It End-user Training Framework for Mitigating Human-related Internal Cybersecurity Risks: a Case Study of Uganda Coffee Ltd

This study examined how IT end-user training affects human-related cybersecurity risk at Uganda Coffee LTD, prompted by a 2021 ransomware attack that entered through a spear-phishing email despite existing firewalls, IDS, and antivirus controls. Using a mixed-methods design, employee questionnaires (n=108), key informant interviews (n=5), and five years of phishing simulation data (1,400 records, 2021–2025), the research found that untrained employees phished at 22.1% versus 7.3% for trained employees, with 91.7% of untrained staff falling into the High Risk category compared to none of the trained staff (χ²(4)=99.063, p<0.001, Cramér's V=0.677). and all five key informants linked past security incidents, including the 2021 breach, to training gaps, Based on these findings, the study proposes a five-phase, mandatory, quarterly, role-differentiated training framework, projected to cut the overall phish rate from 11.0% to within the 4–8% industry benchmark and eliminate High Risk classifications among trained staff within 24 months, contributing original empirical evidence on human-factor cybersecurity risk from an East African agri-commodity setting.