 12.

# 2 Theoretical Background

## 2.1 Theory of Planned Behaviour

The theory of planned behaviour (TPB) can be used to explain how ChatGPT can improve information security behaviour. The TPB suggests that behaviour is influenced by three factors: attitudes, subjective norms, and perceived behavioural control [9] as shown in Fig. 1.

## 2.2 Persuasion Theory

Persuasion theory suggests that effective communication involves understanding the audience, the message, and the context [10]. This is diagrammatically represented in Fig. 2.

Persuasion Theory explains how people can be persuaded to change their attitudes and behaviours through communication. People are more likely to be persuaded by messages that are tailored to their individual needs and preferences [10]. In the context of
<figure><img src="image_3.png" /><figcaption>Fig. 1. Theory of Planned Behaviour [9]</figcaption></figure>

<figure><img src="image_4.png" /><figcaption>Fig. 2. Persuasion Theory [11]</figcaption></figure>

information security, this means de-signing communication strategies that are personal-
ized to the specific needs and characteristics of different user groups, such as employees
with different roles or levels of technical expertise.

3 Chatbots

Chatbots can be programmed to perform a wide range of tasks, from answering basic questions and providing customer service support to assisting with online shopping and booking travel arrangements [12]. They can be integrated into various messaging platforms, such as Facebook Messenger, WhatsApp, and Slack, and can also be found on websites and mobile apps.

There are two main types of chatbots, the rule-based and AI-powered chatbots. The rule based chatbots are programmed to respond to specific keywords or commands, following a predefined set of rules. They are typically used for simple tasks, such as answering frequently asked questions or providing basic customer support. The AI-powered chatbots use machine learning algorithms and natural language processing to understand and interpret human language, allowing them to have more natural and sophisticated conversations. They can learn from past interactions and improve over time, providing more personalized and effective responses.
## 4 ChatGPT

ChatGPT is currently the most common AI Powered chatbot, it provides natural language processing capabilities and generate human-like responses. ChatGPT is a language model developed by OpenAI that is trained on a massive amount of text data and can generate human-like responses to natural language input [13]. It can be fine-tuned to perform specific tasks, such as answering customer service inquiries or providing personalized recommendations [8]. ChatGPT has a variety of potential applications, including chatbots, virtual assistants, and automated content generation. It has been used to develop chatbots for a range of industries, from healthcare to finance to customer service [8]. Overall, ChatGPT is an impressive advancement in natural language processing and has the potential to significantly improve the efficiency and effectiveness of conversational interfaces.

## 5 Information Security

Information security refers to the practice of protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction [14]. It involves a range of measures and technologies designed to ensure the confidentiality, integrity, and availability of information.

Information security includes a variety of techniques, such as access controls, encryption, firewalls, intrusion detection and prevention systems, and vulnerability assessments [15]. It is important in ensuring the privacy of personal information, maintaining the integrity of business data, and safeguarding national security information.

Some common information security threats include cyberattacks, malware, phishing, and social engineering. Effective information security requires a combination of technical controls, policies and procedures, and employee training and awareness [16].

### 5.1 Security Solutions

#### Proactive Security Solutions.

Proactive security solutions refer to measures that are taken to prevent security incidents before they occur, rather than reacting to incidents after they happen [17]. This solution is based on the common metaphor "if a ship has a hole, it is better to patch the hole than bail the water". These solutions are designed to identify and address potential vulnerabilities and threats before they can be exploited by attackers. Some examples of proactive security solutions include security awareness training [18], risk assessments [19], Penetration testing [20], security monitoring [21], security audits [22], or threat intelligence [23].

#### Reactive Security Solutions.

Reactive security solutions refer to measures that are taken after a security incident has occurred, with the aim of limiting the damage caused by the incident and preventing similar incidents from happening in the future [17]. Reactive security measures are typically less effective than proactive measures, as they can only address the symptoms of a security problem rather than its root causes. Some examples of reactive security solutions include incident response [24], forensic analysis [19], patch management [19], data backup and recovery [24], security incident reporting [24].
# 6 Information Security Awareness and Training

Information security awareness and training refer to the processes of educating individuals and organizations on the importance of protecting sensitive data and systems from unauthorized access, use, disclosure, modification, or destruction [25]. The goal of information security awareness and training is to promote a culture of security that ensures the confidentiality, integrity, and availability of information assets [26].

While both awareness and training are important components of information security education, there are some key differences between them, these are their scope, depth delivery and goals. Awareness generally has a broader scope than training, while training is usually more in depth than awareness. Awareness is usually delivered through many communication channels while training is usually conducted in a structured learning environment. The goals of awareness and training are different [27, 28]. The primary goal of awareness is to create a culture of security within an organization by promoting best practices and behaviours that reduce the risk of security incidents. The primary goal of training is to equip individuals with the skills and knowledge needed to perform specific tasks or functions related to information security.

# 7 Using Chatbots for Information Security Awareness and Training

Chatbots can be a useful tool for information security awareness and training, as they provide an interactive and engaging way for users to learn about security best practices and stay up to date on the latest threats and vulnerabilities. Table 1 shows the common themes associated with chatbot use in information security awareness and training.

## 7.1 Advantages of Using Chatbots

Chatbots can provide real-time feedback to individuals, enabling them to identify and rectify security risks promptly [6]. For example, if an individual clicks on a suspicious link, the chatbot can immediately provide feedback on the potential risks and steps to take to mitigate them. They are available 24/7 to provide information security education to individuals, eliminating the need for scheduled training sessions [30]. They can provide interactive learning experiences that engage individuals and encourage them to participate in the learning process. Chatbots can use multimedia content such as videos, images, and quizzes to help individuals understand the importance of information security [34]. They can be a cost-effective way of conducting security simulations [30]. Instead of hiring a dedicated team to conduct security simulations, chatbots can provide a more efficient and cost-effective alternative.

# 8 Methods

Because ChatGPT is relatively new (less than 5 months old at the time this paper was submitted) there were no articles specifically on chatGPT on security awareness and training to review. This paper then made a comprehensive review of the existing literature on chatbots in general. Chatbots in information security awareness and education have similarities in that their main goal is to disseminate knowledge.
<table><caption>**Table 1.** Literature Review</caption><thead><tr><td></td><td>Theme</td><td>Description</td><td>Articles</td></tr></thead><tbody><tr><td>1</td><td>Personalised Question and Answer</td><td>Users can ask Chatbots questions about specific topics related to information security, and Chatbots can provide accurate and relevant answers. Chatbots can analyse the user's previous interactions and adapt the content</td><td>[12, 13, 29–31]</td></tr><tr><td>2</td><td>Simulations</td><td>Chatbots can simulate real-world security scenarios, such as a phishing attack or malware infection, and guide users through the steps they should take to respond to the threat. Chatbots can simulate phishing attacks to train individuals on how to identify and respond to such attacks</td><td>[6, 13, 32, 33]</td></tr><tr><td>3</td><td>Providing Security Alerts and Tips</td><td>Chatbots can be used to provide users with security tips and alerts in a conversational and interactive manner. For example, a chatbot could provide tips on how to create strong passwords, how to avoid phishing scams, or how to secure their home network</td><td>[6, 30, 34, 35]</td></tr><tr><td>4</td><td>Real-Time Assistance</td><td>Chatbots can provide real-time assistance to users by analysing their interactions and providing feedback on potential security risks. For example, if a user receives a suspicious email, Chatbots can analyse the email and provide guidance</td><td>[13, 29–31, 35]</td></tr><tr><td>6</td><td>Gamifying security awareness</td><td>Chatbots can be used to create interactive games and quizzes that help to reinforce key security concepts and best practices. This can help to make security awareness more engaging and enjoyable for users</td><td>[30, 32, 35]</td></tr></tbody></table>

(continued)
<table><caption>**Table 1.** (continued)</caption><thead><tr><td></td><td>Theme</td><td>Description</td><td>Articles</td></tr></thead><tbody><tr><td>7</td><td>Conducting Security Assessments</td><td>Chatbots can be used to conduct security assessments or quizzes to help users test their knowledge of security best practices. This can help identify areas where users may need additional training or education</td><td>[13, 35, 36]</td></tr></tbody></table>

Seven themes were identified, as training on best practices, threat alerts, Personalized recommendations, simulations, gamification, alerts and real time responses. Ten experts in the field were approached to review the framework and also add insights. The themes, the expert insights and the underlying theoretical background were then the basis on which the proposed framework discussed in Sect. 9 was formulated. A desktop validation was then conducted to verify if indeed ChatGPT could be used to conduct information security awareness and training. The method used in this study is presented graphically in Fig. 3.

<figure><img src="image_5.png" /><figcaption>**Fig. 3:** Method followed to conceptualise and validate the framework</figcaption></figure>

## 9 ChatGPT Based Information Security Behavioural Change Framework

The framework in this paper is based on a statement by Tzu & Sunzi (in [37]) that says “if you know both the enemy and yourself, you will fight a hundred battles without danger of defeat; if you are ignorant of the enemy but only know yourself, your chances of winning and losing are equal; if you know neither the enemy nor yourself, you will certainly be defeated”. This study then links this statement back to the underlying theories of the study (Theory of Planned Behaviour and Persuasion Theory).

In terms of the Theory of Planned Behaviour, the statement talks to understanding both the potential threats or “enemies” and one’s own vulnerabilities and strengths
are crucial to making informed decisions about how to protect oneself or one's organi-
zation. This knowledge can inform attitudes towards security measures and perceived
behavioural control, both key factors in the theory of planned behaviour. For example,
if an individual understands the potential threats they face and their own vulnerabilities,
they may have a more positive attitude towards implementing strong security measures
and feel more confident in their ability to do so. Similarly, if an individual perceives
that their peers or organization place a high value on security, they may feel more com-
pelled to prioritize security measures. On the other hand, if an individual is ignorant of
the potential threats or their own vulnerabilities, their chances of effectively defending
against attacks may be diminished. In this case, attitudes towards security measures and
perceived behavioural control may be lower, leading to less effective security practices.

In terms of Persuasion Theory, the statement emphasizes the importance of under-
standing the target audience and tailoring persuasive messages to their specific needs
and motivations. By understanding the threats and vulnerabilities that users face, as
well as their attitudes and behaviours towards information security, messaging and com-
munication strategies can be developed to effectively persuade them to adopt security
practices and policies. Additionally, these persuasive messages are processed heuristi-
cally and systematically by the users and should persuade them to take action to protect
themselves and their information (Fig. 4).

<figure><img src="image_6.png" /><figcaption>Fig. 4. ChatGPT based information security behavioural change framework</figcaption></figure>
## 9.1 Persuasive Message and Audience

**Personalised Training on Best Practices:** ChatGPT can be used to provide training on information security best practices. This could include training on password management, phishing prevention, safe browsing, and other aspects of information security. ChatGPT can be programmed to deliver this information in an engaging and interactive way, making it easier for users to learn and retain the information. ChatGPT can provide personalized recommendations based on a user's behaviour. For example, if a user tends to use weak passwords, ChatGPT can suggest stronger password options. If a user frequently opens suspicious emails, ChatGPT can recommend ways to identify and avoid phishing scams.

**Threat Alerts and Tips:** ChatGPT can be programmed to provide real-time threat alerts to users. For example, if there is a new phishing scam or malware attack, ChatGPT can notify users and provide guidance on how to avoid it. ChatGPT can also provide users with tips and best practices for staying safe online. For example, it can offer advice on creating strong passwords, using two-factor authentication, avoiding phishing scams, and keeping software up to date. These tips can be delivered in the form of daily or weekly reminders, or users can ask ChatGPT for advice whenever they have a security-related question.

**Conducting Security Assessments:** ChatGPT can be used to conduct security assessments by leveraging its natural language processing capabilities to interact with individuals or groups and gather information about their information security practices, knowledge, and awareness. ChatGPT could ask the user a series of questions about their information security practices, such as What kind of sensitive information they handle at work, if they use encryption to protect their sensitive data, if they have received any phishing or social engineering attempts in the past, etc. These questions can help gauge the user's level of information security knowledge and awareness.

**Gamification:** ChatGPT can use gamification for cybersecurity awareness: Cybersecurity challenges: ChatGPT can create cybersecurity challenges that require users to demonstrate their knowledge and skills in various areas, such as password security, phishing prevention, and data protection. Users can earn points and badges for completing challenges, and their progress can be tracked over time.

**Reminders and Nudges:** ChatGPT can use reminders and nudges to help promote cybersecurity awareness and encourage users to adopt secure behaviours. Some examples of how ChatGPT can use reminders and nudges include Password reminders, Two-factor authentication (2FA) nudges, Phishing awareness reminders, Software update reminders, social engineering awareness nudges. By using reminders and nudges, ChatGPT can help reinforce cybersecurity best practices and encourage users to adopt secure behaviours. It can promote a culture of security awareness and help reduce the risk of cyber-attacks.
## 9.2 Heuristic and Systematic Processing

**Attitudes:** Attitudes refer to a person's positive or negative evaluation of a behaviour. ChatGPT can help improve attitudes towards information security behaviour by providing engaging and interactive training that makes users feel empowered and knowledgeable about how to protect their sensitive information [38]. By providing personalized recommendations and real-time alerts, ChatGPT can also help users see the benefits of following best practices.

**Subjective norms:** Subjective norms refer to the influence of social norms and expectations on behaviour [39]. ChatGPT can help create a culture of information security by providing consistent messaging and reminders to users. By gamifying the experience and providing rewards for following best practices, ChatGPT can also make it more socially desirable to prioritize information security.

**Perceived behavioural control:** Perceived behavioural control refers to a person's belief in their ability to perform a behaviour [39]. ChatGPT can help improve perceived behavioural control by providing easy-to-understand instructions and guidance on how to follow best practices. By providing reminders and nudges, ChatGPT can also help users feel more confident in their ability to remember and follow through on information security behaviours.

## 9.3 Persuasion

Intention and behaviour are two related concepts in psychology that are often used to explain human actions [11]. Intention refers to a person's conscious decision or plan to engage in a particular behaviour, whereas behaviour refers to the actual execution of that behaviour [39]. Intention plays a crucial role in determining whether individuals adopt secure behaviours. For example, if an individual believes that using strong passwords is important for protecting their personal information and they feel confident in their ability to create and remember strong passwords, they are more likely to intend to use strong passwords and actually do so. Therefore, interventions that target attitudes, subjective norms, and perceived behavioural control can help promote intention and encourage individuals to adopt secure behaviours. TPB posits that intention is influenced by these three factors and that a strong intention to perform a behaviour is more likely to result in the actual execution of that behaviour [39].

# 10 Results

The review of the literature and expert interviews revealed seven prominent themes that were consolidated into five and used to formulate the framework proposed in this study. These themes were then formulated into prompts to see if ChatGPT would be able to provide information to assist. The 10 experts rated the results from the chat GPT prompts and gave their satisfaction level per construct and they were averaged as is shown in Table 2.
<table><caption>**Table 2.** Results</caption><thead><tr><td>Construct from framework</td><td>ChatGPT prompt</td><td>Result Satisfactory?</td><td>Satisfaction Level</td></tr></thead><tbody><tr><td>Personalised Training on Best Practices</td><td>I am an organisational employee, train me on information best practice</td><td>Yes – 8; No – 2 In-between - 0</td><td>80%</td></tr><tr><td>Threat Alerts & Tips</td><td>I am an organisational employee, provide me with the latest threat alerts & tips</td><td>Yes – 8; No – 1 In-between - 1</td><td>85%</td></tr><tr><td>Conducting Security Assessments</td><td>Provide 10 multiple-choice questions to assess information security awareness</td><td>Yes – 9; No – 0 In-between - 1</td><td>95%</td></tr><tr><td>Gamification</td><td>Provide a game for information security that I can play against chatgpt</td><td>Yes – 9; No – 0 In-between - 1</td><td>95%</td></tr><tr><td>Reminders and Nudges</td><td>Can you provide nudges and reminders for information security weekly</td><td>Yes – 8; No – 0 In-between - 2</td><td>90%</td></tr></tbody></table>

## 11 Discussion

The findings of this study suggest that chatGPT can play a significant role in enhancing information security awareness and training. The study found that chatGPT can provide a more interactive and engaging learning experience, tailored to the specific needs and preferences of individuals. The study also found that chatGPT can provide real-time feedback, enabling individuals to identify and rectify security risks promptly.

While the potential benefits of using ChatGPT for information security awareness and education are significant, there are also potential limitations to consider. Firstly, ChatGPT relies on the quality of the data used to train it. If the data used to train ChatGPT is biased or incomplete, it may provide inaccurate or incomplete information. Secondly, ChatGPT may not be able to understand the context of specific information security scenarios. For example, it may not be able to distinguish between a genuine email and a phishing email. Therefore, ChatGPT should be used in conjunction with other information security tools and practices to provide a comprehensive approach to information security. The biggest advantage of using ChatGPT is that it can provide information security awareness and education to a large number of users simultaneously.
# 12 Conclusion

This paper provides insights into the role of chatbots in enhancing information security awareness and education. The study findings suggest that chatbots can provide a more engaging and interactive learning experience, tailored to the specific needs and preferences of individuals. The study also identified the potential benefits and limitations of using chatbots for information security awareness and education. The study concludes with recommendations for the implementation of ChatGPT in information security awareness and education, including the need for careful design and customization, integration with existing security measures, and ongoing monitoring and evaluation.

ChatGPT has the potential to be a valuable tool for information security awareness and education. Its natural language processing capabilities make it an ideal tool for delivering personalized learning experiences, real-time assistance, and receiving relevant threat alerts and tips. Further research is needed to evaluate the effectiveness of using ChatGPT for information security education in real-world scenarios.

In conclusion, using the proposed framework for improving information security behaviours can be an effective approach for organizations looking to enhance their cybersecurity posture with a restricted budget. The use of nudges and reminders can help sustain a culture of information security, encouraging individuals to continue practising secure behaviours over time. Additionally, gamification can be an effective tool for making information security training more engaging and enjoyable, increasing the likelihood of retention and behaviour change. Overall, the ChatGPT offers a promising avenue for improving information security behaviours by combining the convenience and accessibility of chatbots with the sophistication of natural language processing. By promoting a culture of information security and empowering individuals with the knowledge and tools to protect sensitive information, organizations can mitigate the risk of security breaches and protect their valuable assets.

# References

1. Gundu, T., Flowerday, S.V.: Ignorance to awareness: towards an information security awareness process. SAIEE Afr. Res. J. **104**, 69–79 (2013)

2. Bauer, S., Bernroider, E.W.N., Chudzikowski, K.: Prevention is better than cure! Designing information security awareness programs to overcome users’ non-compliance with information security policies in banks. Comput. Secur. **68**, 145–159 (2017). https://doi.org/10.1016/j.cose.2017.04.009

3. Gundu, T., Flowerday, S.V.: The enemy within: a behavioural intention model and an information security awareness process. In: Information Security for South Africa (ISSA), pp. 1–8. IEEE (2012)

4. de Bruijn, H., Janssen, M.: Building cybersecurity awareness: the need for evidence-based framing strategies. Gov. Inf. Q. **34**, 1–7 (2017). https://doi.org/10.1016/j.giq.2017.02.007

5. Bada, M., Sasse, A.M., Nurse, J.R.: Cyber security awareness campaigns: why do they fail to change behaviour? arXiv preprint arXiv:1901.02672 (2019)

6. Kowalski, S., Walentowicz, S., Mozuraite Araby, R.: Using chatbots for security training of ICT users (2008)

7. ChatGPT: Generative artificial intelligence (AI) (2022)
8. Ajzen, I.: From intentions to actions: a theory of planned behavior. In: Kuhl, J., Beckmann, J. (eds.) Action Control. SSSSP, pp. 11–39. Springer, Heidelberg (1985). https://doi.org/10.1007/978-3-642-69746-3_2

9. O'keefe, D.J.: Persuasion: Theory and Research. Sage Publications, Newbury Park (2015)

10. Eagly, A.H., Chaiken, S.: Cognitive theories of persuasion. In: Advances in Experimental Social Psychology, pp. 267–359. Elsevier (1984)

11. Kleebayoon, A., Wiwanitkit, V.: Artificial intelligence, chatbots, plagiarism and basic honesty: comment. Cel. Mol. Bioeng. **16**, 173–174 (2023). https://doi.org/10.1007/s12195-023-0075-9-x

12. Baidoo-Anu, D., Owusu Ansah, L.: Education in the era of generative artificial intelligence (AI): understanding the potential benefits of ChatGPT in promoting teaching and learning (2023). https://papers.ssrn.com/abstract=4337484. https://doi.org/10.2139/ssrn.4337484

13. Kasneci, E., et al.: ChatGPT for good? On opportunities and challenges of large language models for education. Learn. Individ. Differ. **103**, 102274 (2023). https://doi.org/10.1016/j.lindif.2023.102274

14. Mallaboyev, N.M., Sharifjanovna, Q.M., Muxammadjon, Q., Shukurullo, C.: Information security issues. In: Conference Zone, pp. 241–245 (2022)

15. Flowerday, S.V., Tuyikeze, T.: Information security policy development and implementation: the what, how and who. Comput. Secur. **61**, 169–183 (2016). https://doi.org/10.1016/j.cose.2016.06.002

16. Gundu, T., Maronga, V.: IoT Security and Privacy: Turning on the Human Firewall in Smart Farming. In: Kalpa Publications in Computing, pp. 95–104. EasyChair (2019). https://doi.org/10.29007/j2z7

17. Choi, Y.-H.: A framework for making decision on optimal security investment to the proactive and reactive security solutions management. J. Internet Comput. Serv. **15**, 91–100 (2014)

18. Bogale, M., Lessa, L., Negash, S.: Building an information security awareness program for a bank: case from Ethiopia (2019)

19. Chen, J., Zhu, Q.: Interdependent strategic security risk management with bounded rationality in the internet of things. IEEE Trans. Inf. Forensics Secur. **14**, 2958–2971 (2019). https://doi.org/10.1109/TIFS.2019.2911112

20. Bacudio, A.G., Yuan, X., Chu, B.-T.B., Jones, M.: An overview of penetration testing. Int. J. Netw. Secur. Appl. **3**, 19 (2011)

21. Zakariyya, I., Al-Kadri, M.O., Kalutarage, H.: Resource efficient boosting method for IoT security monitoring. In: 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC), pp. 1–6 (2021). https://doi.org/10.1109/CCNC49032.2021.9369620

22. Stafford, T., Deitz, G., Li, Y.: The role of internal audit and user training in information security policy compliance. Manag. Audit. J. **33**, 410–424 (2018). https://doi.org/10.1108/MAJ-07-2017-1596

23. Jang-Jaccard, J., Nepal, S.: A survey of emerging threats in cybersecurity. J. Comput. Syst. Sci. **80**, 973–993 (2014). https://doi.org/10.1016/j.jcss.2014.02.005

24. Schlette, D., Caselli, M., Pernul, G.: A comparative study on cyber threat intelligence: the security incident response perspective. IEEE Commun. Surv. Tutor. **23**, 2525–2556 (2021)

25. Mamonov, S., Benbunan-Fich, R.: The impact of information security threat awareness on privacy-protective behaviours. Comput. Human Behav. **83**, 32–44 (2018). https://doi.org/10.1016/j.chb.2018.01.028

26. Da Veiga, A.: Comparing the information security culture of employees who had read the information security policy and those who had not: illustrated through an empirical study. Inf. Comput. Secur. **24**, 139–151 (2016). https://doi.org/10.1108/ICS-12-2015-0048

27. Gundu, T.: Towards an information security awareness process for engineering SMEs in emerging economies (2013)
28. Gundu, T., Modiba, N.: Building competitive advantage from Ubuntu: an African information security awareness model. In: ICISSP, pp. 569–576 (2020)

29. Choi, J.H., Hickman, K.E., Monahan, A., Schwarcz, D.: ChatGPT goes to law school (2023). https://papers.ssrn.com/abstract=4335905. https://doi.org/10.2139/ssrn.4335905

30. Gupta, A., Hathwar, D., Vijayakumar, A.: Introduction to AI chatbots. Int. J. Eng. Res. Technol. 9, 255–258 (2020)

31. Cameron, G., et al.: Towards a chatbot for digital counselling. In: Proceedings of the 31st International BCS Human Computer Interaction Conference (HCI 2017), vol. 31, pp. 1–7 (2017)

32. Duha, M.S.U.: ChatGPT in education: an opportunity or a challenge for the future? TechTrends **67**, 402–403 (2023). https://doi.org/10.1007/s11528-023-00844-y

33. Yoo, J., Cho, Y.: ICSA: Intelligent chatbot security assistant using Text-CNN and multi-phase real-time defense against SNS phishing attacks. Expert Syst. Appl. **207**, 117893 (2022)

34. Gulenko, I.: Chatbot for IT security training: using motivational interviewing to improve security behaviour. In: AIST (supplement), pp. 7–16 (2014)

35. Hamad, S., Yeferny, T.: A chatbot for information security. arXiv preprint arXiv:2012.00826 (2020)

36. Cotton, D.R.E., Cotton, P.A., Shipway, J.R.: Chatting and cheating. ensuring academic integrity in the era of ChatGPT (2023). https://edarxiv.org/mrz8h/. https://doi.org/10.35542/osf.io/mrz8h

37. Lo, P.: Warfare ethics in Sunzi’s art of war? Historical controversies and contemporary perspectives. J. Mil. Ethics **11**, 114–135 (2012)

38. Shropshire, J., Warkentin, M., Sharma, S.: Personality, attitudes, and intentions: predicting initial adoption of information security behaviour. Comput. Secur. **49**, 177–191 (2015). https://doi.org/10.1016/j.cose.2015.01.002

39. Ajzen, I.: The theory of planned behaviour: reactions and reflections. Taylor & Francis (2011)