Undergraduate computing curricula increasingly integrate security across courses, yet little is known about whether security knowledge acquired in systems courses transfers spontaneously to downstream software engineering practice. Transfer of learning theory suggests that spontaneous transfer, applying knowledge without explicit prompting, rarely occurs, but coordinated cross-course instruction may create conditions that improve its likelihood. This study investigates whether students who completed a coordinated security intervention spanning concurrent Operating Systems and Database Systems courses spontaneously apply security concepts when completing software engineering design tasks that warrant but do not prompt for security considerations. We conducted a within-subjects longitudinal observational study with a cohort of undergraduate students at a U.S. federal service academy. Students had previously completed a coordinated security intervention addressing four bridge domains: authentication, access control, auditing, and encryption. In the subsequent Software Engineering course, we embedded transfer tasks across Weeks 12 through 15 in regular coursework, each targeting a specific security domain. Security instruction was deliberately placed at Week 16 to maximize the pre-instruction observation window. Data sources included a retention assessment administered at semester start, rubric-scored design rationale documents, and an exit survey capturing perceived cross-course connections. Results show that the cohort retained recognition-level security knowledge and applied it at depth when design prompts cued security domains. When prompts cued other concerns, the same cohort did not apply security reasoning spontaneously, even when the artifact under design provided clear opportunities. Auditing was the least transferred domain across all instruments. These findings suggest that cross-course coordination alone may not produce spontaneous activation in downstream courses without additional scaffolding.

Mohamed Elwakil is an assistant professor of cyber systems at the Department of Electrical Engineering and Computing of the Coast Guard Academy. Dr. Elwakil’s teaching experience spans fifteen years of teaching computer science, information technology, and information systems courses at seven universities and colleges in four countries. Besides mentoring senior projects and advising MSc. theses, he has taught a wide range of undergraduate and graduate courses using different modalities such as face-to-face, distance learning, and wide-area classroom.

He earned a Ph.D. in Computer Science from Western Michigan University, MS, and BS in Information Systems from Cairo University in 2011, 2005, and 2000, respectively.

Dr. Elwakil’s research focuses on developing formal methods and supporting tools to aid computer software modeling, analysis, and debugging. In particular, he worked on deterministic replay and trace-based predictive analysis of message-passing concurrent programs. His work appeared in conferences/workshops such as ATVA, ACT, EASE, QDB, and PADTAD and in journals such as ACM TODAES. In 2010, he received the PADTAD workshop best paper award. In addition, he worked on projects supported by grants from the NSF and the ONR during his doctoral research, which Dr. Zijiang Yang supervised. In 2015/2016, Dr. Elwakil was a postdoctoral researcher at Innopolis University, Innopolis, Russia, where he worked with Dr. Bertrand Meyer on static deadlock prediction in object-oriented applications.