Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums Strategies, Barriers, and Future Directions

Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums — Strategies, Barriers, and Future Directions NALIN A. G. ARACHCHILAGE∗ and ASANGI JAYATILAKA∗ , School of Computing Technologies, RMIT,

arXiv:2608.17758v1 [cs.CY] 18 Aug 2026

Australia

SENURI WIJENAYAKE, School of Computing Technologies, RMIT, Australia DAVID HERBERT, University of Tasmania, Australia KAIE MAENNEL, AdelaideUniversity, Australia NICOLE HERBERT, University of Tasmania, Australia CLAUDIA SZABO, Adelaide University, Australia GABRIELLE MURRAY, Office of Indigenous Education Research and Engagement, RMIT University, Victoria GARY THOMAS, Office of Indigenous Education Research and Engagement, RMIT University, Victoria Australian women, gender-diverse individuals, and culturally and linguistically diverse (CALD) communities are often more susceptible to phishing and other forms of cybercrimes due to factors such as language barriers, limited access to cybersecurity education, and social isolation. These communities encounter substantial obstacles both entering and progressing in the cybersecurity field. In Australia, the Higher Education sector still leans heavily on a largely uniform cybersecurity curriculum, focusing heavily on technical proficiency, overlooking the vital impact of intersectionality and user-centered thinking for boosting student engagement and learning. Without gender inclusivity and proper consideration of intersectionality forms such as CALD, the workforce is deprived of the varied perspectives necessary to tackle today’s intricate cybersecurity issues. In this study, we conducted semi-structured interviews with 15 experienced academics teaching and coordinating cyber security programs from a diverse range of Australian universities, covering all states, to explore their perspectives on: i) current strategies for addressing the women, gender-diverse and CALD perspective in cyber security education in the Australian HE sector; ii) barriers to incorporate women, gender-diverse and CALD perspective in cybersecurity curriculums in higher education; iii) future work and support that is needed. Our research highlights a lack of systematic methods for integrating intersectional perspectives into cybersecurity curriculums. In particular, we identified four key barriers and four areas where support and future efforts are needed to address this issue. Our findings offer vital insights that can substantially ∗ Both authors contributed equally to this research.

Authors’ Contact Information: Nalin A. G. Arachchilage, nalin.arachchilage@rmit.edu.au; Asangi Jayatilaka, asangi,jayatilaka@rmit.edu.au, School of Computing Technologies, RMIT, Melbourne, Victoria, Australia; Senuri Wijenayake, School of Computing Technologies, RMIT, Melbourne, Australia, senuri.wijenayake@rmit.edu.au; David Herbert, University of Tasmania, Hobart, Australia, DAVID.HERBERT@UTAS.EDU.AU; Kaie Maennel, AdelaideUniversity, Adelaide, South Australia, Australia, kaie.maennel@adelaide.edu.au; Nicole Herbert, University of Tasmania, Hobart, Australia, nicole.herbert@utas.edu.au; Claudia Szabo, Adelaide University, Adelaide, South Australia, Australia, claudia.szabo@adelaide.edu.au; Gabrielle Murray, Office of Indigenous Education Research and Engagement, RMIT University, Melbourne, Victoria, gabrielle.murray@rmit.edu.au; Gary Thomas, Office of Indigenous Education Research and Engagement, RMIT University, Melbourne, Victoria, gary.thomas@rmit.edu.au. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org. © 2026 Copyright held by the owner/author(s). Publication rights licensed to ACM. Manuscript submitted to ACM Manuscript submitted to ACM

1

Nalin A. G. Arachchilage, Asangi Jayatilaka, Senuri Wijenayake, David Herbert, Kaie Maennel, Nicole Herbert, Claudia 2 Szabo, Gabrielle Murray, and Gary Thomas guide curriculum development in cybersecurity education. Additionally, these insights create a comprehensive roadmap for academic institutions, government bodies, accreditation bodies, and industry leaders to cultivate a more inclusive learning environment. CCS Concepts: • Social and professional topics → Gender; Cultural characteristics; • Security and privacy → Human and societal aspects of security and privacy. Additional Key Words and Phrases: Cyber security, Education, Human-aspects, Intersectionality ACM Reference Format: Nalin A. G. Arachchilage, Asangi Jayatilaka, Senuri Wijenayake, David Herbert, Kaie Maennel, Nicole Herbert, Claudia Szabo, Gabrielle Murray, and Gary Thomas. 2026. Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums — Strategies, Barriers, and Future Directions. 1, 1 (August 2026), 25 pages. https://doi.org/XXXXXXX.XXXXXXX

1

Introduction

Cybersecurity in the digital age has evolved into a sophisticated battleground where the most vulnerable targets are not systems, but people. Phishing attacks, social engineering tactics, and other forms of cyber exploitation thrive on human error, exploiting individuals as the weakest link in information security [Desolda et al. 2021; Zhuo et al. 2023] - phishing propagates other cyber-attacks such as ransomware or malware. The Australian Cyber Security Strategy 2023–2030 emphasizes that a critical skill gap exists in addressing these human vulnerabilities (via social engineering like phishing scams), with cybercriminals increasingly honing attacks to exploit personal, cultural, and situational weaknesses [Farlow and Banfield 2023]. This gap is especially pronounced when we consider intersectionality [Thomas et al. 2021b]—the diverse identities, backgrounds, and lived experiences that shape how individuals perceive and respond to cyber threats. For example, in particular, women and gender-diverse communities, and culturally and linguistically diverse (CALD) communities are disproportionately affected by cybersecurity vulnerabilities [Cross and Lee 2022]. In early 2023, phishing scams through various social engineering techniques resulted in over 5% million in losses, representing a diverse age group from CALD communities - women are more susceptible for phishing than men. Australian women, gender-diverse individuals, and culturally and linguistically diverse (CALD) communities are often more susceptible to phishing and other forms of cybercrimes due to factors such as language barriers, limited access to cybersecurity education, and social isolation [Leyton Zamora et al. 2021]. These vulnerabilities can make it easier for attackers to exploit them through deceptive communications, making them even more susceptible to phishing scams and other forms of cyber-attacks [Centre 2023]. In addition, these communities face significant barriers to entry and advancement within the cybersecurity workforce, including gender bias, cultural discrimination, and lack of representation in leadership roles [Anwar et al. 2017; Namukasa et al. 2023; Peacock and Irons 2017]. The lack of gender inclusivity, coupled with inadequate attention to other forms of such CALD diversity [Leyton Zamora et al. 2021; Sheanoda et al. 2024], results in a workforce that lacks the broad perspectives needed to address today’s multifaceted cybersecurity challenges. Despite these complexities, Australia’s Higher Education (HE) sector remains anchored to a cybersecurity curriculum that is largely one-dimensional [Griffin and Johnson [n. d.]], overlooking the importance of intersectionality in student engagement and learning [Griffin and Johnson [n. d.]]. Current programs tend to emphasise technical proficiency over cultural and social contexts, leaving critical blind spots in how students from diverse backgrounds may respond differently to threats like phishing (social engineering attacks) and other forms of cyber-attacks [Farlow and Banfield 2023; Griffin and Johnson [n. d.]]. For example, students from marginalized communities may face unique challenges Manuscript submitted to ACM

Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums — Strategies, Barriers, and Future Directions 3 due to language barriers, cultural nuances in communication, or varying levels of access to digital resources [Oropeza et al. 2010; Thomas et al. 2021a]—factors that are not adequately addressed in the existing curriculums in Australian HE. Therefore, a pressing need has emerged to revamp the Australian HE cybersecurity curriculum, fostering a more culturally inclusive and comprehensive approach that actively engages students by reflecting their diverse backgrounds, experiences, and perspectives [Farlow and Banfield 2023]. By integrating intersectionality into cybersecurity education, we can bridge these skill gaps, cultivating a generation of cybersecurity professionals who are not only technically proficient but also culturally competent to combat against cyber-attacks. To the best of our knowledge, there is little empirically known about current strategies employed to embed women, gender diverse and CALD perspectives into Australian HE cyber security curriculums, barriers for doing so, and future work and support needed. Motivated by this need we conducted an empirical investigation using in-depth semi-structured interviews with 15 academics from multiple Universities across all states in Australia. Our study findings contribute to the state-of-the-art understanding of by (i) providing an evidence-based understanding of the as-is state of embedding women, gender diverse and CALD perspectives into Australian HE cyber security curriculums, (ii) identifying the barriers academics face in embedding women, gender diverse and CALD perspectives into Australian HE cyber security curriculums, (iii) discussing of the future work and support needed in this context. The rest of the paper is organised as follows. Section 2 provides a comprehensive summary of the related work and Section 3 gives detailed analysis of the methods employed for data collection and analysis. Section 4 presents the findings arising from the qualitative data gathered through the study and the paper ends with a discussion of findings, threat to validity and conclusion in Section 5 and Section 6.

2

Related work

2.1

Cybersecurity Education in Australian Higher Education

Cybersecurity has rapidly evolved from a niche technical domain into a pervasive societal concern encompassing human, social, and cultural dimensions [Creese et al. 2021]. Despite this shift and the growing recognition of cybersecurity as a multidisciplinary field, higher education curricula remain largely technical in focus and fragmented in scope. Vykopal et. al., [Vykopal et al. 2025] show that many university cybersecurity programs worldwide fail to sufficiently integrate non-technical dimensions, including human, organisational, and societal factors, as well as broader contextual competencies. While this work highlights a significant lack of interdisciplinary integration, it stops short of examining how intersectional perspectives—such as gender, culture, socio-economic status, and the experiences of marginalised groups—are incorporated into cybersecurity education. This omission points to a critical knowledge gap [Vykopal et al. 2025]: the absence of systematic integration of intersectionality within curriculum design. Addressing this gap is essential to ensure that future cybersecurity professionals are equipped to engage with diverse user contexts, understand digital inequalities, and respond effectively to the uneven impacts of cyber risks across populations. Furthermore, the Australian Cyber Security Strategy 2023–2030 highlights a growing gap in cybersecurity capabilities, especially in areas that rely on understanding human vulnerabilities, such as phishing and social engineering attacks [Abeysooriya et al. 2023]. Despite this evolution, most higher education (HE) cybersecurity curriculums (e.g., NICE (National Initiative for Cybersecurity Education) framework [Newhouse et al. 2017], the Bologna standard [De Wit 2018] etc. — broadly adopted and used as a standard guideline for the formulation of cybersecurity degrees) remain technologically deterministic and lack critical engagement with socio-cultural factors that shape digital risks and safety behaviours [Abeysooriya et al. 2023; Mountrouidou et al. 2019]. Manuscript submitted to ACM

Nalin A. G. Arachchilage, Asangi Jayatilaka, Senuri Wijenayake, David Herbert, Kaie Maennel, Nicole Herbert, Claudia 4 Szabo, Gabrielle Murray, and Gary Thomas Globally, computing education researchers have highlighted the need for a broader and more inclusive approach to cybersecurity pedagogy [Mountrouidou et al. 2019; Parrish et al. 2018], as reflected in the principles of Culturally Responsive-Sustaining Computer Science Education [Center 2021] in general. This includes not only emphasizing technical proficiency but also fostering cultural competence, ethical reasoning, and user-centered thinking in cybersecurity practice. Within this context, human-centered cybersecurity education frameworks have emerged [Straight 2024a,b], recognising that “users—not systems—are” often the primary targets of attack [Arachchilage and Love 2014]. Cybersecurity education in Australia is shaped by a layered ecosystem of industry skills frameworks, accreditation standards, and curriculum guidelines across schooling, vocational training, and higher education [Griffin and Johnson 2024a]. At the professional level, the Skills Framework for the Information Age (SFIA) is the dominant industry standard, defining ICT and cybersecurity roles, skill levels, and responsibilities, and guiding workforce development across government and industry. Aligned with SFIA, several Australian education-focused frameworks shape curriculum design but remain largely skills- and competency-driven. The Australian Computer Society (ACS) Core Body of Knowledge (CBOK) underpins accreditation of university computing and IT degrees, mapping academic learning to industry expectations and migration pathways [Griffin and Johnson 2024b]. While CBOK includes ethics and professionalism, these aspects are typically addressed at a high level and often confined to single courses, rather than embedded across Australian HE cybersecurity curricula. On the other hand, the Australian Digital Capability Framework (ADCF), adapted from the European DigComp framework and adopted nationally from 2025, defines digital skills across five domains spanning foundational literacy to advanced ICT competence [Department of Employment and Workplace Relations 2025]. Although the ADCF provides a structured progression of digital capability across Vocational Education and Training (VET) and workforce training, it focuses primarily on individual skill acquisition and does not explicitly address how cybersecurity risks and practices intersect with gender, culture, or language [Department of Employment and Workplace Relations 2025]. On the other hand, the ASD Cyber Skills Framework, developed by the Australian Signals Directorate (ASD), aligns directly with SFIA to define cybersecurity roles and proficiency levels for education and workforce development [Australian Signals Directorate 2020]. While this framework strengthens career pathways and role readiness, its emphasis remains on technical capability and professional progression, offering limited guidance on inclusive or culturally responsive education [Australian Signals Directorate 2020; Department of Employment and Workplace Relations 2025]. At the pre-tertiary level, the Australian Curriculum: Digital Technologies (F–10) and senior secondary computer science syllabuses emphasise computational thinking, problem-solving, and practical skills, adopting a competency-based orientation similar to SFIA [Australian Curriculum, Assessment and Reporting Authority 2019]. However, these curricula largely model a generic learner and user, with minimal engagement with social, cultural, or intersectional dimensions of digital technologies and cybersecurity. Collectively, these frameworks demonstrate strong alignment between education and industry needs but share a common limitation: inclusivity and intersectionality are implicit values rather than explicit curriculum design principles, resulting in uneven and superficial integration within cybersecurity education [Accenture et al. 2026; Department of Employment and Workplace Relations 2025; Griffin and Johnson 2024b; Vykopal et al. 2025].

2.2

Intersectionality and Digital Vulnerability

Coined by Kimberlé Crenshaw, intersectionality explains how overlapping systems of oppression shape individuals’ lived experiences [Crenshaw 1989]. In the context of cybersecurity education, intersectionality becomes critical when Manuscript submitted to ACM

Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums — Strategies, Barriers, and Future Directions 5 examining how identity characteristics—such as gender, ethnicity, socio-economic status, and language—compound digital risk exposure and influence users’ responses to cyber threats [Mitta and Dupuis 2024; Vykopal et al. 2025]. Evidence from Australian contexts shows that women, gender-diverse individuals, and culturally and linguistically diverse (CALD) populations are disproportionately affected by phishing related scams, romance fraud, and technologyfacilitated violence and abuses [Australian Competition and Consumer Commission 2024; eSafety Commissioner 2019; Henry and Flynn 2018]. Attackers often exploit cultural norms/standards, communication styles, values, or expectations to enhance the effectiveness of phishing and social engineering cyber crimes [Desolda et al. 2021]. For example, in high power distance cultures—where hierarchy and authority are potential—attackers may impersonate senior executives to pressure employees into urgent actions, such as authorizing payments or disclosing credentials [Gottschalk [n. d.]]. This tactic, known as business email compromise (BEC) [Al-Musib et al. 2023; Bonhard et al. 2025] in the organisational settings, thrives on culturally reinforced obedience to authority figures. For instance, cybercriminals may impersonate a Chief Executive Officer within an Asian multinational organisation and exploit culturally embedded hierarchical communication norms. By adopting formal, authoritative language and leveraging perceived positional power, attackers can coerce employees into complying with fraudulent requests—such as initiating unauthorised fund transfers—often before adequate verification occurs [Abawajy 2014]. Similarly, in collectivist cultural contexts, attackers frequently appeal to notions of group loyalty, organisational harmony, or community obligation to manipulate targets emotionally. Such culturally tailored social engineering attack strategies increase perceived trust and reduce scepticism, thereby heightening individuals’ susceptibility to deception [Workman 2008]. Collectively, these examples underscore the critical need for culturally and linguistically aware (i.e., CALD) cybersecurity education and training to strengthen resilience against sophisticated social engineering attacks. Such threats are often deliberately tailored to exploit culturally embedded norms, values, and communication practices, making CALD communities disproportionately vulnerable. Addressing these risks requires cybersecurity interventions that move beyond generic awareness approaches and instead account for cultural context, language, and social dynamics within diverse populations. Furthermore, these communities also face systemic exclusion from cybersecurity education and workforce participation due to structural inequities, such as limited access to technical training, lack of culturally safe curriculums, and implicit biases in pedagogy and hiring practices [Australian Public Service Commission 2024; eSafety Commissioner 2019]. Yet, intersectionality is rarely operationalized in HE Australian cybersecurity education. Curriculums typically overlook the nuanced ways in which marginalised learners experience, understand, and respond to digital risks, leading to educational practices that are exclusionary, disengaging, and ineffective for diverse learners. 2.3

Current Limitations in Australian Cybersecurity Curriculums

Griffin and Johnson [Griffin and Johnson 2024b] critically examined how Australian HE cybersecurity programs align with the Skills Framework for the Information Age (SFIA), revealing a skewed emphasis toward technical knowledge at the expense of socio-ethical, psychological, and user-centered skills . This narrow framing fails to engage students who bring valuable lived experience with digital marginalization or who require culturally responsive teaching approaches to thrive (i.e., in our case women, gender-diverse and CALD community). Moreover, cybersecurity curricula and pedagogical practices frequently adopt a deficit-oriented framing when engaging with diverse student cohorts. In this approach, learners from non-normative identities—such as women, culturally and linguistically diverse (CALD) backgrounds, and gender-diverse communities—are positioned as inherently “at risk” or lacking, rather than being recognised for the distinctive skills, perspectives, and strengths they bring [Mountrouidou et al. 2019; Valencia 2012]. Such framings risk reinforcing structural inequities by marginalising diverse forms of knowledge and limiting meaningful Manuscript submitted to ACM

Nalin A. G. Arachchilage, Asangi Jayatilaka, Senuri Wijenayake, David Herbert, Kaie Maennel, Nicole Herbert, Claudia 6 Szabo, Gabrielle Murray, and Gary Thomas participation in cybersecurity education and the broader workforce. Such perspectives can reduce motivation, lower self-efficacy, and limit career aspirations among under-represented students [Ladson-Billings 1995] in cybersecurity within a country. As a result, there is growing consensus that HE institutions must transition from generic technical training to inclusive, intersectionality-informed curriculums that reflect the realities of digital life for all students—not just a normative, predominantly male, English-speaking, and Western cohort [Mountrouidou et al. 2019]. 2.4

Toward Intersectionality-Informed Cybersecurity Pedagogy

Addressing these disparities requires a pedagogical shift toward inclusive, intersectionality-informed teaching practices [Mountrouidou et al. 2019]. These may include: Embedding culturally responsive teaching materials that reflect students’ lived experiences. Incorporating collaborative learning and storytelling approaches that allow marginalized voices to shape content. Designing assessments that consider diverse linguistic and cultural modes of knowledge representation. Fostering supportive peer networks and mentorship opportunities for under-represented groups. Most importantly, such curriculums reforms must be informed by evidence based research, and the voices of those most affected by educational exclusion. Therefore, co-designing with students from marginalized communities—especially women, CALD, and gender-diverse individuals—ensures that reforms are grounded in real-world needs, not institutional or individual assumptions. 2.5

Gaps in the Literature and Research Contribution

Australia’s demographic profile has shifted markedly in recent years, with Census data showing that people born in India now constitute the largest overseas-born population, alongside substantial growth from countries such as China, Nepal, the Philippines, Vietnam, and Sri Lanka [Australian Bureau of Statistics 2025]. This increasing cultural and linguistic diversity is especially visible within Australian Higher Education and the cybersecurity workforce pipeline. However, Australian HE cybersecurity curricula continue to be designed around a largely homogeneous, English-dominant learner model, with limited consideration of how migration background, language, and cultural norms shape digital practices and cyber risk [Australian Curriculum, Assessment and Reporting Authority 2019; Australian Signals Directorate 2020; Department of Employment and Workplace Relations 2025; Griffin and Johnson 2024a, [n. d.], 2024b]. As Australia’s population and talent base become increasingly multicultural [Australian Bureau of Statistics 2025], the absence of culturally responsive and intersectionality-informed cybersecurity education represents a growing structural misalignment between who is being educated and how cybersecurity is taught. On the other hand, despite increasing attention to diversity in computing education [Hayes 2026], very few studies have operationalized intersectionality in cybersecurity curriculum design [Mountrouidou et al. 2019]. Most research focuses either on diversity in the workforce or on digital literacy interventions in community settings—not on transforming university HE curriculums to centre intersectional experiences within technical disciplines [Namukasa et al. 2023]. Despite the existence of multiple, well-established skills and education frameworks in Australia, there is little empirical research examining how intersectional perspectives are—or are not—embedded within cybersecurity curricula aligned to these frameworks [Australian Curriculum, Assessment and Reporting Authority 2019; Australian Signals Directorate 2020; Department of Employment and Workplace Relations 2025; Griffin and Johnson 2024a, [n. d.], 2024b]. Existing studies typically focus on workforce shortages, diversity in employment, or digital inclusion initiatives outside Australian Higher Education, rather than interrogating curriculum design practices within accredited university programs. Therefore, this study addresses this gap by providing the first multi-university empirical investigation of how Manuscript submitted to ACM

Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums — Strategies, Barriers, and Future Directions 7 Australian HE cybersecurity curricula currently engage with women, gender-diverse, and CALD perspectives, and by identifying structural, institutional, and pedagogical barriers that limit meaningful inclusion. By situating these findings within the broader ecosystem of SFIA-aligned frameworks (ACS CBOK, ADCF, ASD Cyber Skills Framework, and national curricula [Australian Curriculum, Assessment and Reporting Authority 2019; Australian Signals Directorate 2020; Department of Employment and Workplace Relations 2025; Griffin and Johnson 2024a, [n. d.], 2024b]), this research offers actionable insights for educators, accreditation bodies, policymakers, and industry seeking to strengthen both workforce relevance and educational inclusivity. This proposed research fills this gap by: i) conducting a multi-university analysis of current cybersecurity offerings across Australian HE institutions; ii) applying co-design methodology with students from intersecting marginalized identities; iii) developing practical, adaptable guidelines for embedding intersectionality in cybersecurity education across the Australian HE institutions. This contribution is especially timely given the broader societal push for equity in STEM education, the urgency of human-centred cybersecurity threats, and the increasing policy focus on inclusive digital capabilities in Australia. 3

Methods

We used semi-structured interviews to gather data from academics who have experience in teaching and or coordinating cyber security courses at Australian universities. These interviews explored their current strategies for embedding women, gender-diverse and CALD perspectives into the Australian HE cyber security curriculum, barriers faced, and the reasons for either integrating or not integrating intersectional perspectives into the Australian HE cybersecurity curriculum, and future direction and support needed. All participants received a 40 AUD gift card as a token of appreciation for their contributions. Ethical approval was obtained from the Human Research Ethics Committee of [removed to maintain anonymity] University prior to commencing data collection. 3.1

Interview guide preparation

The interview guide had three main sections: i) current strategies for inclusivity; ii) barriers to embedding women, gender-diverse, and CALD perspectives into Australian HE cyber security curriculums; iii) future work and support needed. All authors contributed to the development of the interview guide. A pilot was conducted to identify potential issues with question clarity and phrasing. The pilot interview helped us to understand two issues in the way we originally planned to ask the interview questions: i) not all participants may be fully aware of the key terms used in the interview guide, and ii) participants may be hesitant to disclose their personal challenges but more willing to articulate them as general issues. As a result, we decided to include: i) an introductory slide set about the project and the key terms used during the project (e.g., gender-diverse, CALD, intersectionality); ii) explanation at the start that participants are not required to base the responses solely on personal experiences; they may also draw upon current/past observations or what they have heard etc. We also changed the wording of certain interview questions to reflect these changes. The anonymised introductory slides and the interview questions are available here1 . 3.2

Recruitment and data collection procedure

We recruited 15 academics who had experience in teaching and/or coordinating cybersecurity courses in the Australian higher education sector. These academics included three Professors, four Associate Professors, three Senior lecturers and 1 Interview material is available here.

Manuscript submitted to ACM

Nalin A. G. Arachchilage, Asangi Jayatilaka, Senuri Wijenayake, David Herbert, Kaie Maennel, Nicole Herbert, Claudia 8 Szabo, Gabrielle Murray, and Gary Thomas five lecturers representing all states of Australia. The demographics of the participants are given in Table 1. Participants were recruited via invitation emails sent to potential study candidates identified through existing contacts or web searches. Most of these participants had extensive experience teaching cybersecurity across various universities within the Australian higher education sector. The interviews were conducted using Microsoft Teams and video recorded for analysis and transcription purposes. The interview lasted approximately 45-60 minutes. Two researchers were present in each interview. One researcher primarily led the discussion, while the other took detailed notes. At the start of each interview, we provided participants with an overview of the project, the aims of the interview study, explanations of the expectations from them, and an explanation of how the data would be analysed and used, using the introductory slides deck. We also provided them with the opportunity to ask the researchers any questions they had before the interview began. After that, participants were asked to provide answers to a set of basic demographic questions. A researcher shared their screen with a Google form for this purpose and filled in the data as the participants explained their answers to the given questions (e.g., years of experience teaching cyber security at the undergraduate level). When the participants were satisfied with their answers to the basic demographic information requested, the researcher submitted the form on their behalf. Next, we moved on to the interview questions. The interview was guided based on the interview guide explained in Section 3.1. At the end of the interview, participants were provided the opportunity to express any additional points they wished to make beyond the interview questions. Finally, the researchers thanked the participants for their time and mentioned that a gift card would be sent to them as a token of appreciation after the interview.

3.3

Data analysis procedure

We analysed the qualitative data obtained from interviews using thematic analysis based on the guidelines proposed previously [Braun and Clarke 2006]. Two authors, who had more than 10 years of experience with qualitative data analysis, worked closely together during the analysis. The process involved: i) familiarising with the data; ii) generating initial codes; iii) searching for themes; iv) reviewing themes; and v) defining and naming themes. We initially performed a pilot data analysis using data from three participants and discussed the findings before proceeding with the rest of the analysis. After the pilot, one researcher primarily led the analysis and held frequent meetings with the other researchers to review progress. Any disagreements were resolved through discussions during these meetings. We achieved theoretical saturation (i.e., a state where little fresh information emerges from subsequent interviews) because all the main themes and sub-themes had been uncovered across the 15 participants (see Figure 1). For example, the last five interviews provided more examples for the emerged findings but no new themes or insights emerged.

4

Findings

The semi-structured interviews conducted with academics who had experience in teaching and/or coordinating cybersecurity courses in the Australian higher education sector provided detailed insights into current strategies for embedding women, gender-diverse and CALD perspectives into cyber security curriculums, barriers for doing so and the future directions and support needed, which we explain below. An overview of study findings is presented in Figure 2. Manuscript submitted to ACM

Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums — Strategies, Barriers, and Future Directions 9

Fig. 1. Theoretical saturation achieved during data analysis. The last five interviews provided more examples for the emerged findings but no new themes emerged. Table 1. Participants demographics

4.1

PID State

Current title

Yrs of Exp teaching cybersecurity at the postgraduate level

Yrs of Exp teaching cybersecurity at the undergraduate level

Yrs of Exp coordinating postgraduate cybersecurity subjects

Yrs of Exp coordinating undergraduate cybersecurity subjects

P1 P2 P3 P4 P5 P6 P7 P8 P9 P10 P11 P12 P13 P14 P15

Associate Professor Lecturer Senior Lecturer Professor Professor Lecturer Associate Professor Associate Professor Professor Senior Lecturer Lecturer Lecturer Associate professor Lecturer Lecturer

9 5 6 6 20 5 4 6 20 6 5 5

9 16 10 6 25 0 4 0 20 6 1 4

9 1 4 6 15 5 4 6 20 4 5 5

9 1 4 6 18 0 4 0 20 5 1 4

5 5

3 5

5 0

3 5

New South Wales Tasmania New South Wales New South Wales South Australia South Australia Queensland South Australia Victoria Western Australia New South Wales Tasmania Victoria New South Wales Tasmania

Current strategies

In this section, we present participants’ explanations about their current strategies to embed intersectional perspectives, specifically women, gender-diverse and CALD perspectives, into cyber security Australian HE cyber security curriculums. 4.1.1

CS1: Lack of systematic ways to embed intersectional perspectives into cyber security curriculums. Manuscript submitted to ACM

Nalin A. G. Arachchilage, Asangi Jayatilaka, Senuri Wijenayake, David Herbert, Kaie Maennel, Nicole Herbert, Claudia 10 Szabo, Gabrielle Murray, and Gary Thomas

Fig. 2. Overview of the study findings

CS1.1: Limited translation of high-level strategic directions to grassroots implementation. All participants unanimously agreed that, currently, there are limited or no systematic ways to embed women, gender-diverse and CALD perspectives into cyber security curriculums. Although university strategies often emphasise the importance of inclusivity and diversity, participants noted that there is limited support for translating these commitments into grassroots implementation, particularly in curriculum design and delivery “Most of the universities where I worked, and I am aware that they all have a policy for diversity and inclusion. But it is very unlikely you will see something exclusive for cybersecurity. You will see that in the industry I work in, I work very closely with the industry and the Community, and you’ll see there is a big demand. There is a gap in women’s representation in the cyber and cloud communities. However, we don’t see many policies in place” (P1). In terms of intersectionality, beyond the inclusion of women, gender-diverse, and CALD perspectives, some participants noted that there have been encouraging advancements in integrating Indigenous perspectives into the cybersecurity curriculum. On the other hand, some participants acknowledged the presence of active members who are experts in Indigenisation but noted that these experts have not yet been able to embed Indigenous perspectives into cybersecurity programs or courses. CS1.2: Informal or individual strategies. While there are currently no systematic or institution-wide approaches in place for embedding women, gender-diverse, and CALD perspectives into cyber security curriculums, some participants described informal or individual strategies they have adopted to address these issues to some extent in their courses or those taught by people they know. For example, some explained that general discussion about diversity and inclusion is carried out as a part of the ethics related course/topics within the cyber security curriculams. “In regards to sort of management and society issues, so again, you know you may have a situation where gender is discussed, but it’s like it’d be Manuscript submitted to ACM

Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums — Strategies, Barriers, and Future Directions 11 like one week in an ethics course, you know, and that’s the extent.” (P9) Another participant explained that she would do an early assessment in a course she designed, which is considered a diagnostic test to determine who needs support in language. Based on the results of this early assessment, their team would then conduct learning circles to ensure that students lacking language skills are well supported and brought up to a standard that allows them to follow the course. “We did the first assignment really early, and it was a diagnostic test. So with the diagnostic test, I could actually pick out people whether they. Whether they were older males with no academic experience or whether they were from Vietnam with hardly any English. Then my friend would actually put in the learning circles to bring them to the stage where we believe that they could. Deal with the curriculum as it was. So, generally speaking, we were dealing with language.” (P5) 4.2

Barriers

In this section, we describe what participants explained when they were asked to explain barriers for embedding women, gender-diverse and CALD perspectives into cyber security curriculams. 4.2.1

B1: Governmental and institutional barriers.

B1.1 Lack of support and encouragement from the government. Our participants emphasised that the government should increase funding to universities to better support women, gender-diverse, and CALD communities. Currently, there is a noticeable lack of targeted initiatives in these areas, highlighting the need for clearer support structures. One participant even highlighted that there is no dedicated ministry representing these minority groups. Due to financial pressure, universities are often compelled to restrict their capacity to provide comprehensive support and promote inclusive environments. “There is financial pressure in our universities and limitations in providing the funding resources to cover this area. At least for my organisation, I had a discussion yesterday about some updates to the course which is needed. However, we still need to wait until the end of this year, as any course revision, even if agreed upon by the discipline, requires support from the school. But the school doesn’t have sufficient financial support” (P7). Additionally, when the governments change, policies and funding priorities often shift, which can disrupt ongoing initiatives and create uncertainty for universities striving to support diverse communities effectively “Is it important that Universities really want this to happen, even if when things when times get tough, I don’t want to be this the first one to drop off when there is a workplace change. I’ve seen this, which is not good” (P4). Participants highlighted that by addressing these issues, Australia can ensure its higher education institutions become more equitable and effective. B1.2: Constraints related to workload and promotion opportunities. Participants noted that their workloads frequently leave little to no time to explore the importance or relevance of intersectional perspectives in their courses and/or to integrate these perspectives into their teaching. As a result, the demanding nature of academic responsibilities often hinders engagement in diversity and inclusion initiatives. It restricts participation in activities beyond core teaching and research duties that are prioritised through the workload model. Furthermore, when academics perceive that these initiatives are not properly recognised in their promotion pathways, their motivation to engage in them diminishes further “When they [academic staff] apply for a promotion, then that [collaborative work done in designing courses with intersectional perspectives] should be highly valued. It is easy to say that - We encourage cross-university, cross-college, cross-departmental collaborations, but at the same time, the value should be heard” (P13). B1.3: Lack of supportive teaching resources for the academics. The lack of teaching resources is one of the significant barriers for them to integrate women, gender-diverse and CALD perspectives into the cyber security courses they teach. In fact, our participants identify two specific gaps. Firstly, there is a lack of research that informs curriculum Manuscript submitted to ACM

Nalin A. G. Arachchilage, Asangi Jayatilaka, Senuri Wijenayake, David Herbert, Kaie Maennel, Nicole Herbert, Claudia 12 Szabo, Gabrielle Murray, and Gary Thomas design with robust scientific underpinnings in the areas of diversity and inclusion, making it challenging to develop evidence-based educational content. Secondly, there is a shortage of relevant use cases and personas that can be utilised in classrooms as examples. This limits the ability to engage students with practical, real-world scenarios that reflect diverse perspectives “The challenge is we do not have access to some sort of pool of real-world use cases or case studies so that you can bring them into either ethical discussions or sort of human-centric courses” (P6). 4.2.2

B2: Diversity and attitudinal challenges.

B2.1: Lack of diversity in academia and industry. Cyber security field is predominantly dominated by males, which creates a lack of diverse perspectives and experiences within the field. In particular, having more women and genderdiverse and CALD representation in academia and industry potentially creates more opportunities for cyber security solutions and approaches that a more diverse workforce could bring. This diversity could also influence the development of curriculums, ensuring that educational content reflects a broader range of perspectives and prepares students to address complex, real-world challenges. Participants explained that cyber security academics, who are often males, frequently use case studies and examples biased towards males and mono-cultures in their lecture material and assignments “Often when we write assignments and exams, we say, imagine an organisation with, you know, so, so many people working on. Often, the examples that we give are very male and very mono-cultural”. On the other hand, from the students’ perspective, having fewer women, gender-diverse, and CALD role models could limit their inspiration to pursue courses and careers in the cyber security field and to excel in them. B2.2: Perceived relevance of intersectionality related topics among technically-oriented staff. Cyber security is inherently considered a technical subject, and most academics teaching cyber security courses in the HE sector possess the most experience with technical skills such as coding, network security, and encryption methods. They also focus on teaching these skills to students. “So who’s going to teach it? Most of the teachers are actually the hardcore cybersecurity people.” (P4) Furthermore, one participant explained that for master’s level courses, students come from diverse backgrounds; hence, often providing technical skills and knowledge is seen as more critical by both educators and students. Technical skills are crucial for a graduate completing an undergraduate or master’s degree related to cyber security; however, to identify and develop effective solutions for today’s multifaceted cyber security challenges, the students should be equipped with a much broader skill set. This includes not only technical expertise but also critical thinking, ethical reasoning, and an understanding of the socio-cultural dimensions of cyber security. Unfortunately, most technically oriented academic staff seem to overlook this fact and are reluctant to incorporate intersectional perspectives into the courses they teach. 4.2.3

B3: Collaboration and integration challenges.

B3.1 Challenges for interdisciplinary collaborations. Our participants emphasised the need for interdisciplinary collaborations for embedding women, gender-diverse and CALD perspectives into the cyber security curriculum. For example, cyber security academics working hand in hand with faculty members from the School of Psychology were identified as a possible step towards identifying effective ways to embed intersectional perspectives into the learning materials and assessments. Although interdisciplinary approaches offer significant benefits, participants explained several challenges in their implementation, which we describe below. Manuscript submitted to ACM

Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums — Strategies, Barriers, and Future Directions 13 Participants explained that the different mindsets across diverse disciplines present challenges in both teaching and research. In terms of research, different disciplines favour different publication venues. The divergence in publishing priorities can make it difficult for researchers from various fields to find common ground and effectively share their interdisciplinary work with broader audiences “We encourage people to collaborate, but at the end of the day we are publishing in two different venues that have different recognitions... That creates a huge barrier for people to collaborate hand in hand with the other people” (P13). Similar issues can arise in teaching. The focus of two or more disciplines on teaching matters could vary significantly, creating unnecessary tension. This divergence may lead to conflicts over curriculum priorities, teaching methodologies, and assessment criteria. As a result, cross-disciplinary collaboration needs significant time and effort. However, participants fear that they may receive limited recognition from top management for such interdisciplinary work. 4.2.4

B4: Knowledge and capability gaps.

B4.1: Lack of education, awareness and training among the staff. Our participants described various limitations in awareness, education and training among the staff, which hinders their capacities to embed women, gender diverse and CALD perspectives into cyber security curriculams. Some participants even acknowledged that they have not thoroughly considered the importance of integrating intersectional perspectives into their teaching practices. This lack of reflection can stem from being focused on traditional academic routines or facing the pressures of immediate teaching and research demands, leaving little room for exploring novel avenues that enrich students’ overall learning experiences. On the other hand, even the academics who are aware of the importance of embedding intersectional perspectives into cyber security curriculum, lack of education and training on how to embed these perspectives into their courses and to make the integration a relevant way for students “familiarity with the area would also be something that would hold them [academics] back. I think there might be a lack of education there. There is a general understanding that diverse perspectives are important. But there is a lack of knowledge of exactly what those different perspectives and tools are and how to integrate them into their teaching” (P11). Furthermore, some participants explained they or other academic staff they know lack the confidence to discuss sensitive topics in the classroom. They are concerned that the examples or vocabulary they use could offend a particular student or even a group of students. B4.2: Difficulties in measuring success. Measuring success in incorporating intersectional perspectives into curriculams requires more than just tracking the increase in enrolment from diverse student groups. A participant explained that it should involve evaluating how well these perspectives are integrated into learning outcomes and assessing their impact on students’ learning experience. However, until now, there are no clear ways of measuring success in tangible and fair ways. “The quality is often hard to measure. Often, it does not appear well in Excel sheets. Yes, you can measure - how many females? These are things you can measure. However, some things cannot be measured. What is your goal, and what is your target? What are the measurable outcomes of achieving much better inclusivity and diversity?” (P4) Even a participant explained that their University is putting a lot of effort into embedding indigenous-specific perspectives, issues, and solutions into the courses they teach; however, they are struggling to identify the most effective ways to measure the success of these initiatives. The participant further explained that the University can show statistics indicating that enrolments from Indigenous students have significantly increased after their initiatives were launched, but this measure alone is not sufficient to identify how effectively these students are engaging with and benefiting from Manuscript submitted to ACM

Nalin A. G. Arachchilage, Asangi Jayatilaka, Senuri Wijenayake, David Herbert, Kaie Maennel, Nicole Herbert, Claudia 14 Szabo, Gabrielle Murray, and Gary Thomas the curriculum or how students, in general, are equipped to tackle real-world cybersecurity challenges upon graduation after the initiatives are introduced. B4.3: Lack of processes, frameworks and tools. Our participants explained various issues related to processes, frameworks and tools restricting the ability or demotivating the Universities and academics to focus beyond technical subjects within the cybersecurity curriculums. One of the significant factors is how the cyber security curriculams are accredited at the moment. Australia’s cyber security curriculums is often accredited based on the Australian Computer Society (ACS), as it provides pathways for international students to immigrate to Australia. Currently, based on ACS accreditation, the focus is on teaching several core courses that encompass the body of knowledge. These courses are largely technical, with a limited focus on social and human aspects, such as intersectionality. As a result, most cybersecurity curriculums address inclusivity-related topics only at a surface level, often within an ethics course “In the Australian context, all IT and information systems courses are credited by the Australian Computer Society. So the reason universities do that is, again, it’s a professional body. Additionally, it provides a pathway for international students to migrate. So it’s very attractive. The Australian Computer Society has a body of knowledge that should be taught in every IT course. And again, the focus is very much on technology with a very small part focus on ethical, social and business issues” (P9). Participants pointed out other countries that have processes and frameworks that focus on gender and inclusivity as a part of the cybersecurity curriculums. For example, the United Kingdom (UK) has developed a cybersecurity body of knowledge (i.e., CyBOK) that universities are expected to teach, along with cyber apprenticeship programs. These initiatives explicitly focus on intersectional perspectives, such as gender, ensuring they are integrated into the curriculum. Often Australia tend to follow processes and frameworks that the UK develops. However, a participant highlighted issues associated with adopting a model from another country, such as the UK, and applying it directly to Australia. They noted that each country has its unique characteristics and challenges, which must be taken into account. Australia’s distinct cultural and socio-economic landscape can significantly influence the effectiveness of such models. For example, the participant emphasised the importance of tailoring approaches to meet Australia’s specific needs and circumstances, rather than assuming that processes, frameworks, and tools successful in other contexts will be universally applicable. 4.3

Future directions and support needed

In this section, we describe participants’ perspectives on future work and support needed for embedding women, gender-diverse and CALD perspectives into cyber security curriculums in the Australian HE sector. 4.3.1

FW1: Inclusive and participatory curriculum design.

FW1.1: Consultations with marginalised communities in course design. Participants explained the need for consultations with marginalised communities when designing the Australian HE cyber security curriculum [Australian Public Service Commission 2024; eSafety Commissioner 2019]. Such consultations are crucial for ensuring the curriculum reflects diverse perspectives and addresses the specific needs and challenges faced by these groups. By incorporating insights from marginalised communities, educators can create more inclusive and relevant course content. For example, by consulting with marginalised communities, academics can identify real-world case studies and examples that they can use in class for teaching and assessment. Having access to such rich real-world case studies and examples will potentially address the challenges related to the lack of supportive teaching resources for the academics described in Manuscript submitted to ACM

Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums — Strategies, Barriers, and Future Directions 15 Section 4.2.1. Furthermore, this approach not only enhances the educational experience but also prepares students to consider social and ethical dimensions in their future cybersecurity careers “I definitely think there is a huge opportunity to involve students from some of these specific groups. Co-design curriculums that are relevant to them. So, it’s not just curriculum content, but also the delivery that’s relevant for them. The reason why that’s important is that sometimes it’s easy to sit back, especially as academics and researchers, and think, These are your issues. These are your challenges and this is how you fix your challenges. Co-design is so powerful because it’s empowering. It’s participatory. It allows people to own whatever solutions they come up with. So for me, yeah, co-design actually will go a very long way in addressing this problem” (P8). FW1.2: Interdisciplinary collaboration among academics and other staff. Collaboration among interdisciplinary academics and other staff in course design is crucial for fostering innovation and enhancing educational outcomes. In terms of teaching, our participants emphasised the importance of academics teaching cybersecurity courses, collaborating with academics from other disciplines when designing curriculams and course materials. This interdisciplinary approach ensures that courses are comprehensive, reflecting the complexities of modern cybersecurity challenges. By integrating diverse expertise, we can develop cyber security programs that are not only technically robust but also consider intersectional perspectives, preparing students for real-world applications. Such collaborations should be valued, recognised and promoted from the University management. Furthermore, one participant suggested the possibility of having a separate team that specialises in intersectional perspectives that could work hand in hand with academics to ensure that diverse perspectives are integrated into the curriculum, leading to more comprehensive and engaging learning experiences “It is something like when you’re developing a course, it would be quite nice to have a dedicated team who are working hand in hand with academic. That needs to be properly formulated with awareness of all the schools and heads of schools” (P13). In terms of research, participants highlighted that more scientific evidence is needed to explain how intersectional perspectives can be effectively integrated into curriculums. They highlighted the need for studies that demonstrate how existing educational frameworks can be contextualised to accommodate diverse viewpoints. This research is essential for developing an inclusive educational approach that addresses the varied needs of students and prepares them for complex environments. FW1.3: Learning and employability linkage. Our participants highlighted that students might resist learning cyber security courses embedded with intersectional perspectives if they are uncertain about the relevance of the teaching content to the cybersecurity challenges they could encounter in their careers after graduation. The participants believe that as long as academics can demonstrate the necessity and relevance of looking beyond technical aspects and into intersectional perspectives for solving complex real-world cybersecurity challenges, students will be more open and motivated to engage with the material “I look at the utmost benefit of the students and then I try to reverse engineer my teaching delivery and whatever I teach in the class. So it’s my best interest to incorporate all this in my teaching so that my students can become successful. Our job is to make sure the students become global leaders and global experts not just for a certain geographic location so in reality” (P10). To enhance the professional relevance of educational content, it is essential that all teaching materials, including diverse perspectives, are explicitly connected to course learning outcomes, specific job roles within enterprise security, and broader industry expectations. By incorporating gender and cultural dimensions into practical, job-focused scenarios, Manuscript submitted to ACM

Nalin A. G. Arachchilage, Asangi Jayatilaka, Senuri Wijenayake, David Herbert, Kaie Maennel, Nicole Herbert, Claudia 16 Szabo, Gabrielle Murray, and Gary Thomas these abstract concepts could become more concrete and accessible for students. This method not only deepens understanding but also prepares students to apply these insights effectively in their future careers. As a result, learners are better equipped to navigate and contribute to an increasingly inclusive and dynamic workforce, aligning their skills with the evolving demands of the industry and broader context in which cybersecurity operates. 4.3.2

FW2: Processes, frameworks, toolkits and training.

FW2.1: Processes, frameworks, and toolkits for academics. Often, governments and universities establish strategies aimed at promoting inclusivity and intersectionality. These strategies are in place to promote educational environments that embrace diversity in all its forms, ensuring that curriculums and University practices reflect a variety of perspectives and experiences. However, without proper processes, frameworks, and toolkits, academics struggle to implement those high-level strategies. Our participants pointed out that evidence-based research is needed to determine how to effectively integrate intersectional perspectives into curriculums and how existing frameworks can be contextualised. However, as previously pointed out (see Section 4.2.4), adapting frameworks from other countries to Australia may not be straightforward. This complexity arises from Australia’s unique cultural and social contexts, which necessitate tailored approaches to ensure these frameworks are relevant and effective in addressing local intersectional challenges. A participant also emphasised the importance of engaging in discussions with accreditation bodies, such as the Australian Computer Society, to explore the possibility of updating the body of knowledge and curriculum model to ensure better representation of gender issues and other forms of inclusivity. “If you go back to that fundamental issue that Australia has with our courses about curriculum design and accreditation, it would actually be important to have a conversation with the Australian Computer Society. There is an existing body of knowledge that every course is supposed to teach. It is whether that body of knowledge and that curriculum model. Can it be updated to reflect gender issues and inclusivity as part of the curriculum of every course?” (P9). As explained in Section 4.2.4, if the body of knowledge has an emphasis on intersectional perspectives, there is more motivation for the Universities to actively start looking into ways of embedding these concepts into their curriculums. Apart from the aforementioned processes and frameworks, academics also need access to targeted resources and examples. These resources should include, but are not limited to, a comprehensive pool of case studies, cybersecurity challenges, and potential solutions “I think it would be great to have a pool of examples. What can we pull or bring into the ethical discussions or human-centric topic courses?” (P6). Such resources would enable educators to illustrate practical applications of intersectional perspectives and equip students with the skills necessary to address complex, real-world cybersecurity issues. FW2.2 Culturally sensitive awareness and training for staff. One of the major challenges academics are currently facing, as described in Section 4.2.4, is the lack of awareness and training. Many academics are not fully aware of the cybersecurity challenges experienced by women, gender-diverse, and CALD communities. Even those who recognise these issues often lack the expertise to integrate these perspectives into their courses. Therefore, our participants suggested that there needs to be systematic training offered to the academics to clearly understand the importance of the intersectional perspectives in solving real-world cyber security challenges and ways of embedding these concepts in the courses they teach. “We need some culturally sensitive training to help us. Come up with this sort of material or these sorts of course designs. Because again, you’d be doing it in that sort of isolationist, patronising sort of viewpoint if you weren’t aware of each of these different members of society and what their concerns. So timely training” (P2). Our Manuscript submitted to ACM

Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums — Strategies, Barriers, and Future Directions 17 participants further highlighted the importance of providing such training to program managers and discipline leaders to ensure these initiatives are supported at all levels. 4.3.3

FW3: Institutional commitment.

FW3.1 University-level integrated approach. Participants highlighted the need for a university-level integrated approach to better align Australian HE cyber security curriculams with intersectional perspectives. This should be demonstrated through consistent top-down leadership and strategic allocation of resources. University KPIs should be re-evaluated to assess their alignment with intersectional goals and initiatives. By ensuring KPIs encompass intersectional perspectives, program managers and discipline heads are motivated and made responsible for driving meaningful initiatives that promote diversity and inclusivity aspects within their curriculams “This needs to be a top priority in cyber because otherwise, we’re really missing all the quality in the market. So maybe developing Key Performance Indicators (KPI) for managers and for the university to measure how inclusive our curriculum is” (P4). Once university-level KPI’s are in place for recognising the importance of intersectional aspects, there will be motivation to introduce program-level objectives and course learning outcomes that explicitly incorporate intersectional perspectives as well. Such integration helps to create a curriculum that not only meets academic standards but also prepares students to engage effectively with complex, real-world challenges in a diverse society. Furthermore, participants emphasised the importance of aligning classroom discussions with student assessments. It’s crucial to focus on developing assessments that incorporate elements of intersectionality, ensuring that diverse perspectives are reflected and understood by the students “If I talk about the attacks on under-represented groups, then there should be good questions in my assignments or exams using real-word scenarios” (P7). FW3.2 Introduction of elective courses. To ensure that Australian higher education is inclusive, relevant, and responsive to the intersectional needs of diverse student populations, universities could begin by introducing related elective courses to their curriculams rather than introducing the intersectional perspectives in core courses directly. This may be viewed as a more risk-averse approach as the integration can be accomplished without significantly altering existing frameworks and structures. The success of such elective courses can serve as a starting point to demonstrate the importance of the associated content to universities, government, industry, and accreditation bodies “I actually think what you would need to do is develop a unit as an elective fast into a degree program. To then highlight the success of that new offering, engage it with the industry. Then, suggest developing it into the core of the degree course as part of that conversation, having the engagement. With government and industry as part of that, the elective can develop and grow. The problem you’re going to have is taking something that’s a new concept and embedding it directly into the core of a degree course. When it comes to the curriculum in universities, it’s very much risk-averse. So again, when you have a new idea or are trying to fit that into the core, you may face quite a bit of resistance. Whereas if you developed the new unit as an elective and really proved the concept, you know, raised the awareness of the elective, then the next step is to get it into the core of the degree” (P9). A participant also highlighted that program managers and discipline leads should carefully consider who will teach such courses. One participant explained that academics who teach such courses should be carefully selected based on their passion and teaching and research interests, rather than selecting someone from the team who has a lighter teaching load. Manuscript submitted to ACM

Nalin A. G. Arachchilage, Asangi Jayatilaka, Senuri Wijenayake, David Herbert, Kaie Maennel, Nicole Herbert, Claudia 18 Szabo, Gabrielle Murray, and Gary Thomas FW3.3 More recognition and support for academics from their departments and disciplines. As mentioned in Section 4.2.1, academics are often overloaded with research and teaching commitments. As a result, even academics motivated to make changes to their courses are unable to do so due to constraints in their workloads. Therefore, our participants noted that discipline heads or school heads must actively seek ways to support such academics by providing them with additional resources or allocations within their workload to develop new courses and/or improve existing ones “The workload model should factor these as well. Because if that is important, then it is not just a matter of ticking the boxes - Oh yeah, we got that interdisciplinary thing, or do we really need to deep dive into it? Then that should be clearly identified in the workload. It is like developing a new state-of-the-art master’s program” (P13). On the other hand, academics are often driven by career progression and promotions; hence, universities could consider ways to provide more recognition to academics who make an effort to update their courses or develop new courses with intersectionality aspects in mind. Such incentives would encourage more academics to consider these perspectives when designing their courses. FW3.4: More women, gender diverse and CALD representation in staff. Participants emphasised the importance of increasing the representation of women, gender-diverse individuals, and those from CALD backgrounds among academic staff, highlighting their potential to serve as role models for students. Moreover, involving such academics in curriculum design can enrich the process by incorporating their lived experiences and diverse perspectives “Something that we did when I was still in [a different University], and it goes back to what I mentioned earlier about modelling and seeing role models, is that we very intentionally recruited female lecturers for some positions to be able to have a role model. After we recruited her, she was a data scientist, we started have a lot more females wanting to participate in that. So I mean something as simple as that. It’s just a role model who shows that this is possible can be done. You know you should never disregard how how impactful that can be” (P8). 4.3.4

FW4: Cross-Sector collaboration and partnerships.

FW4.1: Government support and funding. Our participants emphasised the need for the government to play a pivotal role in promoting inclusivity and intersectional aspects within society as a whole. The government could consider targeted funding or incentives for universities that meet or exceed intersectionality goals. “The government could fund and support some institutions that are offering courses like this. So that the institution itself. Universities aren’t the ones that are driving it. It would be more government-based and you could then get the right experts who have the right expertise in the room to develop and deliver those courses” (P14). One of our participants even highlighted that Australia does not have a dedicated cyber security minister, and the current cyber security minister oversees many sectors where priorities may be different “We had a dedicated Cyber Minister, who sat in Cabinet as a cyber minister. That isn’t the case now” (P9). Furthermore, participants noted that the government could encourage more research in this area by enabling anonymised, shared datasets, as is done in healthcare. FW4.2: Collaboration between academia, industry and government. Our participants emphasised the importance of fostering stronger partnerships and shared visions among government, industry, and academia to promote and support intersectional perspectives within the University. Such partnerships would then be reflected in top-down leadership, resource allocation, and systemic accountability from all parties, including universities, government and industry. One participant explained that the recently established executive cyber council in Australia and the cyber security skills Manuscript submitted to ACM

Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums — Strategies, Barriers, and Future Directions 19 workbook that is planned to be launched could be considered the first steps towards that much-needed collaboration in the cyber security sector. However, the participant was not able to comment on both these initiatives further as the information about them was not publicly available at the time of the interview “I suppose there is a need to bring together industry, academia, and government, whether the Executive Cyber Council is the way to do that, I don’t know. But it’s the first step in that way. Within the next sort of month or so, this cybersecurity Skills workbook will be released. What’s in that? I do not know. But because it would be supported by the government and then supported by industry, it’ll be used as sort of a major driver of change” (p9). Furthermore, participants discussed how the industry could contribute through funding, sharing real-world use cases, and providing access to data. One participant highlighted that Work Integrated Learning (WIL) could be an effective mechanism to enhance these collaborations. While some industries have a genuine need to tackle pressing issues, academics can play a crucial role in supporting these efforts. In return, industry partners should be encouraged to actively engage, providing relevant data to foster meaningful collaboration and impact.

“Usually what happens is industry says I have a problem and academics solve it for me. Then the academics do what they can, and they come up with a report that industry may or may not then integrate. But if industry actually does stuff, if it actually gets involved in the teaching or in taking on interns or in sharing some potentially useful data that could be useful for students. To work with or create opportunities for them to role-play or create use cases that we can then use. That would be something that the industry could genuinely do to help and support” (P11).

5

Threats to validity

We discuss potential threats to the validity of the study, specifically in terms of data collection and analysis. The data collection materials, designed to capture comprehensive insights, were carefully crafted to minimise biases and maximise participant input. All authors contributed to the development of the interview guide. Based on the insights gained from the pilot interview, we decided to include a set of slides at the beginning of the interview to provide participants with a clearer understanding of the study’s aims. Furthermore, we invited participants to share either their own experiences or those of others whom they know. The research team intentionally selected this approach to cultivate a supportive and non-confrontational atmosphere, ensuring participants felt secure and not scrutinised. By fostering this environment, we aimed to facilitate open and honest dialogue, thereby enriching the quality and depth of the insights gathered. Our participants included three Professors, four Associate Professors, three Senior lecturers and five lecturers who had experience in teaching and coordinating postgraduate and undergraduate cyber security courses. While the academics who participated in this study represented all states in Australia and had a vast amount of experience in the field, we acknowledge that qualitative studies are inherently interpretive [Malterud 2016]; the findings are based on the studied context, thus making it challenging to generalise. We reached theoretical saturation, which indicates adding more participants from the same group will not influence findings; however, large-scale studies can be conducted to validate the current study’s findings and investigate their generalisability in other contexts. We believe our findings can be recreated and adapted in other similar contexts. To support this, we have provided detailed information about the participants, research methodology, and the interview material in Section 3. Manuscript submitted to ACM

Nalin A. G. Arachchilage, Asangi Jayatilaka, Senuri Wijenayake, David Herbert, Kaie Maennel, Nicole Herbert, Claudia 20 Szabo, Gabrielle Murray, and Gary Thomas Data analysis was primarily conducted by the first two authors. Both authors jointly conducted the data analysis through an iterative and collaborative process. They regularly reviewed and discussed the emerging codes, subthemes, and themes in relation to the interview transcripts to ensure consistency, accuracy, and analytical rigor. All interpretations were continuously cross-validated against the raw data, drawing on the each authors’ expertise of more than 10 years in qualitative research and analysis. They held meetings to discuss the findings in depth, resolving any disagreements collaboratively. However, the findings were not verified with participants through member checking, posing a risk of potential misinterpretations from the interviews. 6

Discussion and conclusion

This paper critically examines cybersecurity education within the Australian Higher Education sector, focusing on the inclusion of women, gender-diverse individuals, and those from CALD backgrounds. Our findings reveal complex barriers and essential future actions, which ultimately affect Australia’s ability to develop a robust, innovative, and diverse cybersecurity workforce [Australian Public Service Commission 2024; eSafety Commissioner 2019]. In this section, we provide an overview of study findings and discuss implications of study findings for universities and policy makers, educator, industry and researchers. 6.1

Overview of findings

Overall, our findings indicate that intersectional perspectives remain insufficiently integrated within the Australian HE cybersecurity curriculum [Australian Public Service Commission 2024; eSafety Commissioner 2019]. This observation aligns with prior research by Vykopal et. al., (2025), which demonstrates that many Cyber Security programs globally—despite their labeling—fail to incorporate essential interdisciplinary and non-technical dimensions, highlighting a broader systemic gap between curricular design and contemporary competency expectations [Vykopal et al. 2025]. Although our participants pointed out some ad-hoc ways to integrate intersectional perspectives into the Australian HE cybersecurity curriculum, there is a lack of systematic ways to embed women, gender-diverse, and CALD perspectives in the Australian HE cybersecurity curriculum [Anwar et al. 2017; Leyton Zamora et al. 2021; Namukasa et al. 2023; Peacock and Irons 2017; Sheanoda et al. 2024]. Existing practices are often driven by individual staff interests or one-off projects, rather than embedded through coordinated program design, assessment, or accreditation requirements [Abeysooriya et al. 2023; Mountrouidou et al. 2019]. As a result, diversity topics are often treated as add-ons and inconsistently implemented, limiting its impact on student learning and on the broader culture of cybersecurity education. The analysis of barriers to incorporating diverse perspectives in cybersecurity curricula uncovers deeply rooted issues that go beyond mere knowledge gaps and recruitment challenges [Mountrouidou et al. 2019; Parrish et al. 2018]. Participants highlighted structural constraints such as crowded curricula, rigid accreditation standards, limited time and resources for curriculum an course revamping, and a shortage of accessible, context-specific teaching materials. These challenges are also intensified by cultural and other organisational issues [Australian Public Service Commission 2024; eSafety Commissioner 2019; Griffin and Johnson 2024b; Henry and Flynn 2018], such as common views of cybersecurity as a highly technical, male-dominated field, some educators’ lack of confidence in teaching intersectional topics, and limited institutional motivation to make inclusivity a priority. Together, these factors create a cycle in which diverse perspectives are viewed as desirable but non-essential, and therefore remain marginal. Finally, our findings on future work and support needed underscore a critical transition from ad-hoc initiatives to a more strategic, integrated, and empirically driven approach [Australian Public Service Commission 2024; eSafety Manuscript submitted to ACM

Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums — Strategies, Barriers, and Future Directions 21 Commissioner 2019; Griffin and Johnson 2024a]. Participants called for contextual frameworks and guidelines that explicitly articulate how diversity and inclusion can be embedded across core cybersecurity units, alongside repositories of shared teaching resources and case studies that centre women, gender-diverse, and CALD experiences [Vykopal et al. 2025]. They also emphasised the importance of targeted professional development, dedicated funding, and recognition for staff who lead inclusive curriculum innovation. Sustained collaboration between universities, industry, and community partners will be essential to co-design and evaluate interventions that are scalable and sustainable and also responsive to the lived experiences of marginalised groups in cybersecurity. 6.2

Implications for practice

In this section we discuss the implications of our study findings to universities, educators, industry and researchers. 6.2.1

Implications for universities. • Curriculum approval and review Course and programme approval templates could explicitly require evidence of how intersectional perspectives are embedded in learning outcomes, content and assessment [Accenture et al. 2026; Australian Competition and Consumer Commission 2024; Australian Curriculum, Assessment and Reporting Authority 2019; eSafety Commissioner 2019; Griffin and Johnson 2024b; Straight 2024a; Vykopal et al. 2025]. This moves inclusion from being an optional add-on which educators often neglect to a core quality criterion. For example, course learning outcomes could require students to critically analyse how cybersecurity threats, policies, and technologies impact different communities, rather than assuming a universal user [Accenture et al. 2026; Vykopal et al. 2025]. Review panels could be asked to comment specifically on whether units demonstrate diverse case studies, and assess students on their ability to recognise and address bias in cybersecurity systems [Vykopal et al. 2025]. • Workload and promotion recognition Universities should formally recognise inclusive curriculum development as academic work, rather than treating it as voluntary work. Our findings indicate that allocating time in the workload for the design, piloting and evaluation of intersectional teaching materials and recognising such contributions in promotion, performance review and teaching awards may motivate academics to initiate and enagage in such activities. Without this recognition, inclusive curriculum work will continue to depend on a small number of committed individuals which risks burnout and reinforces existing inequities. • Resourced interdisciplinary teams Our findings suggest that meaningful inclusion of women, gender-diverse and CALD perspectives cannot be achieved by cybersecurity academics working in isolation. Universities should invest in interdisciplinary teams that bring together expertise from cybersecurity, education, gender studies, sociology, and cultural studies to co-design curricula and assessment. Providing funding for such collaborations, along with administrative and learning design support, would enable the development of richer, contextually grounded materials that address both technical and socio-cultural dimensions of cybersecurity. • Engagement with accreditation bodies Accreditation and professional bodies have a crucial role in shaping the core cybersecurity knowledge and skills [Australian Signals Directorate 2020; Griffin and Johnson 2024b; Straight 2024a]. Universities and policy-makers should actively engage these bodies to advocate for standards that explicitly recognise diversity, equity and inclusion competencies as integral to professional practice. Such alignment would ease the perceived conflict between satisfying accreditation requirements and embedding inclusive content, and would clearly signal to providers that intersectional perspectives are fundamental to producing industry-ready graduates and not something optional. Manuscript submitted to ACM

Nalin A. G. Arachchilage, Asangi Jayatilaka, Senuri Wijenayake, David Herbert, Kaie Maennel, Nicole Herbert, Claudia 22 Szabo, Gabrielle Murray, and Gary Thomas 6.2.2

Implications for educators. • Integrate intersectionality into all aspects of teaching and learning Rather than treating diversity as a stand-alone topic, educators can embed intersectional analysis into existing course content, assignments and exercises. This might involve asking students to consider how threat models, authentication mechanisms, or security policies affect users differently based on gender, culture, language, disability, or migration status. For example, students could be required to critique a security protocol from the perspective of a multilingual user, or redesign an access control system to better accommodate persona of a gender-diverse staff. Embedding these questions within core technical tasks helps students see intersectional thinking as an integral part of rigorous cybersecurity practice, rather than an optional ethical add-on [Vykopal et al. 2025]. • Co-create content with industry and communities Educators could seek opportunities to co-develop teaching materials with industry partners, community organisations, and advocacy groups that work with under-represented populations [Accenture et al. 2026; Vykopal et al. 2025]. This co-creation also helps keep examples relevant to current threats and real workplace situations, while reducing the risk of using stereotypical representations of diversity. • Targeted professional learning Many of the participants reported limited confidence in teaching intersectional content. Universities and professional bodies should therefore offer targeted professional learning opportunities—such as workshops and mentoring—that focus on inclusive pedagogies for cybersecurity [Accenture et al. 2026; Australian Signals Directorate 2020; Griffin and Johnson 2024b; Vykopal et al. 2025]. These should provide practical strategies for educators embded intersectional perspectives to their own courses. Ongoing professional learning, rather than one-off sessions, will be critical for sustaining change in teaching practice.

6.2.3

Implications for industry audience. • Develop research-informed training and awareness program for their future employees Industry partners can utilise research findings to design training and awareness programmes that equip graduates to recognise, critically examine and address diversity and inclusion issues in cybersecurity practices within their workplaces [Accenture et al. 2026; Australian Signals Directorate 2020; Griffin and Johnson 2024b; Vykopal et al. 2025]. This content should be embedded in the onboarding process and ongoing professional development, so that inclusive cybersecurity practices are reinforced throughout employees’ careers and contribute to lasting shifts in workplace culture. • Develop research-informed apprentices program Apprenticeship and early-career pathways can be deliberately structured to support diverse entrants to cybersecurity [Accenture et al. 2026; Australian Signals Directorate 2020; Griffin and Johnson 2024b; Vykopal et al. 2025]. Industry can work with researchers and educators to identify barriers faced by women, gender-diverse and CALD candidates, and to design supports such as mentoring and targetted learning.

6.3

Implications for research • Including student and community perspectives Future research should more systematically centre the perspectives of students and community stakeholders [Australian Competition and Consumer Commission 2024; Griffin and Johnson 2024b; Vykopal et al. 2025]. This includes investigating the cybersecurity experiences, barriers and learning needs of marginalised groups; how they engage with and experience cybersecurity curricula and learning environments; what motivates or discourages them from persisting in the field. We also anticipate

Manuscript submitted to ACM

Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums — Strategies, Barriers, and Future Directions 23 a stronger emphasis on co-design, where students and community partners work alongside educators and researchers to shape pedagogical approaches and curriculum content. • Contextualised frameworks and toolkits Our findings provide evidence that there is a need to develop and test frameworks and practical toolkits that help educators integrate intersectional perspectives into cybersecurity in ways that are sensitive to local context [Vykopal et al. 2025]. This might involve adapting existing international models of inclusive STEM education to the specific cultural and institutional context of Australian higher education, and developing practical resources such as curriculum-mapping templates, sample rubrics, and checklists to support inclusive cirriculam and course design. • Evaluating intersectional pedagogical interventions Finally, empirical evaluation of intersectional pedagogical interventions in cybersecurity is needed [Griffin and Johnson 2024b; Vykopal et al. 2025]. For example, future studies could investigate the impact of different teaching strategies (e.g. scenario-based learning, community-engaged projects, reflective journals) on student learning outcomes, attitudes towards diversity. Longitudinal research can track whether exposure to intersectional curricula influences graduates’ professional practices and their contributions to workplace culture and policy. Such evidence will be critical for refining interventions, justifying institutional investment, and influencing accreditation and policy settings. In summary, this study shows that intersectional perspectives are still marginal within Australian higher education cybersecurity curricula, despite growing recognition of their importance. Systemic constraints—spanning curriculum structures, accreditation requirements, institutional cultures, and limited staff support—mean that diversity and inclusion are often treated as optional rather than integral to professional competence. Addressing these challenges will require coordinated action by universities, educators, industry and researchers to embed intersectionality into curriculum design, accreditation standards, professional learning and workplace practices [Griffin and Johnson 2024b; Vykopal et al. 2025]. Doing so is essential not only for equity, but for building a more resilient, innovative and socially responsive cybersecurity workforce for Australia. Acknowledgments We sincerely thank all the participants who generously shared their time and experiences during the interviews with us. The work has been supported by the [removed for anonymity]. The authors would also like to acknowledge the use of AI tools like Grammarly, Microsoft CoPilot, and ChatGPT to assist with proofreading and improve the clarity of some authors’ own text in the manuscript. References Jemal Abawajy. 2014. User preference of cyber security awareness delivery methods. Behaviour & information technology 33, 3 (2014), 237–248. Sasenka Abeysooriya, Saeed Akhlaghpour, Ivano Bongiovanni, Dallas Dowsett, Joseph Grotowski, Mike Holm, Dan Kim, Ryan Ko, Andelka M Phillips, Sergeja Slapnicar, et al. 2023. Discussion Paper: 2023-2030 Australian Cyber Security Strategy. (2023). Accenture, Harpreet Sidhu, Vikram Desai, Christian Weiss, Mariana Perez, and Yusof Seedat. 2026. Reinventing the Cyber Workforce: Three Moves to Address the Cybersecurity Talent Gap. Research Report. Accenture. https://www.accenture.com/content/dam/accenture/final/accenture-com/documentfy26/q3/Reinventing-the-Cyber-Workforce-Accenture.pdf Accessed: 2026-06-20. Norah Saud Al-Musib, Faeiz Mohammad Al-Serhani, Mamoona Humayun, and NZ Jhanjhi. 2023. Business email compromise (BEC) attacks. Materials Today: Proceedings 81 (2023), 497–503. Mohd Anwar, Wu He, Ivan Ash, Xiaohong Yuan, Ling Li, and Li Xu. 2017. Gender difference and employees’ cybersecurity behaviors. Computers in Human Behavior 69 (2017), 437–443. Nalin Asanka Gamagedara Arachchilage and Steve Love. 2014. Security awareness of computer users: A phishing threat avoidance perspective. Computers in human behavior 38 (2014), 304–312. Manuscript submitted to ACM

Nalin A. G. Arachchilage, Asangi Jayatilaka, Senuri Wijenayake, David Herbert, Kaie Maennel, Nicole Herbert, Claudia 24 Szabo, Gabrielle Murray, and Gary Thomas Australian Bureau of Statistics. 2025. Australia’s Population by Country of Birth. https://www.abs.gov.au/statistics/people/population/australiaspopulation-country-birth/jun-2025 Australian Competition and Consumer Commission. 2024. Scamwatch Annual Report. https://www.scamwatch.gov.au Australian Curriculum, Assessment and Reporting Authority. 2019. Australian Curriculum: Digital Technologies (F–10). https://v8.australiancurriculum. edu.au/f-10-curriculum/technologies/digital-technologies/ Emphasises computational thinking, problem solving, and practical digital skills. Australian Public Service Commission. 2024. APS culturally and linguistically diverse employment strategy and action plan. https://www.apsc.gov. au/sites/default/files/2024-04/APS%20Culturally%20and%20Linguistically%20Diverse%20Employment%20Strategy%20and%20Action%20Plan%20%20Accessible_1.pdf Australian Signals Directorate. 2020. ASD Cyber Skills Framework. Technical Report. Australian Signals Directorate. https://www.cyber.gov.au/businessgovernment/protecting-business-leaders/cyber-security-for-business-leaders/cyber-skills-framework Aligned with the Skills Framework for the Information Age (SFIA) to define cyber security roles, skills, and proficiency levels for education and workforce development. Sebastien Kanj Bonhard, Pau Garcia Villalta, Oriol Roses, and Josep Pegueroles. 2025. A review of tactics, techniques, and procedures (TTPs) of MITRE framework for business email compromise (BEC) attacks. IEEE access 13 (2025), 50761–50776. Virginia Braun and Victoria Clarke. 2006. Using thematic analysis in psychology. Qualitative research in psychology 3, 2 (2006), 77–101. Kapor Center. 2021. Culturally responsive-sustaining computer science education: A framework. online document (2021). National Anti-Scam Centre. 2023. National Anti-Scam Centre in action: Quarterly update. Technical Report. Sadie Creese, William H Dutton, and Patricia Esteve-González. 2021. The social and cultural shaping of cybersecurity capacity building: a comparative study of nations and regions. Personal and ubiquitous computing 25, 5 (2021), 941–955. Kimberlé Crenshaw. 1989. Demarginalizing the Intersection of Race and Sex: A Black Feminist Critique of Antidiscrimination Doctrine, Feminist Theory and Antiracist Politics. University of Chicago Legal Forum 1989, 1 (1989), 139–167. https://chicagounbound.uchicago.edu/uclf/vol1989/iss1/8/ Cassandra Cross and Murray Lee. 2022. Exploring fear of crime for those targeted by romance fraud. victims & offenders 17, 5 (2022), 735–755. Hans De Wit. 2018. The Bologna process and the wider world of higher education: The cooperation competition paradox in a period of increased nationalism. In European higher education area: The impact of past and future policies. Springer, 15–22. Department of Employment and Workplace Relations. 2025. Australian Digital Capability Framework. Technical Report. Australian Government. https://www.dewr.gov.au/skills-reform/resources/australian-digital-capability-framework Adapted from the European Commission’s DigComp framework; nationally adopted from 2025. Giuseppe Desolda, Lauren S Ferro, Andrea Marrella, Tiziana Catarci, and Maria Francesca Costabile. 2021. Human factors in phishing attacks: a systematic literature review. ACM Computing Surveys (CSUR) 54, 8 (2021), 1–35. eSafety Commissioner. 2019. Women from Diverse Backgrounds: Experiences of Technology-Facilitated Abuse. https://www.esafety.gov.au/research/ women-from-diverse-backgrounds Harriet Farlow and Julie Banfield. 2023. The Case for Including AI Security in the 2030 Cyber Security Strategy Submission to the 2023-2030 Australian Cyber Security Strategy Discussion Paper. (2023). Petter Gottschalk. [n. d.]. Policing White-Collar Crime. ([n. d.]). Anna Griffin and Nicola Johnson. 2024a. Cybersecurity in australian higher education curricula. 73–89. doi:10.1201/9781032664859-4 Anna J Griffin and Nicola F Johnson. [n. d.]. Cybersecurity in australian higher education curricula: The SFIA framework. In Psybersecurity. CRC Press, 73–89. Anna J. Griffin and Nicola F. Johnson. 2024b. Cybersecurity in Australian Higher Education Curricula: The SFIA Framework. In Psybersecurity: Human Factors of Cyber Defence. CRC Press, 73–89. doi:10.1201/9781032664859-4 Bradley Hayes. 2026. From Principle to Practice: A Culturally Responsive Toolkit for the Busy CS Teacher. ACM Inroads 16, 4 (2026), 42–48. Nicola Henry and Asher Flynn. 2018. Technology-Facilitated Abuse among Culturally and Linguistically Diverse Women: A Qualitative Study. https: //research.monash.edu/en/publications/technology-facilitated-abuse-among-culturally-and-linguisticallyGloria Ladson-Billings. 1995. Toward a theory of culturally relevant pedagogy. American educational research journal 32, 3 (1995), 465–491. Carolina Leyton Zamora, Jennifer Boddy, Patrick O’Leary, and Jianqiang Liang. 2021. Culturally and linguistically diverse (CALD) women’s experiences of technology-facilitated violence: An intersectional approach. The Palgrave handbook of gendered violence and technology (2021), 115–134. Kirsti Malterud. 2016. Theory and interpretation in qualitative studies from general practice: why and how? Scandinavian journal of public health 44, 2 (2016), 120–129. Vamsi Srinivas Kiran Mitta and Marc J. Dupuis. 2024. Unequal Risks: Ethnicity, Region, and Cybersecurity Outcomes in the United States. Journal of Cybersecurity Education, Research and Practice (2024). https://cisse.info/journal/index.php/cisse/article/view/245 Xenia Mountrouidou, David Vosen, Chadi Kari, Mohammad Q Azhar, Sajal Bhatia, Greg Gagne, Joseph Maguire, Liviana Tudor, and Timothy T Yuen. 2019. Securing the human: a review of literature on broadening diversity in cybersecurity education. Proceedings of the Working Group Reports on Innovation and Technology in Computer Science Education (2019), 157–176. Maureen Namukasa, Cherrise Ficke, Isabella Piasecki, et al. 2023. Understanding how to diversify the cybersecurity workforce: A qualitative analysis. Journal of Cybersecurity Education, Research and Practice 2023, 2 (2023), 4. William Newhouse, Stephanie Keith, Benjamin Scribner, and Greg Witte. 2017. National initiative for cybersecurity education (NICE) cybersecurity workforce framework. NIST special publication 800, 2017 (2017), 181. Manuscript submitted to ACM

Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums — Strategies, Barriers, and Future Directions 25 Maria Veronica Oropeza, Manka M Varghese, and Yasuko Kanno. 2010. Linguistic minority students in higher education: Using, resisting, and negotiating multiple labels. Equity & Excellence in Education 43, 2 (2010), 216–231. Allen Parrish, John Impagliazzo, Rajendra K Raj, Henrique Santos, Muhammad Rizwan Asghar, Audun Jøsang, Teresa Pereira, and Eliana Stavrou. 2018. Global perspectives on cybersecurity education for 2030: a case for a meta-discipline. In Proceedings companion of the 23rd annual ACM conference on innovation and technology in computer science education. 36–54. Donna Peacock and Alastair Irons. 2017. Gender inequality in cybersecurity: Exploring the gender gap in opportunities and progression. International Journal of Gender, Science and Technology 9, 1 (2017), 25–44. Veronica Sheanoda, Kay Bussey, and Tiffany Jones. 2024. Sexuality, gender and culturally diverse interpretations of cyberbullying. new media & society 26, 1 (2024), 154–171. Ryan Straight. 2024a. Beyond Human-Centric Models in Cybersecurity Education: A Pilot Posthuman Analysis of the NICE Workforce Framework for Cybersecurity. Journal of Cybersecurity Education, Research and Practice 2024, 1 (2024), 30. Ryan Straight. 2024b. Decentering the Human: A Posthuman Approach to Cybersecurity Education. In 2024 Cyber Awareness and Research Symposium (CARS). IEEE, 1–6. Cate Thomas, Colleen MacMillan, Merryn McKinnon, Hayley Torabi, Megan Osmond-McLeod, Ellen Swavley, Tamzen Armer, and Kimberley Doyle. 2021b. Seeing and overcoming the complexities of intersectionality. Challenges 12, 1 (2021), 5. Julian Thomas, Jo Barraket, Sharon Parkinson, Chris Wilson, Indigo Holcombe-James, Jenny Kennedy, Kate Mannell, and Abigail Brydon. 2021a. Australian digital inclusion index: 2021. RMIT, Swinburne University of Technology, and Telstra: Melbourne, Australia (2021). Richard R Valencia. 2012. The evolution of deficit thinking: Educational thought and practice. Routledge. Jan Vykopal, Valdemar Švábenskỳ, Michael Tuscano Lopez, and Pavel Čeleda. 2025. Cybersecurity Study Programs: What’s in a Name?. In Proceedings of the 56th ACM Technical Symposium on Computer Science Education V. 1. 1169–1175. Michael Workman. 2008. Wisecrackers: A theory-grounded investigation of phishing and pretext social engineering threats to information security. Journal of the American society for information science and technology 59, 4 (2008), 662–674. Sijie Zhuo, Robert Biddle, Yun Sing Koh, Danielle Lottridge, and Giovanni Russello. 2023. SoK: Human-centered phishing susceptibility. ACM Transactions on Privacy and Security 26, 3 (2023), 1–27.

Manuscript submitted to ACM

Related documents

• A Study into the Cybersecurity Awareness Initiatives for School Learners in South Africa and the UK#671967
• Cybersecurity Awareness Level: The Case of Saudi Arabia University Students#672021
• An assessment of cybersecurity awareness level among Northeastern University students in Nigeria#672069
• The influence of social education level on cybersecurity awareness and behaviour: a comparative study of university students and working graduates#671789
• Cybersecurity Education in the Age of AI: Integrating AI Learning into Cybersecurity High School Curricula#419025