Asian Journal of Research in Computer Science

Higher-education cybersecurity studies often report sample averages that can conceal subgroups with different protective-practice patterns. This study used a person-centred approach to characterise self-reported cybersecurity capability among Computer Science undergraduates at universities in Enugu State, Nigeria. A multistage proportionate sampling procedure yielded a planned sample of 393 students; 364 usable questionnaires were returned (92.6%). The analytic sample comprised 250 male and 114 female students, including 257 from public and 107 from private universities. The 60-item Utilisation of Cybersecurity Applications for Digital Learning Questionnaire assessed antivirus, firewall, encryption, multi-factor authentication (MFA), and virtual private network (VPN) practices on a four-point scale. Standardised domain scores were examined using constrained Gaussian mixture modelling. The retained three-profile solution had strong classification quality (BIC = 4453.41; entropy = .982; mean posterior probability = .992). It classified 90 students (24.7%) as vulnerable, 143 (39.3%) as developing, and 131 (36.0%) as capable. The vulnerable profile combined modest antivirus use with very weak practice in the other domains; the developing profile showed broadly low practice; and the capable profile was strongest in encryption, MFA, and VPN use. These patterns indicate that a single awareness programme is unlikely to meet all students’ needs. Universities should combine secure defaults with intensive onboarding for vulnerable students, habit-forming support for developing students, and advanced simulation and peer mentoring for capable students.