Middle School Girls’ Attitudes and Engagement in Generative AI Cybersecurity Summer Camp

Abstract

Informal science, technology, engineering, and mathematics (STEM) learning settings can provide early and accessible opportunities for students who have been historically underrepresented in computing to engage with cybersecurity concepts and emerging technologies. This one-group pretest-posttest mixed-methods study examined a week-long, GenAI-integrated informal cybersecurity summer camp for 33 underrepresented and underserved racial and ethnic minority (UUREM) middle school girls. The study investigated pre-post patterns in perceived cybersecurity knowledge, domain-specific self-efficacy, interest, utility value, career aspirations, and selected AI-literacy practices. Quantitative findings showed the strongest support for increases in perceived cybersecurity knowledge and cyber threat identification self-efficacy, both of which remained significant after Holm adjustment for multiple comparisons. Networking and web management self-efficacy showed preliminary unadjusted increases, whereas overall cybersecurity interest, enjoyment and intent to pursue, utility value, career aspirations, and the remaining self-efficacy domains did not show statistically significant differences. Qualitative observations documented activity-specific engagement, collaborative discussion of cybersecurity ideas, and mentor-mediated GenAI practices such as prompt development, output comparison, and script revision. These findings suggest that informal GenAI-integrated cybersecurity programs may support selected aspects of perceived learning and cybersecurity self-efficacy, while highlighting the need for more rigorous designs, validated AI-literacy measures, and longer-term follow-up.

1. Introduction

The rapidly evolving digital landscape has created an unprecedented demand for cybersecurity professionals, with workforce shortages projected to reach millions globally (Goupil et al., 2022; Li et al., 2025). Simultaneously, generative artificial intelligence (GenAI) has emerged as both a powerful tool for cybersecurity and a vector for new threats, fundamentally reshaping how we approach digital security education (European Commission & Organisation for Economic Co-operation and Development [OECD], 2025; National Artificial Intelligence Research Resource Task Force, 2023; U.S. Department of Education, Office of Educational Technology, 2023). However, existing standards and curricula insufficiently address cybersecurity education, and variability in instructor expertise, limited resources, and restricted student choice further constrain the scope and depth of cybersecurity instruction (Childers et al., 2022; Sağlam et al., 2023). Informal science, technology, engineering, and mathematics (STEM) education environments, such as camps, workshops, and community programs, have emerged as spaces for hands-on, authentic cybersecurity learning experiences that complement formal classroom instruction, while offering the flexibility to integrate emerging technologies like GenAI (Milton et al., 2023; Thomas et al., 2024; Z. Xu et al., 2025). For the context of our paper, we define informal learning as encompassing diverse settings beyond the traditional classroom, including afterschool programs, museums, libraries, community centers, and homes (Rogoff et al., 2016). These environments are not only defined by their physical spaces but also by the people involved (e.g., families, community mentors, educators), the practices engaged (e.g., project-based inquiry, culturally relevant pedagogy), and the purposes they serve (National Research Council, 2009). Compared with formal education, which is delivered through mandated curricula and standardized assessments within the school system, informal learning environments are voluntary, learner-centered, and organized around social interaction and experiential, hands-on engagement, even when, as in structured camps and workshops, they follow an intentional instructional plan (Jeong et al., 2018).

Despite the critical need for cybersecurity professionals, significant disparities persist in who has access to and engagement with cybersecurity education. Girls and other underrepresented and underserved racial and ethnic minority (UUREM) learners face systemic barriers that limit their participation in cybersecurity fields (Bailey et al., 2024; Egete et al., 2023). These barriers include limited exposure to cybersecurity concepts in traditional educational settings, a lack of role models and mentors, stereotypes about who belongs in cybersecurity, and insufficient access to hands-on learning opportunities that demonstrate the field’s creative and collaborative aspects (Bailey et al., 2024; Osman et al., 2023).

While GenAI tools offer potential to democratize access to sophisticated cybersecurity concepts (T. Wang et al., 2025), empirical evidence on how UUREM learners engage with GenAI-enhanced cybersecurity education remains limited (Alasadi & Baiz, 2023). This study addresses that gap by examining UUREM girls’ participation in a week-long residential cybersecurity camp integrating GenAI tools and approaches (Sager et al., 2026). The research question guiding this study was: What pretest-posttest differences and qualitative patterns were observed in UUREM girls’ perceived cybersecurity knowledge, domain-specific self-efficacy, interest, enjoyment and intent to pursue, utility value, career aspirations, and selected AI-literacy practices during a week-long residential cybersecurity summer camp?

2. Literature Review

2.1. Generative AI and AI Literacy

The rapid diffusion of GenAI has fundamentally altered how learners interact with digital technologies in educational contexts (Li et al., 2025). Unlike earlier forms of AI that primarily analyzed or classified existing data (Ng et al., 2021), GenAI systems are capable of producing novel, multimodal outputs (e.g., text, images) through interactive interfaces such as chatbots and image/video generators used by teachers to create videos (Stavrinou et al., 2025). Prior work on K-12 GenAI video production emphasizes the need for explicit AI literacy instruction and teacher scaffolding, as production pipelines often chain multiple tools across script generation, avatar creation, and video editing (Chen & Wu, 2024; Puntambekar & Hübscher, 2005; T. Xu et al., 2024).

Frameworks for AI literacy within K-12 education have increasingly emerged across the educational landscape. Among these, one of the most widely adopted is the AILit framework developed by the OECD (European Commission & Organisation for Economic Co-operation and Development [OECD], 2025), which defines AI literacy as “the technical knowledge, durable skills, and future-ready attitudes required to thrive in a world influenced by AI. It enables learners to engage, create with, manage, and design AI, while critically evaluating its benefits, risks, and ethical implications” (p. 6). Ng et al. (2021) also proposed a framework organizing AI literacy into interrelated dimensions, including understanding AI concepts, applying AI tools, critically evaluating and creating with AI, and engaging with ethical considerations. This progression from recognition to more active, critical engagement shapes how confidently learners interact with AI tools in GenAI-supported environments (Ng et al., 2021).

In the present study, we focus specifically on two of these four dimensions, applying AI tools and critically evaluating AI outputs, since these are the dimensions most directly observable through mentor-mediated project work. We operationalize applying AI tools as instances of girls prompting, revising prompts, or directing the AI toward a specific instructional goal, and critically evaluating AI outputs as instances of girls checking generated content against external sources, flagging errors or implausible claims, or revising AI-generated material before incorporating it into their final video. We do not code for understanding AI concepts or engaging with ethical considerations, as our observation protocol was not designed to capture conceptual knowledge or ethical reasoning directly.

These benefits are not without risk, as GenAI outputs can contain factual or technical inaccuracies that, if uncritically accepted, may misinform learners about real security practices (Stavrou & Piki, 2024). Repeated reliance on AI-generated explanations or solutions can also substitute for the mastery experiences that self-efficacy theory identifies as the strongest source of durable confidence (Bandura, 1977; Yan et al., 2025; Zhang & Xu, 2024), meaning a learner may feel more capable without having built the underlying skill. The use of GenAI tools with minors additionally raises privacy concerns, particularly around data retention and processing by third-party AI systems. Finally, when learners and AI tools co-produce work, attributing specific contributions to either party becomes difficult, which complicates any attempt to assess what a learner has actually learned versus what the tool has done for them. Importantly, these risks are not evenly distributed across learner populations. For girls specifically, lower AI literacy may increase vulnerability to misleading outputs, algorithmic bias, and overreliance on generative systems, potentially reinforcing existing inequities in STEM participation and achievement (Cheng et al., 2025).

2.2. Cybersecurity Education

Research increasingly recognizes that effective cybersecurity education extends beyond technical skill development through formal academic programs and industry certifications, emphasizing instead experiential, hands-on learning environments that mirror real-world challenges and foster both technical competencies and critical thinking (L. Wang et al., 2020). Access to cybersecurity learning opportunities remains uneven for UUREM learners, who often have limited early exposure to cybersecurity concepts, fewer opportunities to develop foundational knowledge, and lower participation in formal cybersecurity pathways (Botha-Badenhorst & Veerasamy, 2023; Osman et al., 2023). These disparities contribute to persistent gaps in cybersecurity knowledge and preparedness, highlighting the need for early, accessible, and supportive learning environments that can broaden participation among historically marginalized learners.

Within this context, informal STEM education environments have emerged as particularly promising venues for cybersecurity education due to their capacity for authentic, project-based learning experiences (Thomas et al., 2024). These settings enable the creation of collaborative experiences that mirror real-world cybersecurity risk challenges (Z. Xu et al., 2025). Triplett (2023) highlights the effectiveness of residential summer camps in cybersecurity education, demonstrating significant gains in participant knowledge, skills, and career interest.

The integration of GenAI into cybersecurity education represents a pedagogical shift, offering opportunities for personalized learning, scenario simulation, and collaborative problem-solving (Sager et al., forthcoming; Walkington et al., 2025). As detailed in the previous section, these affordances carry real risks around accuracy, overreliance, privacy, and attribution, which are especially consequential in informal settings serving UUREM girls, where GenAI tools may simultaneously lower barriers to engagement and introduce representational and epistemic harm.

In summary, prior research has established the promise of informal approaches for cybersecurity education, documented persistent inequities in access and participation for UUREM learners, and begun to explore the educational affordances and risks of GenAI. What remains limited is empirical work examining how GenAI-supported cybersecurity learning within informal settings shapes affective and psychological outcomes (i.e., interest, self-efficacy, and perceived knowledge) for UUREM girls.

3. Theoretical Frameworks

3.1. Interest, Self-Determination, and Expectancy-Value

Interest, conceptualized as a psychological state characterized by focused attention, increased cognitive functioning, and positive affect toward particular subject matter, plays a crucial role in sustained engagement and learning outcomes (Hidi & Renninger, 2006). The Four-Phase Model of Interest Development distinguishes immediate and in-the-moment situational interest and individual interest more stable, enduring preference that drives self-directed learning behaviors (Hidi & Renninger, 2006; Walkington & Bernacki, 2014). Interest development involves affective and cognitive processes, including positive affect, growing knowledge, and perceived value (Hidi & Renninger, 2006). Self-Determination Theory (SDT) complements this model by explaining the motivational mechanisms through which learning environments trigger and sustain situational interest, namely supporting learners’ autonomy, competence, and relatedness (Müller & Louw, 2004; Ryan & Deci, 2020). Autonomy refers to experiencing one’s actions as volitional rather than externally controlled (Müller & Louw, 2004; Ryan & Deci, 2020). Competence refers to feeling effective and capable of meeting challenges, and relatedness refers to feeling socially connected and valued by others within the learning environment (Müller & Louw, 2004; Ryan & Deci, 2020). Expectancy-Value Theory (EVT) adds a third lens, emphasizing learners’ beliefs about their likelihood of success (expectancy) and the perceived value of a task, including its intrinsic, utility, attainment value, and its cost (Eccles & Wigfield, 2002; Wigfield et al., 2017). These perspectives suggest that situational and individual interests are most likely to emerge when learning environments both satisfy learners’ psychological needs and strengthen their expectations for success while highlighting the relevance and utility of learning activities.

In technology-enhanced learning contexts, the mechanisms become particularly salient as instructional tools shape how learners experience agency and competence (Zhang & Zhang, 2025). Zhang and Zhang (2025) provide direct empirical support for this convergence, demonstrating that LLM-supported project-based learning enhanced engagement and learning outcomes specifically when AI use satisfied students’ psychological needs for autonomy, competence, and relatedness, suggesting that the motivational conditions identified by SDT and EVT are no less relevant in GenAI-enhanced learning environments.

For UUREM girls, the residential camp format provides conditions theoretically well-suited to triggering and sustaining situational interest as immersive experiences, peer collaboration, and exposure to personally relevant technologies (Bernacki & Walkington, 2018), while compounded barriers related to stereotypes, limited role models, and prior exclusion from cybersecurity pathways make understanding how interest develops in this context both theoretically and practically consequential (Chong, 2018; Emerick, 2020).

3.2. Self-Efficacy

Self-Efficacy refers to individuals’ beliefs about their ability to organize and carry out the actions needed to achieve specific goals (Bandura, 1977) and reliably predicts motivation, persistence, and academic achievement across a range of educational contexts (Bernacki et al., 2015). These beliefs shape how learners approach tasks, including the goals they set, the effort they invest, and how they respond when they encounter difficulty. Research indicates that self-efficacy develops primarily through four principal sources: mastery experiences, vicarious learning, social persuasion, and physiological states (Bandura, 1977). Of these, mastery experiences are the strongest source of self-efficacy beliefs, while vicarious experiences, such as observing peers succeed, are especially influential for learners with limited prior domain exposure (Bandura, 1977; Walkington et al., 2024).

Cybersecurity self-efficacy encompasses individuals’ beliefs about their capabilities to identify, analyze, and respond effectively to digital security threats and challenges (Hong & Furnell, 2021). These beliefs significantly predict both behavioral intentions and actual security behaviors (Johnston & Warkentin, 2010), though cybersecurity self-efficacy development faces unique challenges related to the field’s technical complexity, rapidly evolving threat landscape, and the abstract nature of many security concepts (Brilingaitė et al., 2020; Stavrou & Piki, 2024). Effective development of these beliefs requires carefully scaffolded experiences that prioritize mastery opportunities over knowledge transmission, gradually increasing challenge while providing meaningful feedback (Thomas et al., 2024). Collaborative learning environments and peer support are particularly consequential for learners who may lack access to relevant role models and mentorship (Triplett, 2023).

Together, these frameworks serve distinct but complementary roles in the present study. The Four-Phase Model of Interest Development frames the distinction between activity-specific situational engagement and more stable cybersecurity interest. Self-Determination Theory is used to interpret learning conditions that may support autonomy, competence, and relatedness during collaborative camp activities. Expectancy-Value Theory informs the interpretation of enjoyment, utility value, and career-related perceptions as motivational constructs connected to learners’ perceived value of cybersecurity. Self-efficacy theory provides the basis for examining domain-specific confidence in cybersecurity-related tasks. Finally, AI-literacy frameworks guide the qualitative interpretation of selected GenAI practices observed during mentor-mediated project work. These frameworks are used as interpretive lenses rather than as a tested causal model.

3.3. Research Purpose

Although prior research has highlighted the importance of mastery experiences, vicarious learning, and supportive social environments for self-efficacy development, how these mechanisms interact within GenAI-integrated informal cybersecurity contexts for UUREM girls remains underexamined. This study addresses the lack of empirical evidence on motivational, perceived-knowledge, self-efficacy, and selected AI-literacy outcomes in GenAI-enhanced informal cybersecurity education for UUREM girls. The purpose of this study was to examine pretest-posttest differences in UUREM girls’ perceived cybersecurity knowledge, domain-specific self-efficacy, interest, enjoyment and intent to pursue, utility value, and career aspirations, together with qualitative evidence of selected AI-literacy practices, in a week-long residential cybersecurity camp integrating GenAI tools. Given the exploratory mixed-methods design, no directional hypotheses were specified.

4. Methodology

The study used a convergent mixed-methods design, supplemented by a post hoc explanatory instructor interview (Creswell & Guetterman, 2019). Survey data, video recordings, screen recordings, and project artifacts constituted complementary strands documenting different aspects of the camp. Quantitative and qualitative evidence were analyzed separately before being compared by construct and evidence source during interpretation. The instructor interview added retrospective context about instructional decisions and perceived participant responses.

4.1. Context and Participants

Girls were recruited from coeducational and all-girls public, private, and public charter middle schools across a major metropolitan area. Recruitment also occurred through public libraries, predominantly Black churches, cultural centers, youth groups, other community venues serving underrepresented girls, and social-media outreach such as parent-focused Facebook groups. Eligibility was limited to girls entering Grades 7–9 who were enrolled in the summer camp. Thirty-three eligible participants completed the pretest; 30 completed the posttest and were matched to their pretest records. Three participants did not complete the posttest for reasons that were not systematically documented. The sample included 15 ninth graders, nine eighth graders, and nine seventh graders. Among the 30 participants with reported race and ethnicity data, 56.7% identified as African American/Black, 23.3% as Latina/Hispanic, 16.7% as multiracial, and 3.3% as White.

A core aspect of the camp was a four-day GenAI and cybersecurity curriculum designed by two subject-matter experts (SMEs). The cybersecurity curriculum included topics on the CIA (confidentiality, integrity, and availability) triad, password safety and multifactor authentication (MFA), and social engineering. The GenAI portion of this instructional block covered: introduction to the capstone project, fundamentals of prompt engineering, deep fake technology and detection, ethics and accessibility considerations in GenAI, and final project presentation and evaluation (see Tables S1 and S2 in the Supplementary Materials for a detailed overview of the curriculum). Given the limited duration of the camp, the implemented curriculum emphasized cybersecurity concepts and GenAI-supported project work rather than broader instruction in general problem-solving strategies or computer-use skills.

Participants worked in seven grade-level groups of four to six, with group assignments made by college-aged mentors (Table 1). Each group developed an AI-supported script, avatar, and cybersecurity informational video for one of two local nonprofit partners. At the time of data collection, the minimum age requirements for ChatGPT and HeyGen were 13 and 18, respectively (HeyGen, 2025b; OpenAI, 2024). Because not all participants met the requirements for independent account use, mentors operated the platforms using their own accounts. Participants collaboratively developed and revised prompts, which mentors entered verbatim. Outputs were shared through a Google Doc, where participants evaluated, selected, and revised the content. The available group records support the reported range of four to six participants per group but do not provide exact membership counts for each individual group.

Table 1. Each Group’s Topic and Selected Non-Profit.

Group Identifier	Topic of Final Project	Non-Profit
7.1	Password Protection	Together Forward
7.2	Password Protection	Together Forward
8.3	Social Engineering	Together Forward
8.4	Password Protection	El Mercado
9.5	Deep Fakes	Together Forward
9.6	Password Protection	El Mercado
9.7	Cyber Hygiene/Social Engineering	El Mercado

4.2. Data Collection

Quantitative data were collected through pre- and post-surveys administered immediately before and after the camp. The survey consisted of 60 Likert-scale items and one short-answer item. The items assessed perceived cybersecurity knowledge, cybersecurity self-efficacy across several subdomains, cybersecurity interest, enjoyment and intent to pursue, utility value, and career aspirations. Multi-item measures were adapted from the Cybersecurity Engagement and Self-Efficacy Scale, Version 2.0, and the Cyber Knowledge and Interest Scale (Asif et al., 2025; McGill, 2021). Standardized Cronbach’s alpha was calculated for each multi-item construct (see Table 2; Cronbach, 1951). Perceived cybersecurity knowledge and cybersecurity career aspirations were assessed with separate researcher-created single items reviewed by subject-matter experts for content alignment with the curriculum; internal consistency reliability cannot be estimated for single-item measures.

Table 2. Scale Characteristics and Internal Consistency.

Construct Measured (Citation)	Number of Items	Example Items	Cronbach’s Alpha of Scale
Problem-Solving Self-Efficacy (McGill, 2021)	4	I am good at problem-solving.	Pre: 0.76 Post: 0.90
Computers Self-Efficacy (McGill, 2021)	3	If I encounter a problem with computer software, I am confident that I would be able to fix it.	Pre: 0.75 Post: 0.75
Cybersecurity Enjoyment and Intent to Pursue (McGill, 2021)	7	I am happy working on cybersecurity tasks and problems.	Pre: 0.96 Post: 0.97
Systems Administration Self-efficacy (McGill, 2021)	7	I am confident I can make changes to a user’s account (e.g., password, permission).	Pre: 0.85 Post: 0.85
Networking Self-efficacy (McGill, 2021)	4	I am confident I can make changes to firewall rules.	Pre: 0.86 Post: 0.77
Web Management Self-efficacy (McGill, 2021)	5	I am confident I can identify a secure URL.	Pre: 0.91 Post: 0.90
Cyber Threat Identification Self-efficacy (McGill, 2021)	3	I am confident I can recognize tricks that cybercriminals use to steal information	Pre: 0.82 Post: 0.78
Cybersecurity Interest (Asif et al., 2025)	8	I like learning about cybersecurity.	Pre: 0.89 Post: 0.93
Cybersecurity Utility (Asif et al., 2025)	18	Cybersecurity is important for society.	Pre: 0.93 Post: 0.92
Perceived Cybersecurity Knowledge (researcher-created single item)	1	How much do you know about cybersecurity?	N/A
Cybersecurity Career Aspirations (researcher-created single item)	1	How likely is it that you will pursue a career in cybersecurity?	N/A

Note. Standardized Cronbach’s alpha is reported for multi-item scales. Alpha is not applicable to the single-item perceived-knowledge and career-aspiration measures.

Problem-solving self-efficacy, computer self-efficacy, and cybersecurity enjoyment and intent to pursue used seven-point Likert response formats ranging from strongly disagree (1) to strongly agree (7). Systems administration, networking, web management, and cyber threat identification self-efficacy used a five-point confidence scale ranging from not at all confident (1) to very confident (5). Cybersecurity interest, utility value, perceived cybersecurity knowledge, and career aspirations used six-point Likert response formats ranging from completely disagree (1) to completely agree (6). Negatively keyed items were reverse scored, and multi-item construct scores were calculated as the mean of their constituent items, with higher values representing more of the construct. A scale score was calculated only when all constituent items were present; consequently, valid paired sample sizes were 29 or 30. The measures were administered without additional age-specific wording modifications and were not separately pilot-tested or validated with middle school participants before this study.

Three qualitative data sources were collected. First, video recordings documented participant interaction during instructional sessions, group activities, and project work. Two cameras were positioned to provide detailed coverage of one seventh-grade group and one ninth-grade group, while a third camera captured whole-group activities, including the opening session and final capstone presentations. Second, screen recordings documented portions of the mentor-mediated workflow in which participants developed prompts, reviewed ChatGPT (GPT-4o) outputs, and revised scripts or media for production in HeyGen (Avatar IV). Third, a post hoc interview with the lead instructor elicited retrospective reflections on instructional decisions and perceived outcomes, including engagement, perceived knowledge, career-related activity, and AI use. Given constraints on the number and fixed placement of available cameras, as well as analytic capacity, intensive small-group video documentation was limited to two focal groups, together with one whole-group final presentation. Within these constraints, a seventh-grade group and a ninth-grade group were purposively selected to capture variation across the lower and upper ends of the camp’s grade range. This maximum-variation strategy was intended to document contrasting interactional processes rather than to produce representative estimates. Detailed small-group coverage was therefore limited to these two groups, and the interview represented one instructor’s perspective. These sources document processes and examples within the recorded material but cannot establish how prevalent a behavior or experience was across all participants. The analyzed recordings totaled 596 min (approximately 9.9 h).

The study protocol was approved by the Institutional Review Board of [Southern Methodist University] (Protocol No. 25-081; approved 5 December 2025). Written informed consent was obtained from the parent or legal guardian of each participant, and written assent was obtained from each participant before data collection.

4.3. Data Analysis

4.3.1. Quantitative Analysis

For the quantitative component, two-tailed paired-samples t tests were used as the primary analysis of mean pretest-posttest differences for 11 prespecified outcomes. All statistical analyses were conducted in R version 4.5.1 (R Core Team, 2025) using RStudio (2025.05.1+513; Posit, PBC, Boston, MA, USA). The paired t test was retained because the target estimate was the mean within-participant change and the test directly provides 95% confidence intervals and standardized mean-change effect sizes. Raw p-values from the 11 paired tests were treated as the primary inferential results. Because multiple comparisons increase the cumulative risk of Type I error, Holm-adjusted p-values were also reported as a conservative sensitivity check. The Holm procedure controls the familywise Type I error rate while being less conservative than the standard Bonferroni correction (Feise, 2002; Holm, 1979).

Scale-specific complete pairs were used for each outcome, yielding valid paired sample sizes of 29–30 and degrees of freedom of 28–29 by excluding the missing data on the items. The quantitative result reports pre- and posttest means and standard errors, paired mean differences with 95% confidence intervals, Cohen’s d, t statistics, raw p-values, and Holm-adjusted p-values. The normality assumption was evaluated using posttest-minus-pretest difference scores. Difference-score histograms, Q-Q plots, and Shapiro–Wilk tests were examined (see Figures S1 and S2, and Table S4 in the Supplementary Materials). Because several difference-score distributions showed departures from normality, two-tailed Wilcoxon signed-rank tests were conducted as a distribution-robust sensitivity analysis, with raw and Holm-adjusted p-values reported in the reproducible analysis (see Table S5 in the Supplementary Materials).

4.3.2. Qualitative Analysis

Three researchers (the first three authors) analyzed the video recordings, screen recordings, project artifacts, and instructor interviews using a hybrid thematic-analysis approach (Braun & Clarke, 2006; Fereday & Muir-Cochrane, 2006). Content logs were first created for each recording to preserve the sequence and context of classroom activity, participant dialogue, group work, and instructor interaction. The unit of analysis was a meaning-bearing segment: turns of talk or interactional episodes in video and screen recordings, and topic-based segments in the instructor interview (Jordan & Henderson, 1995). Project scripts and video excerpts were examined as artifacts of what recorded groups communicated within the capstone task.

Analysis followed the recursive phases of familiarization, initial coding, theme development, theme review, theme definition, and reporting (Braun & Clarke, 2006). The theoretical frameworks and survey constructs supplied deductive sensitizing concepts (Bowen, 2006), including situational engagement, perceived utility, self-efficacy, and selected AI-literacy practices. At the same time, researchers retained interactional patterns and contrasting observations that complicated those concepts, including differences across instructional formats and cases in which the community-facing purpose of the project did not appear salient. Content-log matrices summarized behaviors, dialogue, and group activity by recording. The researchers iteratively compared the logs, reviewed code definitions(see Table S3 in the Supplementary Materials for the codebook), revised theme boundaries, and resolved disagreements through discussion and consensus (Braun & Clarke, 2006). This process is described as hybrid because theory-informed coding was combined with attention to patterns arising from the recorded activity rather than treating the survey constructs as a closed coding frame (Fereday & Muir-Cochrane, 2006). As a reflexive safeguard, the team explicitly considered how theory-informed expectations could foreground anticipated constructs and retained discrepant or negative cases during interpretation.

Instructor-interview evidence was utilized because it documented pedagogical decisions, perceived shifts in participation, and follow-up observations that were not available in the recordings. However, the interview was analyzed as an instructor interpretation rather than a direct measure of participants’ affective or psychological states. Instructor quotations are therefore identified as retrospective accounts, frequency claims are avoided when exact counts are unavailable, and interview evidence is considered alongside participant dialogue, recorded interaction, and project artifacts where those sources are available.

5. Findings

Table 3 and Figure 1 summarize the paired pretest-posttest comparisons. Four outcomes had raw p-values below 0.05: perceived cybersecurity knowledge (n = 30, mean difference = 1.47, 95% CI [1.01, 1.92], d = 1.20, raw p < 0.001), cyber threat identification self-efficacy (n = 29, mean difference = 1.09, 95% CI [0.68, 1.51], d = 1.00, raw p < 0.001), web management self-efficacy (n = 30, d = 0.55, raw p = 0.006), and networking self-efficacy (n = 30, d = 0.49, raw p = 0.011). After Holm adjustment, perceived knowledge and cyber threat identification remained significant (both Holm p < 0.001), whereas web management (Holm p = 0.0504) and networking (Holm p = 0.089) did not. The latter two results are therefore treated as preliminary or less robust. Wilcoxon sensitivity analyses produced the same evidence tiers. These within-group differences should not be interpreted as causal effects of the camp.

Table 3. Two-tailed Paired Pretest-Posttest Comparisons for Study Outcomes.

Construct	n	Pre M (SE)	Post M (SE)	Post-Pre [95% CI]	Cohen’s d	t(df)	Raw p-Value	Holm-Adjusted p
Problem-Solving Self-Efficacy	30	5.38 (0.19)	5.53 (0.23)	0.14 [−0.41, 0.69]	0.10	0.52 (29)	0.604	1.000
Computers Self-Efficacy	30	3.93 (0.25)	4.06 (0.25)	0.12 [−0.51, 0.76]	0.07	0.39 (29)	0.697	1.000
Cybersecurity Enjoyment and Intent to Pursue	29	4.74 (0.28)	4.66 (0.33)	−0.08 [−0.61, 0.44]	−0.06	−0.33 (28)	0.746	1.000
Systems Administration Self-Efficacy	30	3.05 (0.17)	3.29 (0.18)	0.24 [−0.05, 0.53]	0.31	1.68 (29)	0.104	0.623
Networking Self-Efficacy	30	2.31 (0.20)	2.73 (0.18)	0.42 [0.10, 0.75]	0.49	2.71 (29)	0.011	0.089
Web Management Self-Efficacy	30	2.43 (0.22)	2.98 (0.22)	0.55 [0.17, 0.92]	0.55	2.99 (29)	0.006	0.0504
Cyber Threat Identification Self-Efficacy	29	2.60 (0.21)	3.69 (0.22)	1.09 [0.68, 1.51]	1.00	5.37 (28)	<0.001	<0.001
Cybersecurity Interest	30	3.97 (0.20)	4.16 (0.23)	0.19 [−0.18, 0.56]	0.19	1.05 (29)	0.300	1.000
Cybersecurity Utility	29	4.62 (0.16)	4.83 (0.15)	0.21 [−0.02, 0.44]	0.35	1.88 (28)	0.071	0.494
Perceived Cybersecurity Knowledge	30	3.13 (0.26)	4.60 (0.17)	1.47 [1.01, 1.92]	1.20	6.56 (29)	<0.001	<0.001
Cybersecurity Career Aspirations	30	2.83 (0.28)	3.00 (0.24)	0.17 [−0.24, 0.57]	0.15	0.84 (29)	0.407	1.000

Note. Scale scores require complete responses to all constituent items. Mean differences are posttest minus pretest. Confidence intervals are unadjusted 95% intervals for the paired mean difference. Cohen’s d is the mean paired difference divided by the standard deviation of paired differences. Raw p-values are from the primary two-tailed paired-samples t-tests. Holm-adjusted p-values provide a conservative multiple-comparison sensitivity check across the 11 prespecified outcomes.

Figure 1. Paired mean differences with 95% CIs. Note. Blue: remained significant after Holm adjustment; orange: raw p < 0.05 only; gray: raw p at or above 0.05. Labels show d, raw p-value, and Holm-adjusted p; n = 29–30.

5.1. Cybersecurity Interest

Cybersecurity interest refers to learners’ focused attention, positive affect, and sustained cognitive engagement with cybersecurity concepts and practices (Asif et al., 2025; McGill, 2021). The paired comparison indicated no statistically significant pretest-posttest difference (d = 0.19, raw p = 0.300, Holm-adjusted p = 1.000). The observed mean increase should therefore not be interpreted as a statistically supported improvement in overall interest; qualitative observations are presented only as contextual indications of activity-specific engagement.

No qualitative evidence of overall interest change was observed directly from participants in the video or screen recordings. The instructor interview nevertheless described variation in engagement across instructional formats. She recalled lower engagement during early terminology-focused instruction, explaining that “the first day…teaching terminology and principles, and all the not-so-fun, exciting things about cybersecurity…could be a little taxing when you’re tired, and you got a belly full, and heat.” In contrast, she perceived stronger engagement during an interactive password-strength activity because participants could observe the relevance of their choices in real time. These retrospective observations are consistent with the possibility of activity-specific situational engagement, but they do not demonstrate that situational interest increased or explain the nonsignificant overall-interest result. Repeated activity-level measures would be required to distinguish situational from more stable interest.

Although overall cybersecurity interest did not show a statistically significant difference, we next report related motivational and cognitive outcomes: the combined enjoyment-and-intent-to-pursue scale, perceived cybersecurity knowledge, and utility value.

5.2. Cybersecurity Enjoyment and Intent to Pursue

The survey assessed cybersecurity enjoyment and intent to pursue as a seven-item composite rather than as separate outcomes. The combined measure did not show a statistically significant pretest-posttest difference (d = −0.06, raw p = 0.746, Holm-adjusted p = 1.000). Video and screen-recording data provided limited direct evidence concerning the composite. The instructor’s recollection that participants appeared to enjoy an interactive password-strength activity is therefore treated only as a qualitative indication of activity-specific positive affect:

I think what they really enjoyed was password strength … we had students kind of yell out fake passwords to see how strong it was. Once they started and they saw, like, ‘Oh, this is not as strong as I thought it was,’ the more suggestions that we were getting in, the better they were, the longer they were, the harder they were to crack, and they could see, like, ‘Oh, this takes a day to crack,’ or, ‘This takes two weeks.’

5.3. Perceived Cybersecurity Knowledge

Perceived cybersecurity knowledge refers to participants’ self-reported understanding of core cybersecurity concepts and practices. Participants reported significantly higher perceived cybersecurity knowledge at posttest than at pretest (d = 1.20, raw p < 0.001, Holm-adjusted p < 0.001). This result represents a large within-participant difference in self-reported perceived knowledge; it is not an objective assessment of content knowledge and cannot be attributed causally to the camp.

Qualitative evidence from classroom narratives and content logs contextualized the observed increase in perceived cybersecurity knowledge. Recorded participants discussed how cybersecurity ideas might be applied in daily contexts. For instance, a ninth-grade participant reflected during a class share-out: “Practical takeaways—we have to check our passwords and make sure they’re strong and correct… another thing we learned is to help people around us use these devices safely.”

Other recorded participants named concrete practices such as creating “strong passwords,” maintaining “safe social media practices,” and “not sharing personal information.” These examples document how selected participants expressed cybersecurity ideas in action-oriented language rather than demonstrating objective knowledge performance. Additional evidence appeared in GenAI-supported video presentations. One ninth-grade group described cybersecurity as “protecting our computers, networks, and data from digital attacks, like hacking, identity theft, or fraud,” introduced cyber hygiene as “keeping your digital life clean and safe, like brushing your teeth, but for your phone and computer,” and named practices such as using strong passwords, locking devices, and avoiding suspicious links.

Some recorded groups framed their projects as community-facing messages intended to encourage safer digital practices. One group contrasted awareness with action, noting that “while most people fear getting hacked, very few actually use the tools that could stop it.” Their scripts positioned the GenAI-supported videos as attempts to communicate protective practices beyond the camp. This evidence documents how those groups represented and communicated cybersecurity concepts; it does not indicate how consistently all participants understood or independently applied them.

The instructor placed these examples within the challenge of compressing what she described as “200 h of training into 5 h.” She recalled that participants initially did not “resonate” with primarily informational instruction, especially when they had little prior cybersecurity knowledge. After she incorporated music and gamified activities, she perceived fuller responses: “the answers were becoming a little bit more detailed, or if they were providing an answer and maybe not getting it exactly on the head, they were providing some context on how they got there.” This account documents the instructor’s rationale for adapting instruction and her perception of changes in classroom response. It suggests a possible pedagogical process, but it was not independently tested as the cause of the increase in perceived knowledge.

5.4. Cybersecurity Utility Value

Cybersecurity utility refers to the perceived usefulness of cybersecurity knowledge and practices (Asif et al., 2025). The paired comparison did not show a statistically significant increase (d = 0.35, raw p = 0.071, Holm-adjusted p = 0.494). The quantitative result does not support a generalized improvement in perceived utility, and project examples are treated only as qualitative indications of contextual relevance.

In final presentations, recorded groups connected cybersecurity to community safety and practical prevention. One ninth-grade group stated that cyber threats “don’t discriminate,” positioning the message as relevant to a broad public. Another group concluded, “Stay curious, stay safe, and remember strong passwords and MFA help protect our [CITY] community as we grow stronger together.” These artifacts demonstrate contextual relevance in selected groups’ public-facing messages, but they do not establish a population-level change in utility value.

From the instructor’s perspective, at least one participant extended what she learned to her family context. The instructor recalled, “I had one student mentioned that was going to let her younger sibling know what she’s learning in cybersecurity, as well as letting their parents and their grandparents know.” This retrospective account provides a contextual example of perceived everyday relevance but does not establish a generalized change in utility value. The instructor also perceived audience-centered communication in the final creative work:

Primarily our older girls, they knew the demographic, they knew who they were speaking to [NGOs], and that was reflected in the creative. The scripts stressed that tonality was important because you want to make sure that the messaging fits the audience, and they took heed to that as well.

However, the teacher’s follow-up interview also revealed that perceived utility was not equally salient across participants. For some students, the communicative purpose of the final project did not register as meaningful, as she explained, “I don’t think it connected with them what they were doing, and for the sake of trying to complete the project, they kind of took the easy way out and used a real person [instead of using AI].”

5.5. Cybersecurity Self-Efficacy

Cybersecurity self-efficacy refers to students’ confidence in their capability to perform cybersecurity-related tasks and make informed decisions when encountering digital threats (Stavrou & Piki, 2024; Thomas et al., 2024). Six domains were measured and examined in the survey to capture self-efficacy: (1) computer use, (2) cyber threat identification, (3) networking, (4) problem-solving, (5) system administration, and (6) web management. Given the teacher’s characterization of the instructional challenge as compressing “200 h of work into 5 h of instruction,” the camp necessarily prioritized cyber threat identification, networking, and web management, leaving problem-solving, system administration, and computer largely unaddressed.

Cyber threat identification self-efficacy increased and remained significant after Holm adjustment (d = 1.00, raw p < 0.001, Holm-adjusted p < 0.001). Networking self-efficacy (d = 0.49, raw p = 0.011, Holm-adjusted p = 0.089) and web management self-efficacy (d = 0.55, raw p = 0.006, Holm-adjusted p = 0.0504) had raw p-values below 0.05 but did not remain significant after Holm adjustment. Problem-solving, systems administration, and computer self-efficacy were not statistically significant in the primary paired t tests. Wilcoxon sensitivity analyses produced the same evidence tiers.

The qualitative analysis focused on cyber threat identification because it had the clearest corresponding recorded activity. Limited evidence was found directly from the participants on Networking self-efficacy and web management self-efficacy. The video records documented participants moving from naming protective practices to explaining how they might be applied. For example, when asked how to avoid password leaks, one ninth-grade participant responded, “We should not give identity information to people who are not verified as trustworthy [under any circumstance]!” This example documents a task-specific judgment in one recorded interaction. In a follow-up interview, the instructor perceived greater confidence in selected participants’ understanding of MFA and recalled that some shared this information with family members.

When I went into MFA, we had some students that were very familiar with it and had actually initiated it within their cellular devices. For those that didn’t know, they were asking questions. We were explaining how easy it was to set up, and then we had some that had already done it or didn’t realize that it was MFA. Once we kind of went through that particular segment, they were aware of it and shared that information with their parents.

The recorded exchanges and instructor account also included concrete checks proposed during discussion: “think twice before sharing,” “ask what the information is for,” and “verify the requester.” Participants elaborated on phishing and social-engineering scenarios and discussed stronger authentication practices. These interactional examples show how selected participants reasoned about cyber threats during the observed activities; they are contextual evidence of task engagement rather than direct performance measures of self-efficacy.

Selected groups then incorporated password, MFA, suspicious-link, and social-engineering messages into their GenAI-supported scripts. One eighth-grade group advised its audience: “Never share your passwords…be cautious of unexpected calls or texts asking for personal info… don’t click on suspicious links; if unsure, pause and ask for help… Let’s continue to look out for each other. Stay safe, stay smart, stay empowered.” This sequence, from classroom discussion to a community-facing artifact, documents communication and application within the capstone task and provides process evidence relevant to the cyber threat identification finding.

5.6. Cybersecurity Career Aspirations

Cybersecurity career aspiration refers to learners’ intention to continue engaging with cybersecurity and to envision future academic or professional pathways in the field (Asif et al., 2025; McGill, 2021). Results from the paired-samples t-test showed no statistically significant change (n = 30, d = 0.15, raw p = 0.407, Holm-adjusted p = 1.000). This result does not support a quantitative improvement in cybersecurity career aspirations.

Qualitative evidence from the follow-up instructor interview provided limited post-camp behavioral evidence of intent that the pre-post survey design was not positioned to detect. However, the instructor reported that two former camp participants later applied to an AI community internship; the opportunity was not specific to cybersecurity, and no follow-up participant data were collected. The observation is therefore treated only as a limited indicator of engagement with an adjacent AI/STEM opportunity, not as evidence of increased cybersecurity career aspiration.

This isn’t immediately within the camp itself. Outside of it, we have the AI [community internship] program … we had girls that were actually from the summer camp, that were transitioning into high school, apply for the internship, which let me know that the camp resonated, the interest really kind of sparked some career aspirations, and I think inclined them to pursue and apply for the internship.

5.7. Generative AI Literacy

AI literacy was not measured with a validated instrument. The qualitative analysis therefore examined only emerging indicators of selected practices represented in AI literacy frameworks: collaborative prompt formulation, iterative revision, comparison of generated wording, and adaptation of outputs for an intended audience. Evidence was limited regarding independent interface operation, system understanding, verification of accuracy, recognition of bias, privacy judgment, and ethical reasoning.

Recorded groups developed and revised prompts collaboratively. A ninth-grade group described combining alternatives to shape its deepfake script: “[We] used a couple of prompts and we kind of combined them together and chose the best wording, and we told ChatGPT to make a script talking about the dangers of deepfakes.” A seventh-grade group described a similar interactional process: they would “input many different prompts… each of us generated at least one idea about what we wanted to do, and then we brainstormed together and asked Chat[GPT] to continue to generate [scripts].” These exchanges document brainstorming, comparison, and collective decision-making.

Beyond content generation, participants also critically evaluated and refined GenAI outputs to improve the quality of their final products. As illustrated in Figure 2, one participant group systematically revised its prompt based on the clarity, relevance, and structure of ChatGPT’s responses. Their revisions included specifying concrete requests to match the needs of the group’s chosen non-profit (El Mercado), highlighting core themes, adjusting tone, and modifying the length and detail of the expected output. This example documents how members of one recorded group collaboratively refined prompts and evaluated ChatGPT outputs within a mentor-mediated workflow.

Figure 2. Process of Prompt Modification for ChatGPT.

The instructor perceived a shift from initial apprehension toward greater willingness to participate in AI-supported production. She recalled participants saying, “I don’t use it,” “I see it, but not really into it,” and “Oh, isn’t that the thing that’s taking jobs?” She interpreted this as apprehension associated with limited familiarity and negative media narratives: “I actually thought it was a little peculiar, that there was some apprehension in utilizing AI… because of just lack of knowledge and some of the fears that might be associated with AI out in the media.” The instructor described introducing AI in incremental, “palatable bites” as the groups worked toward their videos. This remains a retrospective instructor interpretation; participant attitudes were not directly measured over time.

The instructor also noted that one group “mimicked their avatar that they were creating from scratch within ChatGPT off of [a real person they knew].” Together with the recorded prompt exchanges, this example documents how selected groups made creative and representational choices during mentor-mediated production.

6. Discussion

This study examined pretest–posttest differences and qualitative patterns in UUREM girls’ perceived cybersecurity knowledge, domain-specific self-efficacy, interest, enjoyment and intent to pursue, utility value, career aspirations, and selected AI-literacy practices within a week-long residential cybersecurity camp integrating GenAI tools. Perceived cybersecurity knowledge and cyber threat identification self-efficacy had the strongest quantitative support: both were significant in the primary paired t tests and remained significant after Holm adjustment. Networking and web management self-efficacy had raw p-values below 0.05 but did not remain significant after Holm adjustment and are therefore treated as preliminary or less robust. Overall interest, enjoyment and intent to pursue, utility, career aspirations, and the other self-efficacy domains were not statistically significant. The qualitative strand adds evidence about how selected participants interacted, communicated cybersecurity ideas, and engaged in mentor-mediated GenAI production. The findings shed light on processes and domain-specific patterns that may be relevant to the design of informal cybersecurity learning for UUREM girls. Across the theoretical perspectives that framed this study (the four-phase model of interest development, self-determination theory, expectancy-value theory, and self-efficacy theory), the findings distinguish activity-specific engagement and task-specific confidence, which showed the clearest changes, from broader changes in perceived value, enduring individual interest, and career orientation, which did not. This distinction provides a unifying interpretive lens: it is consistent with the possibility that proximal, situationally supported constructs may be more responsive in short-term programs than distal motivational orientations, which typically develop over longer periods.

6.1. Cybersecurity Interest

Overall cybersecurity interest did not show a statistically significant pretest-posttest difference. The Four-Phase Model distinguishes activity-contingent situational interest from more stable individual interest (Hidi & Renninger, 2006). The instructor’s accounts of lower engagement during terminology-focused instruction and stronger engagement during the password-strength activity are consistent with the possibility that particular activities elicited situational engagement (Bernacki & Walkington, 2018; Hidi & Renninger, 2006). They do not demonstrate that overall interest increased, and the study did not repeatedly measure interest during individual activities. Program duration, activity design, initial interest, and measurement sensitivity remain possible explanations for the null result rather than tested mechanisms. Repeated activity-level measures and longer follow-up would be needed to determine whether brief engagement develops into a more stable interest in cybersecurity (Hidi & Renninger, 2006; Walkington & Bernacki, 2014).

6.2. Perceived Cybersecurity Knowledge

The single-item measure of perceived cybersecurity knowledge showed the largest pretest-posttest difference (d = 1.20) and remained significant after Holm adjustment. The large effect size reflects a large within-participant increase in participants’ self-reported understanding of core cybersecurity concepts. Because this is a single-item, self-report measure evaluated within a single-group design, it indexes perceived rather than demonstrated knowledge and should not be attributed causally to the camp. This pattern is nonetheless consistent with prior research showing that informal, hands-on, and scenario-based cybersecurity programs can accompany rapid gains in perceived knowledge, particularly when learners engage in authentic, project-based tasks situated in real-world contexts (Triplett, 2023; L. Wang et al., 2020). The present study extends this work by suggesting that perceived knowledge gains can occur within an informal learning environment designed for UUREM girls, who often have limited early exposure to cybersecurity education and fewer opportunities to develop foundational knowledge through formal pathways (Botha-Badenhorst & Veerasamy, 2023; Osman et al., 2023).

Importantly, these gains may have been supported by the production-oriented structure of the camp. Through the GenAI-supported video project, participants were asked to interpret, translate, and apply cybersecurity concepts for real community audiences (Thomas et al., 2024; Triplett, 2023). In doing so, the participants were positioned as communicators of cybersecurity knowledge. In this sense, the findings align with prior research highlighting the value of authentic, production-oriented activities in informal STEM learning environments (Thomas et al., 2024) and extend emerging work on the educational affordances of GenAI by situating GenAI use within a project-based cybersecurity context (Li et al., 2025; Walkington et al., 2025).

6.3. Cybersecurity Enjoyment and Intent to Pursue

Enjoyment, as an affective component of interest, appeared to follow a more situational pattern. Enjoyment was assessed as part of a combined enjoyment and intent-to-pursue scale rather than as a separate subscale. Although this combined scale did not show a statistically significant increase, the instructor’s retrospective account described activity-specific enjoyment during activities that were interactive, concrete, and immediately interpretable (Bernacki & Walkington, 2018; Hidi & Renninger, 2006). The password-strength activity was especially illustrative, as participants could test examples, observe immediate consequences, and connect the activity to their own digital lives. These features may have made cybersecurity feel less abstract and more personally meaningful, which is consistent with prior research showing that meaningful content, personal relevance, social support, and opportunities for choice and control can support interest development (Bernacki & Walkington, 2018; Milton et al., in press).

SDT further helps explain why enjoyment may have emerged during particular activities rather than across the camp as a whole. Activities that appeared most engaging were those that supported participants’ autonomy, competence, and relatedness, consistent with SDT and with Zhang and Zhang’s (2025) findings on LLM-supported project-based learning (Müller & Louw, 2004; Ryan & Deci, 2020). Together, these design features may have made cybersecurity feel more accessible, meaningful, and socially connected for participants.

Also, we argue that the absence of a statistically significant difference in the combined enjoyment-and-intent-to-pursue measure suggests that affective change should not be assumed from participation alone. For UUREM girls, who often have limited prior exposure to cybersecurity learning opportunities, brief moments of enjoyment may reflect the affective component of triggered situational interest (Botha-Badenhorst & Veerasamy, 2023; Osman et al., 2023). However, such moments may not immediately translate into more stable individual interest in cybersecurity, which develops over time through repeated and supported engagement (Hidi & Renninger, 2006).

6.4. Perceived Cybersecurity Utility

Perceived utility value also appeared to emerge in context-specific ways. Although survey results did not show a statistically significant increase in cybersecurity utility, qualitative evidence suggested that some participants recognized the usefulness of cybersecurity when it was connected to family protection, nonprofit audiences, and community safety. From an Expectancy-Value Theory perspective, these moments may have strengthened participants’ perceptions of utility value by making the usefulness of cybersecurity visible in relation to real audiences and everyday digital risks (Eccles & Wigfield, 2002; Wigfield et al., 2017). However, the non-significant quantitative finding suggests that these context-specific experiences may not have been sufficient to shift participants’ generalized perceptions of cybersecurity utility over the short duration of the camp (Eccles & Wigfield, 2002; Wigfield et al., 2017).

6.5. Self-Efficacy in Cybersecurity

Cybersecurity self-efficacy results provide a differentiated picture of how participants’ confidence developed across the camp. Among the domain-specific subscales, only cyber threat identification self-efficacy showed a change that remained statistically significant after Holm adjustment (d = 1.00). Networking and web management self-efficacy showed unadjusted increases that did not remain significant after Holm correction and are therefore treated as preliminary rather than robust. These subscales reflect participants’ confidence in performing concrete, domain-specific cybersecurity tasks, such as recognizing cyber threats, evaluating risky online situations, and applying strategies to prevent security risks (Asif et al., 2025; Hong & Furnell, 2021; McGill, 2021). The pattern of findings suggests that the camp was associated with stronger confidence, most robustly for cyber threat identification, in cybersecurity domains that were directly addressed through instruction and project-based activities (Thomas et al., 2024; Triplett, 2023; Walkington et al., 2024).

These gains are consistent with self-efficacy theory and prior research on cybersecurity education that emphasizes mastery experiences, scaffolded practice, feedback, and peer-supported learning (Bandura, 1977; Thomas et al., 2024; Triplett, 2023). Throughout the camp, participants had repeated opportunities to engage with applied cybersecurity practices, such as identifying phishing attempts, explaining MFA, evaluating password strength, and creating narratives about digital threats. These activities resembled opportunities for mastery through applied cybersecurity practice, while instructor and mentor feedback offered forms of social persuasion that may have reinforced their developing confidence (Bandura, 1977; Walkington et al., 2024). The qualitative evidence is consistent with this interpretation: in their final projects participants applied and communicated concepts such as verifying information requests, avoiding suspicious links, and explaining MFA to family or community audiences, and these examples correspond most directly to cyber threat identification, the domain with the most robust quantitative change, rather than to networking or web management (Artino, 2012; Lu et al., 2022; Thomas et al., 2024; Triplett, 2023).

In contrast, problem-solving self-efficacy and system administration self-efficacy did not show statistically significant differences. This pattern may reflect closer alignment between instructional coverage and the targeted self-efficacy domains than for problem-solving and system administration, although this explanation was not directly tested. System administration involves more technical tasks (managing user accounts, permissions, or system-level configurations) that were not a central focus of the camp, and general problem-solving self-efficacy may be a broader, more stable construct less likely to shift within a one-week intervention (Artino, 2012; Bandura, 1977; Brilingaitė et al., 2020; Lu et al., 2022; Stavrou & Piki, 2024). Taken together, the self-efficacy findings suggest that short-term differences in informal cybersecurity programs tend to concentrate in directly targeted domains and are likely most pronounced when the measured domains closely align with the instructional activities participants actually experience; broader or more technical areas may require longer-term instruction and repeated opportunities for independent application (Stavrou & Piki, 2024; Thomas et al., 2024).

6.6. Cybersecurity Career Aspirations

Intent to pursue and career aspirations refer to participants’ willingness to continue engaging with cybersecurity and their ability to envision future academic or professional pathways in the field (Asif et al., 2025; McGill, 2021). In the present study, career aspirations (a single-item measure) and the combined enjoyment and intent-to-pursue scale did not show statistically significant pre-post gains; because intent to pursue was not scored as a separate subscale, it cannot be evaluated independently of enjoyment. In addition, the interview data did not provide evidence that participants developed a sustained intention to continue learning about or working in cybersecurity. From this perspective, the lack of evidence for continued cybersecurity engagement should not necessarily be interpreted as a lack of participant interest, as participants’ future participation may also depend on the availability of relevant opportunities and other contextual supports or barriers (Chong, 2018; Emerick, 2020). Because participants did not have a clearly documented follow-up cybersecurity-specific opportunity, it is difficult to determine whether the absence of continued cybersecurity participation reflected limited opportunity structures, lack of interest, or other contextual factors. Thus, multiple potential confounding factors limit our ability to attribute the null findings to participants’ actual disinterest in cybersecurity.

Nevertheless, the interview indicated that some camp participants later applied for a follow-up AI community internship program. However, due to the lack of repeated quantitative measures and qualitative evidence from participants, this finding should be treated as a limited contextual indicator that two former participants, as reported by the instructor, applied for a related AI-focused opportunity after the camp. Because this opportunity was oriented toward AI rather than cybersecurity specifically, it cannot be interpreted as evidence of sustained cybersecurity career interest and may instead reflect interest in AI more broadly.

6.7. GenAI and AI Literacy

Although AI literacy was not quantitatively measured, qualitative evidence suggests that participants engaged in practices consistent with emerging AI literacy through mentor-mediated GenAI-supported cybersecurity video production; because no validated AI-literacy measure was administered and mentors operated the tools, these are exploratory indicators rather than demonstrated literacy. This finding extends limited research on K-12 students as producers of GenAI-supported multimodal artifacts, particularly in informal STEM contexts (Chen & Wu, 2024; T. Xu et al., 2024). Prior work emphasizes that K-12 GenAI video production requires explicit AI literacy instruction and teacher scaffolding because students must coordinate multiple tools, such as script generation, avatar creation, speech generation, and video editing (Chen & Wu, 2024; T. Xu et al., 2024). In this study, middle school UUREM girls engaged in this type of GenAI production pipeline within a scaffolded cybersecurity project.

This finding is consequential from an equity perspective because lower AI literacy may increase vulnerability to misleading outputs, algorithmic bias, and overreliance on generative systems, potentially reinforcing inequities in STEM participation and achievement (Cheng et al., 2025). Some participants entered the camp with limited prior exposure to GenAI and initial apprehension toward AI systems. However, through scaffolded instruction, teacher and mentor feedback, and peer collaboration, participants began using GenAI in more purposeful and evaluative ways. Rather than using GenAI only to generate scripts or final products, participants engaged in iterative prompting, revision, and evaluation, including refining prompts, comparing outputs, identifying limitations, adjusting tone, and adapting messages for nonprofit and community audiences (Sager et al., forthcoming). Consistent with the two dimensions we operationalized (applying AI tools and critically evaluating AI outputs), these practices provide exploratory, qualitative indicators of emerging AI literacy rather than evidence of the full construct (European Commission & Organisation for Economic Co-operation and Development [OECD], 2025; Ng et al., 2021). We did not assess the other dimensions, such as conceptual understanding of how AI systems work or ethical reasoning, and the evidence remains limited regarding bias evaluation and accuracy verification. Moreover, because mentors entered the girls’ prompts into the GenAI tools owing to platform age restrictions, participants did not directly operate the AI interfaces; independent operational tool fluency was therefore not directly measured, and these indicators should be interpreted as mentor-mediated rather than autonomous AI use (Chen & Wu, 2024; Puntambekar & Hübscher, 2005; T. Xu et al., 2024).

In addition, the observed workflow illustrates how GenAI can be embedded within scaffolded, collaborative, and production-oriented cybersecurity activities. In the present study, GenAI appeared to function as a scaffold for production, communication, and reflection rather than as a stand-alone source of information; because GenAI-supported production occurred alongside instruction, mentoring, and collaborative project work, its specific contribution cannot be isolated in this design. The GenAI-supported production tasks required participants to translate cybersecurity concepts into accessible messages and provided opportunities for practice, feedback, and successful artifact production, which are conditions associated with the development of learners’ confidence. At the same time, overreliance on AI-generated solutions may short-circuit the mastery experiences through which durable self-efficacy is built (Bandura, 1977; Thomas et al., 2024; Yan et al., 2025; Zhang & Xu, 2024). The teacher interview further raised a question about possible cross-tool AI use, reporting that some participants later used the AI assistant in Canva; because the study did not directly measure AI literacy transfer, this offers a limited qualitative observation rather than evidence of transfer. It partially aligns with frameworks that define AI literacy as a broader capacity to engage with, manage, and critically evaluate AI systems across contexts rather than proficiency with a single tool (European Commission & Organisation for Economic Co-operation and Development [OECD], 2025; Ng et al., 2021). Overall, these design features identify a hypothesis for future comparative research, namely whether embedding GenAI within scaffolding, mentor feedback, and collaborative production contributes to novice learners’ confidence, rather than evidence of a distinct GenAI effect.

7. Limitations, Implications, and Conclusion

Several limitations should be acknowledged. First, the sample was relatively small and drawn from UUREM girls participating in a single residential cybersecurity camp, which restricts generalizability to broader student populations, age groups, and informal cybersecurity learning contexts. Second, the short duration of the camp limited the study’s ability to capture sustained changes in affective and career-oriented outcomes; future research should include longitudinal follow-up to examine whether early motivational indicators develop into more stable outcomes over time. Relatedly, the one-week format necessarily constrained the breadth of cybersecurity content that could be covered; several domains, such as system administration and general problem-solving, received limited instructional attention, which may partly account for the domain-specific pattern of self-efficacy findings. Third, reliance on self-report measures may introduce response bias and cannot determine whether perceived gains corresponded to demonstrated performance or durable skill development; performance-based assessments and artifact analysis would strengthen future work. Fourth, the study used a single-group pretest-posttest design with no comparison or control group, so observed changes cannot be attributed causally to the intervention and may reflect maturation, testing effects, or other unmeasured influences. Relatedly, the camp combined cybersecurity instruction, mentoring, collaboration, and project-based GenAI production, and the design does not allow the specific contribution of GenAI to be isolated from these broader features. Fifth, several constructs, including perceived cybersecurity knowledge and career aspirations, were assessed with single-item measures, and the instruments were not re-piloted or re-validated with this middle school population; no objective knowledge test or validated AI-literacy measure was administered. The relatively small sample combined with multiple paired comparisons increases the cumulative risk of Type I error; the Holm adjustment mitigates but does not eliminate this concern, and the study was not powered to detect small effects. The analytic sample also varied across outcomes: 33 girls completed the pretest, 30 completed the posttest, and some paired comparisons were based on n = 29 because of item-level missingness. Some difference scores departed from normality, although Wilcoxon sensitivity analyses yielded the same evidence tiers as the paired t tests. Finally, the qualitative data were limited by uneven video coverage (only two of the seven groups were recorded in detail), a single educator perspective, and mentor mediation of all GenAI interactions, which means AI-literacy indicators reflect mentor-supported rather than independent student operation; future studies should collect more systematic evidence across participants, mentors, and final artifacts.

Our findings offer two key implications for GenAI-integrated cybersecurity education, informal STEM program design, and equity-focused learning environments. First, immersive informal programs may support gains in perceived knowledge and domain-specific confidence for UUREM girls when they provide structured opportunities for mastery, collaboration, and authentic task engagement, although the affective outcomes measured here did not change significantly and these implications should be treated as tentative directions for future research rather than demonstrated effects. For school districts, this suggests the value of partnering with informal STEM programs as a complement to formal instruction, particularly for learners with limited early exposure to cybersecurity pathways. Second, the integration of GenAI offers important pedagogical implications for K-12 cybersecurity education. Educators can embed GenAI tools within production-oriented, collaborative activities that require learners to iteratively refine prompts, evaluate outputs, and communicate ideas for real audiences. Such practices may scaffold cybersecurity learning while supporting the emerging AI-literacy practices observed in this study, though their contribution to broader AI-literacy development remains to be established. These tools must be embedded within pedagogical frameworks that foreground ethical and responsible GenAI use to mitigate risks such as representational bias and inequitable outputs.

This study examined learning outcomes among UUREM middle school girls following participation in a short-term GenAI-integrated informal cybersecurity summer camp. The findings suggest that student-driven, project-based informal learning environments may serve as promising entry points for introducing cybersecurity concepts and AI-supported learning to students with limited access to these opportunities in formal settings. By providing authentic tasks, collaborative structures, and scaffolded opportunities for mastery, such programs are designed with the longer-term aims of broadening access to and supporting participation in emerging technology fields. This study did not measure barrier reduction or equitable participation, however, so these remain program-design goals and questions for future research rather than outcomes demonstrated here. When learning environments are intentionally designed to be supportive and responsive to learners’ backgrounds, UUREM participants may develop foundational perceived knowledge, domain-specific confidence, and activity-specific engagement with cybersecurity. Whether such programs are culturally responsive or identity-affirming in ways that contribute to more inclusive pathways into the field remains a question for future research using designs capable of testing these claims directly.