Students use university accounts, email, cloud services and personal devices in almost every part of their academic and private lives, which exposes them to phishing, password misuse and insecure online behaviour. Technical safeguards alone are not sufficient if users do not recognise a threat. At the same time, cybersecurity topics are not equally present in every curriculum. Using FHNW as a case study, the research aimed to assess overall cybersecurity awareness among students, compare technology-related and non-technology-related students, and derive recommendations.

The study combines a review of the literature on cybersecurity awareness among university students with a quantitative online survey. The questionnaire was based on the Knowledge-Attitude-Behaviour model and measured four separate areas: knowledge, attitudes, self-reported behaviour and scenario-based decision-making in four realistic situations. It was conducted in German and English among students of all FHNW schools. The evaluation was based on 550 responses and carried out using descriptive statistics, Welch t-tests and Cohen's d.

The results show that basic cybersecurity knowledge among FHNW students is high: 94.8 percent of all knowledge questions were answered correctly, attitudes were positive and self-reported behaviour was largely secure. Practical decision-making proved considerably weaker. On average, students selected the safest response in only 2.9 of 4 scenarios, and the greatest uncertainty concerned a data breach with a reused password. Students in technology-related study programs achieved significantly higher scores in all four areas, most clearly in scenario-based decision-making. The differences were small to medium and the two groups overlapped considerably, which indicates that a study program does not reliably predict an individual student's awareness. For FHNW, this presents an opportunity to develop measures that address application rather than information: short, practical basic training for all students at the start of their studies, built around realistic scenarios with immediate feedback, regular reminders, phishing simulations and visible reporting channels. Cybersecurity would thus be established as a general digital competence across all study programs.