The widespread adoption of MFSs in Kenya has transformed financial transactions but has also introduced significant cybersecurity risks (Musyoka & Mose 2024; Ngugi, Mwangi & Kamau 2020). While existing frameworks, such as the NIST CSF and the MediaPro Adaptive Awareness Framework, offer structured approaches to cybersecurity, they were primarily developed in contexts with higher digital literacy and more robust security infrastructures (Kshetri 2019). These frameworks do not fully account for the socio-economic, technological and behavioural factors that shape cybersecurity awareness among MFS users in Kenya. Given the increasing sophistication of cyber threats and the reliance on mobile transactions in Kenya, there is a critical need for an integrated model that aligns with local realities. This study, therefore, seeks to bridge this gap by developing the AGAM, a context-specific framework that enhances cybersecurity awareness and user behaviour in mobile financial ecosystems. Unlike a direct application of these frameworks, AGAM synthesises structured security controls with adaptive learning, ensuring that cybersecurity awareness is both regulatory-aligned and behaviourally reinforced.

Kenya, with its widespread adoption of mobile money platforms such as M-PESA, exemplifies both the opportunities and challenges of MFSs in developing economies. While MFSs have enhanced financial inclusion, it has also introduced significant cybersecurity vulnerabilities because of diverse user demographics, varying levels of digital literacy and evolving cyber threats (Musyoka & Mose 2024). This study seeks to develop a cybersecurity awareness model that aligns with these contextual realities, offering insights applicable to Kenya and other developing economies where MFSs play a crucial role.

To achieve this, the study introduces the AGAM, an integrated cybersecurity awareness framework specifically designed for MFS users in Kenya. Adaptive governance awareness model is formulated by synthesising two well-established frameworks: The NIST CSF, which provides a structured approach to cybersecurity risk management (NIST 2018), and the MediaPro Adaptive Awareness Framework, which emphasises continuous learning and reinforcement to strengthen user security behaviour (MediaPro 2019). The integration of these frameworks is guided by the need to balance structured governance with user-centric learning strategies, ensuring that cybersecurity awareness aligns with the socio-technical landscape in Kenya. This is essential as cybersecurity challenges in MFSs are significantly influenced by user behaviour, awareness levels and evolving threat vectors such as phishing and social engineering (Wainaina, Kiyeng & Masese 2023; Wakoli 2024). Furthermore, empirical studies demonstrate that cybersecurity awareness and digital literacy play a critical role in shaping secure user behaviour and the adoption of digital financial services (Al Doghan & Mirzaliev 2024). By integrating these frameworks, AGAM is expected not only to enhance user security knowledge but also to cultivate proactive security habits among MFS users.

The study theorises that the structured security controls from the NIST framework, when complemented by the adaptive and behaviour-focused principles of the MediaPro framework, will create a comprehensive approach to improving cybersecurity awareness among MFS users. By contextualising these models within the Kenyan and broader African experience, the study aims to assess how various cybersecurity awareness components influence user behaviour and resilience against threats. Therefore, the research seeks to answer the following question: How can the components of the NIST CSF and the MediaPro Adaptive Awareness Framework be integrated to enhance cybersecurity awareness among users of MFSs in Kenya?

Mobile financial services refer to financial transactions conducted through mobile devices, enabling users to store, transfer and manage money electronically, particularly in regions with limited access to traditional banking infrastructure (Mater et al. 2021; Van Zanden 2023). Common MFS transactions include person-to-person money transfers, bill payments, savings and mobile banking services such as account management and international remittances (Ndung’u & Oguso 2021). By lowering transaction costs and reducing geographical barriers, MFSs have played a significant role in extending financial services to unbanked and underbanked populations in developing economies (Mwangi & Kasamani 2017).

An MFS ecosystem typically comprises mobile network operators, financial institutions, agents, merchants and regulatory authorities, whose interactions enable the delivery and sustainability of mobile-based financial services (Tobin 2011). Platforms such as M-PESA in Kenya and MTN Mobile Money in Uganda illustrate how telecommunications and financial infrastructures are integrated to support domestic and cross-border transactions (Van Zanden 2023). While initially designed for basic money transfers, MFS platforms have evolved to include microloans, insurance products and merchant payments, further deepening financial inclusion and economic participation (Ahirrao & Jethani 2014).

Cybersecurity awareness refers to users’ understanding of cyber risks and their ability to recognise, avoid and respond to security threats when interacting with digital systems. In developing economies, limited digital literacy and uneven access to cybersecurity education increase users’ susceptibility to fraud, particularly within MFS environments (Iyelolu et al. 2024; Vitus 2023). Recent evidence indicates high exposure to digital fraud among Mobile financial services users in Kenya, highlighting the urgent need for awareness initiatives tailored to diverse literacy levels and socio-economic conditions (TransUnion Africa 2025).

Effective cybersecurity awareness programmes must therefore be adaptive, inclusive and responsive to evolving threat landscapes. Prior studies emphasise the importance of multifaceted awareness strategies that combine training, communication and behavioural reinforcement to address heterogeneous user capabilities (Brecht 2019; Nagyfejeo & Von Solms 2020). Well-designed awareness initiatives enhance users’ capacity to recognise cyber threats, adopt secure behaviours and reduce systemic exposure to cybercrime within financial ecosystems (Naik & Sneha 2023; NIST 2021; Odo 2024; Popoola et al. 2024).

The NIST CSF provides a structured approach to managing cybersecurity risks through a set of core functions – Identify, Protect, Detect, Respond and Recover – designed to guide organisations in developing and implementing effective security practices (NIST 2018). The introduction of the Govern function further underscores the importance of cybersecurity governance, emphasising alignment between organisational objectives, risk management and awareness initiatives (NIST 2023). While widely adopted, the framework is primarily organisational in focus and offers limited guidance on individual user awareness in low-resource MFS contexts.

The MediaPro Adaptive Awareness Framework adopts a user-centric approach to cybersecurity awareness through four core components: Analyse, Plan, Train and Reinforce (MediaPro 2018). The framework emphasises continuous assessment of user awareness levels, strategic planning of awareness initiatives, engaging training methods and ongoing reinforcement of secure behaviours (8Pillars 2018). Its adaptive design allows awareness content to be personalised based on user behaviour and risk profiles, making it particularly suitable for dynamic environments such as MFSs. However, the framework lacks explicit governance and regulatory integration, limiting its effectiveness when applied independently in regulated financial ecosystems.

This study is underpinned by an integrated conceptual framework that combines risk-based cybersecurity governance theory with adaptive cybersecurity awareness and behavioural learning theory to explain cybersecurity awareness within MFS environments. The framework is developed through the integration of constructs from the NIST CSF and the MediaPro Adaptive Awareness Framework, which together provide a socio-technical perspective on cybersecurity awareness.

The NIST CSF conceptualises cybersecurity as a structured, lifecycle-oriented process encompassing governance, risk identification, protection, detection, response and recovery (NIST 2023). The framework offers a strong theoretical foundation for understanding how cybersecurity is governed and operationalised through formal policies, risk management processes and technical controls. However, prior studies have observed that governance-centric frameworks such as NIST give limited attention to behavioural, cognitive and socio-cultural factors that influence how users perceive and respond to cybersecurity risks, particularly in developing economies (Popoola et al. 2024).

To address this limitation, the conceptual framework also draws on the MediaPro Adaptive Awareness Framework, which conceptualises cybersecurity awareness as an iterative process of analysis, training and reinforcement (MediaPro 2019). MediaPro is grounded in behavioural and educational theory and emphasises sustained learning, user engagement and reinforcement as mechanisms for influencing cybersecurity behaviour over time. The integration of NIST and MediaPro therefore enables the conceptualisation of cybersecurity awareness as a socio-technical system, in which governance structures, technical safeguards and user behaviour are mutually reinforcing.

The resulting AGAM has been contextualised for MFS environments in developing economies, where rapid digital financial inclusion has expanded the cyber threat landscape amid uneven digital literacy and limited institutional capacity (Iyelolu et al. 2024; Lamia 2024). In such contexts, cybersecurity awareness cannot be adequately explained through technical controls or training initiatives alone. Instead, it emerges from the interaction between governance mechanisms, risk perception, threat management practices and continuous capacity building.

Adaptive governance awareness model consolidates overlapping constructs from established cybersecurity governance and awareness frameworks into five information management-oriented dimensions: Governance Planning (GP), Risk Analysis (RA), Threat Management (TM), Incident Response and Recovery (IRR) and Capacity Building (CB). Governance Planning reflects strategic information governance through policy alignment, regulatory compliance and organisational oversight that shape cybersecurity decision-making processes (NIST 2018). Risk analysis is positioned as a forward-looking information management function that supports the systematic identification, evaluation and prioritisation of cybersecurity risks (Whitman & Mattord 2004), while TM represents the operational use of security information through continuous monitoring and the application of protective controls in response to identified risks, thereby maintaining a clear distinction between strategic planning and operational execution (Von Solms & Van Niekerk 2013). Incident response and recovery emphasises organisational resilience by integrating information flows for response coordination, service restoration and post-incident learning (ISO/IEC 2023). Capacity building frames cybersecurity awareness as an ongoing knowledge management and learning process that enhances adaptive user behaviour and institutional capability, which is particularly critical in MFS environments characterised by diverse user competencies (Dhillon & Backhouse 2000; Musyoka & Mose 2024).

The conceptual framework further posits that these constructs are interrelated rather than sequential. Governance planning shapes the deployment of TM and incident response mechanisms, while RA continuously informs governance adaptation and operational priorities. Capacity building functions as a cross-cutting enabler, influencing governance effectiveness, threat recognition and response capability. These relationships reflect established insights from cybersecurity governance and behavioural security literature, which emphasise the reciprocal interaction between policy, risk perception, technical controls and user behaviour (Dhillon & Backhouse 2000; NIST 2018).

By integrating governance and adaptive awareness perspectives, AGAM responds to calls for CSFs that are contextually grounded and behaviourally informed, particularly within developing economies (Al Doghan & Mirzaliev 2024; Kshetri 2019). The conceptual relationships among the constructs are illustrated in Figure 1, which presents AGAM as a holistic framework for understanding and strengthening cybersecurity awareness in MFSs.

Ethical approval for this study was obtained from the University of KwaZulu-Natal Humanities and Social Sciences Research Ethics Committee (No. HSS/1508/015D), as well as from the Communications Authority of Kenya (Ref. No. CCK/CTMA/Research/Vol 13/10/05), in line with both national and institutional ethical requirements. Authorisation was also obtained from the appropriate organisational gatekeeper representing MFSs users. All participants received a consent letter outlining the purpose of the research, its objectives and the procedures implemented to ensure confidentiality and anonymity. Respondents were assured that their identities would be protected and that their personal information would remain anonymous. Participation was entirely voluntary, and participants were informed of their right to withdraw from the study at any stage without any adverse consequences.

Reliability coefficients assess the consistency and dependability of a set of measurements or test scores, reflecting the degree to which the data is free from measurement errors and yields consistent results over time or under different conditions.

Confirmatory factor analysis was performed to assess how well the AGAM measurement model fits the observed data. The overall model fit statistics are summarised in Table 3.

Although the Chi-square minimum discrepancy divided by its degrees of freedom (CMIN/df) ratio exceeded commonly recommended thresholds, alternative and more robust indices indicated excellent model fit. The goodness of fit index (GFI = 0.983) and adjusted GFI (AGFI = 0.922) surpassed the recommended benchmark of 0.90, demonstrating strong absolute model fit. Incremental fit indices, including NFI (0.921), IFI (0.924), TLI (0.914) and CFI (0.923), also exceeded the 0.90 threshold, indicating that the proposed model substantially improves upon the null model.

Furthermore, error-based indices confirmed high model adequacy, with a root mean square residual (RMR) of 0.004 and a root mean square error of approximation (RMSEA) of 0.006, both well within acceptable limits. Taken together, these indicators provide strong evidence that the AGAM measurement model fits the observed data well and is appropriate for testing the hypothesised structural relationships.

After confirming that the measurement constructs achieved an acceptable level of model fit, the next step involved conducting a path analysis using PLS-SEM to examine the relationships within the proposed model. The results, illustrated in Figure 2, show the strength and significance of each path coefficient, with significant relationships marked by green arrows (p < 0.05).

The path analysis confirms that RA and CB play vital roles in cybersecurity management. Risk analysis enhances GP and TM, aligning with frameworks like NIST that highlight risk assessment as central to TM (Freund 2024; NIST 2018; Rahman et al. 2024). Conversely, CB positively affects TM but negatively impacts GP, suggesting targeted approaches are required to integrate capacity-building efforts into strategic governance (Savaş & Karataş 2022). These relationships support the literature emphasising adaptive cybersecurity strategies (ENISA 2020).

Table 4 summarises the outcomes of the hypothesis tests obtained through path analysis. The path coefficients indicate both the magnitude and direction of the relationships between the constructs, whereas the p-values show their level of statistical significance, with values less than 0.05 considered statistically significant.

The results of the hypothesis testing, derived from path analysis, are presented in Table 4 and highlight the relationships between the constructs in the AGAM. Significant relationships were found across all paths, with estimates ranging from 0.075 to 0.498, all yielding p-values of < 0.001, signifying strong evidence for the acceptance of the hypotheses. These significant relationships confirm the interconnections between the constructs of governance, risk management and incident recovery within the awareness model. The thresholds used for assessing these relationships – such as standardised regression weights (CR values), with critical ratios (CR) exceeding 1.96 (Kline 2023) and p-values lower than 0.05 – demonstrate the reliability and validity of the model constructs in predicting key cybersecurity outcomes (Hair et al. 2019). This solid empirical foundation supports the proposed model’s capability to effectively guide cybersecurity training and awareness strategies.

Figure 3 depicts the final representation of the AGAM.

This study’s strengths include the integration of technical (NIST) and behavioural (MediaPro) constructs, combined with robust survey data from 1159 MFS users across diverse demographics and rigorous validation through reliability (Cronbach’s alpha 0.711–0.802), convergent and discriminant validity and CFA. Path analysis further demonstrated the interdependence of governance, RA, CB and TM. Limitations include the cross-sectional design, which limits causal inference, geographic focus on Kenya affecting generalisability, and reliance on self-reported measures, potentially introducing bias. Results should be interpreted considering these constraints, and longitudinal studies are recommended to strengthen causal and external validity.

Based on the study’s findings, several recommendations emerge for future research, policy and practice. The significant effects of age and education on device protection and threat detection suggest that additional socio-economic variables – such as income, employment type and digital access – should be explored to understand their influence on cybersecurity awareness. Such insights would enable more targeted and inclusive interventions, ensuring that awareness programmes reach vulnerable users effectively. The observed lower confidence among older users highlights the need for age-specific training initiatives; future research should design and evaluate adaptive cybersecurity programmes that consider cognitive and behavioural differences, enhancing learning outcomes and threat response across age groups. Cultural factors also merit investigation, as societal norms, trust dynamics and local perceptions of security may shape behaviour; cross-cultural studies could refine AGAM’s adaptability and inform globally relevant awareness strategies. Moreover, validating AGAM in diverse geographic and regulatory contexts would strengthen its generalisability, enabling policymakers and MFS providers to implement evidence-based, context-sensitive interventions that integrate governance, risk assessment and capacity-building efforts.

By linking interventions to demographic, cultural and contextual variables, future studies can ensure that cybersecurity awareness programmes are both effective and equitable, fostering sustained behavioural change.

Collectively, these research avenues will support the development of AGAM as a comprehensive, globally applicable tool for improving cybersecurity awareness and resilience among MFS users, guiding policy, and informing best practices in diverse socio-economic and technological environments.