"A lot of people look at how organizations and big companies deal with cybersecurity and compliance behaviors. But technology is everywhere, in every household, and in every aspect of our lives, so it’s also important to study how cybersecurity plays out there," says Yang.

Cybersecurity within families

Yang studies cybersecurity and online safety from an information systems perspective, with particular attention to how people and families adapt their behaviors as technologies evolve. Through her work, she is helping the business community and families understand present and emerging cybersecurity risks.

At the center of Yang’s research is technology adaptation—how technology is used and how that can change over time and in different circumstances.

Article continues below

In a recent paper, “Rethinking Cybersecurity Behavior Beyond Compliance: Evidence from Distributed Governance in Household,” published in the International Journal of Information Management, Yang and her colleagues looked at how the dynamic between parents and children affects cybersecurity and cyberhygiene in the home. The paper also argued that households provide an empirical context to examine distributed cybersecurity responsibility.

Yang looked at the behavior of families with children in two separate age groups, ages 8 to 11 and ages 12 to 16. Parents were at first quite strict with the younger children, but parents often let the older children have a high level of freedom, believing the children were more tech savvy.

This negotiated authority can then undermine sustained cybersecurity behaviors.

Another finding from the households was security fatigue, as parents often had many things going on in their lives and had trouble keeping up with cybersecurity.

“For instance, parents may set up their children’s Chromebook and internet settings in the beginning, but they don’t follow up later and keep the settings up to date,” Yang says. “The business implications are that employers can likewise get cybersecurity fatigue and let their guard down.”

Evaluating data and AI

As a teacher, Yang brings the latest information systems research and findings into the classroom, helping students understand the subtleties of the technological tools they will work with as executives. In her applied data mining and artificial intelligence course, which is required in the MS in Business Analytics, Yang probes the value and provenance of data, and the utility of AI in different applications.

Badamtsetseg Dash-Ulzii (MSF ’26), an entrepreneur, found that Yang’s course challenged her presumptions.

“One of the most important things I learned is that data mining is both technical and interpretive,” she says. “The class taught me how to build models, but also how to question what a model might be missing and whether its results make sense in the real world.”

In the class, Yang also challenges her students to think critically about AI tools. She created a model where students pitted their own analytical skills using off-the-shelf software against AI.

Dash-Ulzii created a final project examining heart disease.

"I was surprised that the simpler logistic regression model performed slightly better than the AI neural network—a reminder that a more complex model is not automatically the better choice," she said.

For Yang, this kind of lightbulb moment is exactly the outcome she wants. 
 
“These are graduate students, and I don’t want to force my ideas on them,” she says. “I give them challenging problems, and they analyze and think through them on their own.”