Scafolding Student Learning through GenAI in Cybersecurity Education

Abstract

The integration of Generative AI (GenAI) into education has the potential to transform pedagogical approaches and redefine learner engagement. Concerns, however, remain regarding the use of GenAI as a shortcut to final answers rather than as a scafolding tool to support genuine understanding and critical thinking. This short paper presents a conceptual framework and system design for leveraging GenAI as a scafolding tool to prompt student learning in cybersecurity education. The proposed framework introduces a GenAI-powered scafolding agent that provides step-by-step guidance and fosters independent learning through inquiry-based dialogues aligned with established scafolding strategies. The system architecture for this AI-driven scafolding tool is presented in this paper, tailored within the context of cybersecurity pedagogy.

Keywords

• eol>scafolding
• GenAI
• cybersecurity education
• critical thinking
• scafolding agent

1. Introduction

Rapid adoption of Generative AI (GenAI) tools such as ChatGPT, Gemini, and Claude has significantly impacted modern education [ 1 ]. With their ability to generate coherent text, explain concepts, and solve complex problems, these tools have opened new avenues to improve personalized learning experiences [ 2, 3 ]. Meanwhile, the increasing use of GenAI has continued to spark debate. Whilst some educators view them as transformative pedagogical aids, others express concerns over academic integrity and diminished cognitive efort among students [ 4, 5 ]. Students can easily find answers to fact-based problems through GenAI or ask GenAI to complete an essay or report, without going through the process of problem solving.

Scafolding, a concept rooted in Vygotsky’s Zone of Proximal Development (ZPD), refers to the instructional supports provided to help learners bridge gaps between their current capabilities and learning goals [ 6 ]. Traditionally, scafolding has been delivered through tutors, peers, or carefully designed instructional materials [ 7 ]. The integration of GenAI presents a new paradigm: intelligent and adaptive support systems capable of delivering real-time feedback and context-aware assistance tailored to each learner’s needs. Cybersecurity education presents a compelling case for such integration. Given its inherently practical nature and the abstract complexity of its theoretical underpinnings, students often struggle with foundational concepts such as network configurations, threat modeling, and cryptographic algorithms [ 8, 9 ]. Standard teaching models, especially in large classroom settings, may not adequately address individual student misunderstandings. Here, GenAI ofers the potential to act as a 24/7 teaching assistant, capable of scafolding student learning without giving away answers, thus promoting deeper comprehension and retention.

Recent studies have explored the role of GenAI in STEM education. Wang et al. (2024) [ 2 ] reported that while GenAI tools are widely used, students who relied exclusively on AI assistance showed weaker problem-solving and critical thinking skills in comparison to those who used it as a supplementary guide. Abdelghani et al. (2023) [ 3 ] emphasised the importance of maintaining active learning strategies even when GenAI is used in classrooms, warning against a passive learning culture. Researchers found that purpose-built AI tools have augmented teaching and learning, for example,in teaching programming examples such as explaining code snippets and improving code style are to be found [ 10, 11 ], and the virtual teaching assistant (TA) outperforms human TAs in clarity and engagement, matching them on accuracy when the question is non-assignment-specific [ 12 ]. In cybersecurity education specifically, there remains a lack of structured research investigating how GenAI can be adopted to scafold the development of learners’ cognitive skills, skills such as critical thinking and problem solving, together with the development of practical skills such as troubleshooting. Previous research to this point has focused on group work dynamics [13, 14], peer instruction [15], and related areas [ 8 ], however, the application of GenAI-driven scafolding in cybersecurity education is relatively unexplored.

This paper aims to address the above research gap by proposing a conceptual framework and system design for leveraging GenAI as a scafolding agent to prompt student learning in cybersecurity education. Rather than ofering direct answers, the scafolding agent breaks down problems, prompts reflection, and encourages exploration, which is an approach rooted in Socratic questioning and inquiry-based learning [16]. The overarching goal is to design an AI-based scafolding model that can enhance student engagement, foster critical thinking, and ultimately improve learning outcomes. By focusing on a cybersecurity course context, this work contributes to the discussion on digital pedagogy and the ethical deployment of AI in higher education.

The following sections in this paper are structured as follows: Section 2 presents the prototype design and scafolding strategies, Section 3 outlines the approach taken for implementation and Section 4 concludes the paper with final reflections.

2. Design of the GenAI-Powered Scafolding Agent

The design of the GenAI-powered Scafolding Agent began with a conceptual framework based on scafolding theory [ 6 ], emphasising step-wise guidance and Socratic questioning [16] by which learners are guided through critical inquiry rather than being given direct answers.

2.1. System Architecture

1. Front End. The scafolding agent will be accessed through a chatbot interface that allows typed input, voice-recording-based input for hands-free interaction, and also includes features for uploading files or photos, enabling students to share screenshots of errors or diagrams for more contextual support. The frontend will also include a dedicated user login and signup page, allowing students to register and authenticate their sessions. 2. Backend. A secure authentication system will be implemented to manage student access and diferentiate between users. User registration data will be stored and managed securely. Each login will be tied to a user-specific session, and all progress will be automatically saved to ensure continuity between sessions. This allows learners to resume their practice from where they left of. A database will log all user interactions, categorised by topic and hint level. This data will help administrators identify the most common questions asked, frequently encountered misconceptions, and usage patterns. Server-side logic will handle query pre-processing, session management, security checks, and role-based access for admins in the cloud. 3. GenAI Integration. The OpenAI GPT model will serve as the assistant’s reasoning engine, providing contextual responses in an educational tone. Its scafolding capabilities will be shaped through engineered prompts and domain-specific framing to avoid ofering direct answers unless explicitly needed.

2.2. Scafolding Strategies

The integration of these components aims to form a cohesive, AI-driven scafolding tool that supports students with a guided, personalised learning experience in cybersecurity. The key scafolding strategies proposed include: • Progressive Hint Generation: The scafolding agent is designed to ofer layered support through hints such as those in [17]. When a student encounters dificulty (e.g., misconfiguring a firewall rule), the scafolding agent first poses reflective questions (“What’s the intended outcome for this rule?”), followed by conceptual nudges, and—only if necessary—partial explanations or references [ 2 ]. • Context-Aware Dialogue: Leveraging the OpenAI GPT API, the agent is planned to adapt responses based on the user’s current topic, query patterns, and self-selected proficiency level (e.g., Beginner, Intermediate, Advanced) [18]. The goal is to support foundational learners while encouraging advanced learners with higher-order thinking questions [ 3, 4 ]. • Socratic Questioning Modules: The agent will encourage metacognitive engagement by asking students to reflect on their reasoning [ 19]. For example, it may ask, “How does this rule afect incoming packets from a public network?” instead of stating what’s incorrect [16]. • Error Diagnosis Patterns: Anticipated system intelligence will include mapping common errors (e.g., invalid IP address range or incorrect encryption syntax) and ofering hint-based correction paths specific to each category [ 8 ].

Additionally, the scafolding agent will provide dynamic scafolding through visual cues. Where appropriate, the system will display relevant images or diagrammatic explanations—such as simplified network topologies or rule flow charts—based on student input. These visual assets are intended to help students build conceptual models and foster visual thinking in areas such as firewall configuration, subnetting, or routing logic. An admin interface will visualise interaction history and performance indicators to help educators understand common dificulties experienced by the student cohort. This can inform teaching strategies and curriculum updates. Admins will also have access to heatmaps and query trends showing which topics are most problematic for learners.

3. Implementation

A flow-based conversational model is in development, allowing cybersecurity topics, for example, packet snifing and encryption algorithms, to branch into a dialogue tree with embedded checkpoints, revision prompts, and optional deeper conceptual trails. Flutter (Dart) is chosen for the front end for its cross-platform development flexibility and responsive, consistent user interface accessible on both mobile and desktop platforms. Firebase was chosen because it works well with Flutter. The backend infrastructure and interface have been partially implemented (see Figures 2), while the full pipeline connecting GPT interaction to real-time classroom support is still under active development. The ultimate aim is to mirror the dynamics of human scafolding while preserving autonomy and critical thinking for the learner. In future stages, integration with learning management systems (LMS) may be explored to enhance student motivation and align with institutional workflows.

4. Summary

This paper contributes to the emerging field of AI-driven educational scafolding by proposing and designing a scafolding agent leveraging Generative AI for cybersecurity education. The integration of a scafolding agent capable of delivering contextual hints and Socratic questioning is presented with the intention of providing an efective learning experience with increased student engagement, improved academic outcomes, and independent learning. Although the system is still in development, the technical stack and deployment approach have been defined in this short paper. The digital nature of GenAI enables scalability, accessibility, and availability in asynchronous and remote learning contexts. Moreover, integrating GenAI into cybersecurity education supports inquiry-based learning, encouraging students to take ownership of their learning paths.

Future research, will involve using the scafolding agent to identify scafolding mechanisms (e.g., hints, feedback, dialogue) that are most efective when delivered through GenAI; how a GenAI-based scafolding agent can be designed to address common learning challenges in cybersecurity education such as a network security courses; and the ethical considerations and pedagogical implications of deploying GenAI in cybersecurity education.

Declaration on Generative AI

The author(s) have not employed any Generative AI tools. NY, USA, 2024, p. 743–749. URL: https://doi.org/10.1145/3626252.3630789. doi:10.1145/3626252. 3630789. [13] H. Xiao, J. Spring, I. Kuzminykh, Analysis of student preference to group work assessment in cybersecurity courses, in: 2nd International Workshop on CyberSecurity Education for Industry and Academia (CSE4IA 2024), Genova, Italy, 2024. [14] H. Xiao, J. Spring, I. Kuzminykh, J. Cortellazzi, Inclusive group work assessment for cybersecurity, in: Proceedings of the 2023 Conference on Innovation and Technology in Computer Science Education V. 2, 2023, pp. 652–652. [15] P. Deshpande, C. B. Lee, I. Ahmed, Evaluation of peer instruction for cybersecurity education, in: Proceedings of the 50th ACM Technical Symposium on Computer Science Education, SIGCSE ’19, Association for Computing Machinery, New York, NY, USA, 2019, p. 720–725. doi:10.1145/ 3287324.3287403. [16] C. Chin, Classroom Interaction in Science: Teacher questioning and feedback to students’ responses, International Journal of Science Education 28 (2006) 1315–1346. doi:10.1080/ 09500690600621100. [17] J. A. da Silva Gonçalves, A Hint Generation System for Introductory Programming Exercises in

Java, Master’s thesis, ISCTE-Instituto Universitario de Lisboa (Portugal), 2022. [18] E. Oliveira, P. Galvao de Barba, L. Corrin, Enabling adaptive, personalised and context-aware interaction in a smart learning environment: Piloting the icollab system, Australasian Journal of Educational Technology 37 (2021) 1–23. URL: https://ajet.org.au/index.php/AJET/article/view/6792. doi:10.14742/ajet.6792. [19] S. Yilmaz, Socratic Method “Teaching IR Theory Using the Socratic Method”, Springer Nature Switzerland, Cham, 2024, pp. 439–451. URL: https://doi.org/10.1007/978-3-031-72072-7_35. doi:10. 1007/978-3-031-72072-7_35.

References

[1] J. E. Duah , X. Lu , P. McGivern , Y. Jing , Interdisciplinary perspectives on generative artificial intelligence adoption in higher education: A theoretical framework review , in: Proceedings of the 2024 7th International Conference on Big Data and Education , ICBDE '24, Association for Computing Machinery, New York, NY, USA, 2025 , p. 1 - 9 . URL: https://doi.org/10.1145/3704289. 3704293. doi: 10 .1145/3704289.3704293.

[2] K. D. Wang , Z. Wu , L. T. II , C. Wieman , S. Salehi , N. Haber , Scafold or crutch? examining college students' use and views of generative AI tools for stem education , 2024 . URL: https: //arxiv.org/abs/2412.02653. arXiv: 2412 . 02653 .

[3] R. Abdelghani , H. Sauzéon , P.-Y. Oudeyer, Generative AI in the classroom: Can students remain active learners ?, 2023 . URL: https://arxiv.org/abs/2310.03192. arXiv: 2310 . 03192 .

[4] M. Bobula , Generative artificial intelligence (AI) in higher education: a comprehensive review of challenges, opportunities, and implications , Journal of Learning Development in Higher Education ( 2024 ). URL: https://journal.aldinhe.ac.uk/index.php/jldhe/article/view/1137. doi: 10 . 47408/jldhe.vi30. 1137 .

[5] N. J. Francis , S. Jones , D. P. Smith , Generative AI in higher education: Balancing innovation and integrity , British Journal of Biomedical Science Volume 81 - 2024 ( 2025 ). URL: https://www.frontierspartnerships.org/journals/british -journal-of-biomedical-science/articles/ 10 .3389/bjbs. 2024 . 14048 . doi: 10 .3389/bjbs. 2024 . 14048 .

[6] L. S. VYGOTSKY , Mind in Society: Development of Higher Psychological Processes, Harvard University Press, 1978 . URL: http://www.jstor.org/stable/j.ctvjf9vz4.

[7] B. R. Belland , Instructional scafolding in STEM education: Strategies and eficacy evidence, Springer Nature, 2017 .

[8] V. Švábenský , J. Vykopal , P. Čeleda , What are cybersecurity education papers about? a systematic literature review of sigcse and iticse conferences , in: Proceedings of the 51st ACM Technical Symposium on Computer Science Education, SIGCSE '20 , Association for Computing Machinery, New York, NY, USA, 2020 , p. 2 - 8 . doi: 10 .1145/3328778.3366816.

[9] I. Kuzminykh , B. Ghita , H. Xiao , M. Yevdokymenko , O. Yeremenko , Investigating Threshold Concept and Troublesome Knowledge in Cyber Security, 2021 1st Conference on Online Teaching for Mobile Education , OT4ME 2021 , Institute of Electrical and Electronics Engineers Inc ., United States , 2021 , pp. 26 - 30 . doi: 10 .1109/OT4ME53559. 2021 . 9638889 , publisher Copyright : © 2021 IEEE.; 1st Conference on Online Teaching for Mobile Education , OT4ME 2021 ; Conference date: 22 - 11 -2021 Through 25- 11 - 2021 .

[10] M. Lifiton , B. E. Sheese , J. Savelka , P. Denny , Codehelp: Using large language models with guardrails for scalable support in programming classes , in: Proceedings of the 23rd Koli Calling International Conference on Computing Education Research , Koli Calling ' 23 , Association for Computing Machinery, New York, NY, USA, 2024 . URL: https://doi.org/10.1145/3631802.3631830. doi: 10 .1145/3631802.3631830.

[11] R. Liu , C. Zenke , C. Liu , A. Holmes , P. Thornton , D. J. Malan , Teaching cs50 with AI: Leveraging generative artificial intelligence in computer science education , in: Proceedings of the 55th ACM Technical Symposium on Computer Science Education V. 1 , SIGCSE 2024 , Association for Computing Machinery , New York, NY, USA, 2024 , p. 750 - 756 . URL: https://doi.org/10.1145/3626252. 3630938. doi: 10 .1145/3626252.3630938.

[12] M. Liu , F. M'Hiri, Beyond traditional teaching: Large language models as simulated teaching assistants in computer science , in: Proceedings of the 55th ACM Technical Symposium on Computer Science Education V. 1 , SIGCSE 2024 , Association for Computing Machinery , New York,