Mohammad Alshayeb

1. The rapid advancement of mobile device capabilities has accelerated the digitization of services previously delivered through traditional channels, leading to a shift toward mobile applications ...

Cybersecurity is a critical component of digital transformation, as the two must be integrated to enable business modernization and the adoption of innovative technologies while ensuring system security. Modern technologies introduce increasingly complex threats as more data is stored, transmitted, and processed across systems. Threats include the violation or misuse of data, such as data corruption, data theft, or a privacy violation. Determining if an organization applies the best practices requires measurements using maturity models. Several maturity models with different goals and qualities have been developed. However, no cybersecurity maturity model is related to digitally enabled or transforming organizations. The objective of this study is to develop a model that measures cybersecurity maturity for digitally transformed organizations. The model aims to provide a customizable assessment method for organizations of different sizes and domains. Two multivocal literature reviews (MLRs) were conducted to identify the available maturity models and best practices from formal and grey literature. After analyzing 165 studies, seven cybersecurity categories, as the capability areas, and 22 practice areas, were identified. Moreover, an assessment tool that supports self‐assessment was developed. Finally, the model was evaluated through five case studies and expert judgments. As a result, a cybersecurity maturity model for digitally transformed organizations is developed, along with its assessment methodology and automation tool. The model evaluation showed promising results in terms of the ability to identify the maturity level.

Requirements engineering plays a pivotal role in software development, but overlooks the subjective emotional perspectives of users. However, capturing user emotions effectively is essential for designing engaging systems aligned with pragmatic needs. This paper presents the EmORE tool for generating emotional journey artifacts that provide novel insights into user affect dynamics during the requirements elicitation process. The tool implements a customizable interview technique to evoke usage-specific emotional responses. Emotions are quantified using the Self-Assessment Manikin (SAM) rating technique to enable consistent measurement. Machine learning classifiers categorize expressed emotions, while clustering algorithms identify cross-user patterns to construct comprehensive emotional journey maps—the core contribution of this work. The customizable elicitation workflow and quantitative emotion capture capabilities help mitigate subjectivity, variability, and context-dependence. The tool was evaluated through case studies, interviews, and usability assessments. The accuracy analysis showed 80-96% precision in predicting users’ emotional responses across diverse touchpoints. Thematic analysis revealed positive perceptions of the tool’s potential but concerns about interpretability and adoption. The System Usability Scale (SUS) scores indicated high usability with opportunities to improve learnability. Overall, the results validate the tool’s capabilities while highlighting areas for enhancement, such as simplified onboarding and seamless integration with existing project management techniques. This research facilitates the inclusion of complex emotional perspectives in software engineering to drive user adoption and satisfaction.

Software maturity models can be utilized by organizations to evaluate and enhance their development processes. Established and recognized models such as the Capability Maturity Model Integrated (CMMI) and ISO/IEC 15504 (Software Process Improvement and Capability Determination (SPICE)) have proven their value. However, many new software maturity models exist, and their quality and potential value remain questionable until they are properly assessed before adoption. Without such an assessment, organizations can implement poor or ineffective models, resulting in wasted resources and failed improvement initiatives. Our research aims to address this challenge by developing a measurement framework based on ISO/IEC 15504-3 standards to assess the quality of developed software maturity models. We derived our quality assessment criteria through literature analysis, analyzing four main categories: basic model information, structural design, assessment methods, and implementation support. After developing this framework, we validated it with expert reviews to assess its design and usability and through a series of case studies. Feedback from academics and industry practitioners confirmed the framework’s utility, especially recognizing its clear structure and comprehensiveness of evaluation criteria. Case studies also revealed the framework’s effectiveness in identifying strengths and areas of improvement, finding that evaluated models had quality scores ranging from 83.3% to 93.2%. Our study enhances software maturity models’ practical utility and adoption across different software contexts, providing professionals and academics with a structured way to evaluate and enhance maturity models.

Recent studies have highlighted a growing interest in security culture. Frameworks and standards currently exist, offering cybersecurity regulatory guidelines for organizations both locally and internationally, as evidenced in the literature. However, research on information security culture (ISC) within universities remains limited. Moreover, there is a notable absence of professional and academic investigations into ISC. In this article we aim to thoroughly examine ISC in universities through four main objectives. First, we will identify essential knowledge areas (KAs) in this field. Second, we will analyze best practices (BPs) used to promote security culture in universities. Third, we will explore where these practices can be applied across different university areas. Finally, we will create a detailed taxonomy to organize the aspects of ISC in university settings. We employed a multivocal literature review (MLR) approach to identify the primary KAs and BPs for understanding and enhancing security culture in universities. We scrutinized 81 primary studies from formal (FL; peer-reviewed) and grey literature (GL; blogs, web pages, white papers). These studies span the past 14 years, from 2010 to 2024. We identified 12 main KAs and 76 best practice areas from both FL and GL. Our findings have enabled us to establish a taxonomy of security culture in universities. This comprehensive categorization serves as a valuable resource for understanding aspects of security culture. This study will assist researchers and practitioners in finding relevant studies from the FL and GL to obtain evidence that will help develop an ISC model. Moreover, it has shed light on several areas that warrant further research and development to enhance security culture.