Cybersecurity - and in particular secure communication - is a topic that is, to varying degrees, a part of many modern computer science (CS) curricula. Also, students encounter it as a phenomenon of their everyday lives, e.g. when using messengers that advertise encrypted communication. They will thus in most cases have preconceptions about what encrypted communication means that they will bring into the classroom. As in many cases, we expect these conceptions to be incomplete or even inappropriate.

Knowing the extent and limitations of students' prior ideas informs lessons planning and, when addressed properly, fosters both learning and conceptual change. Therefore, we present the results of a mixed-methods investigation into the conception of secure messaging held by both K-12 students and pre-service teachers. We inductively coded written and drawn responses to a situated assessment administered as a questionnaire and, after refining the codesystem, tried to identify different types of conceptions by clustering the responses. Our results indicate that students first and foremost lack a clear understanding of networked communication that may subsequently prevent them from forming correct mental models about cybersecurity.

As cybersecurity is a topic that is usually seen as part of a "digital competence" - and as such may also be taught by subjects other than CS - we discuss how our findings might inform a cross-subject approach to teaching it.