What motivates users to adopt cybersecurity practices? A survey experiment assessing protection motivation theory

• Published date: 01 November 2023
• Author: Cassandra E. Dodge,Nathan Fisk,George W. Burruss,Richard K. Moule,Chae M. Jaynes
• Date: 01 November 2023
• DOI: http://doi.org/10.1111/1745-9133.12641

DOI: ./- .

SPECIAL ISSUE ARTICLE

CYBERCRIME AND CYBERSECURITY

What motivates users to adopt cybersecurity

practices? A survey experiment assessing

protection motivation theory

Cassandra E. Dodge1Nathan Fisk2George W. Burruss3

Richard K. Moule Jr.3Chae M. Jaynes3

Department of Criminology and

Criminal Justice, Georgia Southern

University, Statesboro, Georgia, USA

College of Education, University of

South Florida, Tampa, Florida, USA

Department of Criminology, University

of South Florida, Tampa, Florida, USA

Correspondence

George W.Burruss, Department of

Criminology, University of South Florida,

 E. Fowler Avenue,SOC , Tampa,

FL , USA.

Email: gburruss@usf.edu

Abstract

Research Summary: A×× fully crossed factorial

experiment is used to examine the linkages between key

dimensions of protection motivation theory (PMT; per-

ceived severity of risk, vulnerability to risk, and response

costs) and the intentions to adopt information tech-

nology (IT) cybersecurity recommendations after being

informed of degrees of risk in the vignettes. Data in this

study consist of a nationwide sample of  American

adults. Results from a series of fractional logistic regres-

sions indicate support for many of the core mechanisms

within PMT. Seventy percent of respondents indicated

they were likely to follow IT recommendations to mit-

igate a cyber threat. Self-efficacy and response costs

affected intentions to do so.

Policy Implications: The study’s findings have impor-

tant implications for improving cybersecurity and reduc-

ing vulnerabilities to cyber threats. Current training

programs need more effective communication strate-

gies and engagement tools. Perceptions of users as

security threats rather than potential contributors hin-

der progress in the ability of organizations to improve

cybersecurity. Collaborative, user-centered approaches

can enhance users’ self-efficacy and improve cyber-

security by aligning user and IT professional needs

and capabilities. Strategies like gamified simulations

Criminology & Public Policy. ;:–.©  American Society of Criminology.849wileyonlinelibrary.com/journal/capp

850 DODGE  .

and tailored interventions can create a more security-

focused culture and encourage user participation in

defending an organization. Recognizing individual dif-

ferences among users and further examining personal

characteristics that may impact user interactions with

technology and cybersecurity interventions is crucial.

Overall, more personalized, adaptable approaches to

cybersecurity policies and technical solutions, account-

ing for diverse user needs and characteristics, should be

a priority for improving cybersecurity practices.

KEYWORDS

cybersecurity, experimental vignette design, information security,

protection motivation theory

Most aspects of modern life, including shopping, banking, education, dating, and entertainment,

now occur online (e.g., Faverio & Anderson, ; Pew Research Center, ;Sumter&Van-

denbosch, ). The expansion of Internet use and online interactions has coincided with the

growth of cybercrime. In , the Internet Crime Complaint Center (IC, ) received over

, reports of email compromise, data breaches, ransomware, and malware, accounting for

over $. billion in financial losses. This figure underrepresents the severity of cybercrime and

its impact on individuals and organizations, as only %–% of cybercrime victims reported

losses to the IC (Baker, ). The coronavirus disease (COVID-) pandemic increased the

opportunity for cybercrime as telecommuting surged, and scammers exploited public concerns

about the virus (Federal Bureau of Investigation (FBI), ). Comparedto pre-pandemic levels,

daily complaints to the IC quadrupled by April  (England, ).

Much cybercrime victimization results from human susceptibility to social engineering rather

than technological vulnerabilities (CybSafe, ). In , CybSafe, a cybersecurity firm, ana-

lyzed  incident reports from the U.K.’s Information Commissioner’s Office; % of those

incidents were attributed to end-user error.Verizon’s Data Breach Investigations Report sim-

ilarly indicated that two-thirds of breaches came from credential thefts, social attacks, and user

error (Verizon, ). Many users fail to implement basic cybersecurity protections despiteorga-

nizations’ extensive efforts to train them to recognize cybersecurity threats (Ng et al., ). These

efforts are coupled with broad, negative perceptions of cybersecurity education and training pro-

grams(Burnsetal.,; Haney & Lutters, ; Reeves et al., ). As such, understanding

the factors that motivate users to engage in protective behaviors remains a significant concern to

academics and practitioners alike.

One way of understanding the factors influencing engagement in protective behavior is

through protection motivation theory (PMT; Floyd et al., ; Rogers, , Maddux & Rogers,

). PMT argues that people naturally seek to protect themselves. Nevertheless, the motivation

to engage in protective action can be influenced by several factors, such as the severity of the

threat, the perceived likelihood of the threat occurring, and the individual’s confidence in

their ability to protect themselves. Further, some factors may reduce motivation, particularly

when potential protections are seen as costly. Research has applied PMT to information or