Exploring the Frontiers of Cybersecurity Behavior: A Systematic Review of Studies and Theories

Abstract

Cybersecurity procedures and policies are prevalent countermeasures for protecting organizations from cybercrimes and security incidents. Without considering human behaviors, implementing these countermeasures will remain useless. Cybersecurity behavior has gained much attention in recent years. However, a systematic review that provides extensive insights into cybersecurity behavior through different technologies and services and covers various directions in large-scale research remains lacking. Therefore, this study retrieved and analyzed 2210 articles published on cybersecurity behavior. The retrieved articles were then thoroughly examined to meet the inclusion and exclusion criteria, in which 39 studies published between 2012 and 2021 were ultimately picked for further in-depth analysis. The main findings showed that the protection motivation theory (PMT) dominated the list of theories and models examining cybersecurity behavior. Cybersecurity behavior and intention behavior counted for the highest purpose for most studies, with fewer studies focusing on cybersecurity awareness and compliance behavior. Most examined studies were conducted in individualistic contexts with limited exposure to collectivistic societies. A total of 56% of the analyzed studies focused on the organizational level, indicating that the individual level is still in its infancy stage. To address the research gaps in cybersecurity behavior at the individual level, this review proposes a number of research agendas that can be considered in future research. This review is believed to improve our understanding by revealing the full potential of cybersecurity behavior and opening the door for further research opportunities.

1. Introduction

The Internet and computers are working together to connect people worldwide [1]. Hence, cybersecurity became a must-have framework. As a result, all communications and information sharing will remain safe. Cybersecurity covers the Internet, computer networks, and computing systems. Technological and organizational elements of cybercrime, such as databases, software administration, and computer programming, are essential for individuals’ understanding [2,3]. Organizations and individuals utilize cybersecurity to prevent illegal access to data centers and computerized systems. A robust cybersecurity strategy is typically provided through solid security procedures.

Cybersecurity threats come in three forms: cybercrimes, cyberattacks, and cyberterrorism. Cybercrimes refer to crimes committed through the Internet and other digital means and more conventional crimes enabled or sustained by these means [4]. Cyberattacks refer to cyberspace-based assaults aimed at disrupting, disabling, damaging, or maliciously managing a computer environment/infrastructure, ruining data integrity, or stealing sensitive information [5]. Cyberterrorism involves the disruption of crucial national infrastructure, encompassing transportation, energy, and governmental operations, through employing computer network tools to coerce or intimidate a government or civilian population [6]. These threats result from malware, phishing, social engineering, SQL injection, man-in-the-middle attack, and distributed denial-of-service attacks [7,8]. Additionally, malicious efforts to harm or destroy computing systems or networks are included in the definition of cybersecurity [9,10]. Hence, cybersecurity attacks and threats can affect various industries, such as healthcare, manufacturing, financial services, government agencies, and education [11]. Cybersecurity must consider technological, regulatory, legal, ethical, and social factors.

Individuals’ behavior toward cybersecurity is a concern for both end-users and organizations. This is because most cybersecurity incidents are caused by human mistakes or inadequate knowledge [12,13,14]. Therefore, promoting cybersecurity behavior is essential to protecting organizations and individuals from security threats [15]. Cybersecurity behavior refers to the users’ actions and reactions in the cyber realm [16]. One major limitation is the lack of a clear definition and understanding of how individuals differ in their awareness, knowledge, and cybersecurity behavior when confronted with adaptable cyber hazards [17].

The literature indicates that cybersecurity in general, particularly cybersecurity behavior, plays a critical role in supporting the application of many information system (IS) theories and models. By analyzing cybersecurity behavior research, it has been observed that existing review studies have overlooked studying cybersecurity behavior from the lens of IS theories and models. Psychologists employ various theories to explain and predict human behavior in preparation for cybersecurity programs. For instance, cybersecurity professionals may rely on the protection motivation theory (PMT), which mainly explains the impact of threat perception and self-efficacy on security behaviors or attitudes among the population [18]. In addition, the theory of planned behavior (TPB) indicates that behavioral intention is influenced by subjective norms and attitudes [19]. These theories and models help to decide which behavioral elements are most predictive to be included in the prevention plan or intervention.

While understanding cybersecurity behavior mainly relies on several technical, social, and human factors that can be identified through different IS theories and models, the existing research ignores reviewing this research topic from the perspective of those theories and models. Moreover, most of the current review studies have concentrated on the technical aspects of cybersecurity, with little attention paid to human behaviors. For example, Ref. [20] analyzed the progress of information security awareness (ISA) and provided the current state of the art in the content development of ISA in both the private and public sectors by understanding the different ISA content development methodologies and variables that impact employees’ ISA. Additionally, Ref. [21] comprehended the current level of cybersecurity education and its associated research. Moreover, Ref. [22] investigated which qualitative research methodologies have been used the most to study different aspects of cybersecurity.

Therefore, this review systematically examines and synthesizes cybersecurity behavior studies from the perspective of IS theories and models. This is because these theories and models provide a better understanding of user behavior toward a particular technology or service by identifying the underlying drivers and barriers [23]. Identifying the drivers and barriers would improve cybersecurity behavior by allowing researchers to investigate the technical, social, and cultural aspects and understand the correlation between those factors and users’ willingness to improve their cybersecurity behavior when using any technology or service. The review also intends to identify the common research themes, external factors, dominant technologies and services, main research methods, active countries, and participants. Analyzing common research themes in cybersecurity behavior is crucial because it helps to identify the most widely studied and significant areas of this field. This can guide future research efforts, ensuring that resources focus on the most critical and impactful areas. Additionally, understanding external factors that affect cybersecurity behavior is crucial because these factors can influence an individual’s behavior regarding how they approach and engage with cybersecurity issues [24]. Moreover, researchers and organizations can better understand the root causes of cybersecurity behavior and develop strategies to encourage positive behavior and minimize risk.

Further, being aware of which technologies are prevalent in the field helps researchers and practitioners understand the current landscape and identify areas for further development or improvement [25]. Moreover, analyzing research methods can inform future studies by highlighting areas where new and different techniques may be needed to address gaps or limitations in the current body of knowledge [26]. In addition, knowing which countries are active in this area of research can help identify regional trends and disparities in knowledge, resources, and expertise. It also provides a sense of the global reach of cybersecurity behavior research and highlights areas where additional research may be needed. Furthermore, analyzing the participants is crucial because the demographic characteristics and behavior of the participants can significantly impact the results and conclusions of the study. Understanding the background, experience, and perspectives of the participants can help to contextualize the findings and provide insights into the generalizability of the results. Additionally, identifying the type of participants, such as individuals, organizations, or communities, can highlight the scope and focus of the study and shed light on the potential biases and limitations in the research. Consequently, this review study intends to address the following research questions:

RQ1: What are the prominent IS theories and models in the context of cybersecurity behavior?

RQ2: What are the common themes in the articles under analysis?

RQ3: What are the common external factors affecting cybersecurity behavior?

RQ4: What is the relationship between the cybersecurity research themes and external factors?

RQ5: What are the dominant technologies and services used in cybersecurity behavior?

RQ6: What are the leading research methods used?

RQ7: What are the active countries in cybersecurity behavior research?

RQ8: What is the relationship between the cybersecurity research themes and study regions?

RQ9: Who are the participants in cybersecurity behavior research?

Following this section, Section 2 provides a background on cybersecurity behavior and previous reviews on cybersecurity. Section 3 presents the review methodology, in which inclusion and exclusion criteria, data sources and search strategies, and data coding and analysis, are discussed. Section 4 shows the results by responding to all the formulated research questions, while Section 5 discusses these results in detail. Section 6 concludes the review and provides a number of research gaps that require further examination.

2. Background

2.1. Cybersecurity Behavior

The continued adoption of information technologies has been accompanied by the need to enhance systems and data security [27]. Effective cybersecurity programs consider the human element the weakest link in cybersecurity [28,29]. Implementing administrative safeguards focusing on behavior is imperative to address people-related vulnerabilities. Cybersecurity behavior refers to the individual practices that attenuate or minimize the risk and likelihood of cyber threats. According to [30], focusing on social and behavioral issues can help deal with cybersecurity. As such, identifying behaviors that can either enhance or reduce the level of security is an essential consideration in creating and implementing a cybersecurity strategy [17]. More importantly, fostering a solid cybersecurity culture in which every member of the organization behaves appropriately reduces people-related cyber vulnerabilities [31]. The idea is to discourage negative behaviors while encouraging positive ones.

Various examples of negative security behaviors should be discouraged in organizational settings. One such behavior is visiting unsafe websites [12]. In workplace environments, it is common for employees to visit potentially dangerous websites. Such websites contain exploits targeting the organization’s systems [32]. Another negative behavior relates to falling victim to social engineering. Social engineering techniques are the most utilized avenues for infecting and intruding into computer networks [33]. These techniques leverage human weaknesses such as greed, fear, negligence, and ignorance to obtain sensitive information from people. For instance, an employee could be tricked into opening a phishing link to win a present. Employees can also fail to back up data or secure their portable devices. For example, the loss of a smartphone containing company data can result in a major data breach.

2.2. Related Work

Lately, the review studies to investigate different domains in the context of cybersecurity behavior have increased.

Table 1. Previous review studies on cybersecurity.

Source	Review Type	Number of Reviewed Studies	Domain	Aim
[36]	Narrative review	1249	Healthcare	Understanding and identifying the vulnerabilities and cybersecurity threats and their effect on healthcare.
[43]	Systematic review	35	Software Engineering	Understanding user differences related to good or bad cyber hygiene behavior, and what users can do to support good cyber hygiene.
[37]	Systematic review	70	Healthcare	Uncovering the prevalent factors affecting a healthcare organization’s cybersecurity posture due to a lack of awareness of the cyber threat to healthcare, identifying healthcare organizations’ cyber defense strategy through studying human behavior, and examining the organization’s risk assessment approach and cybersecurity policies that have been enacted.
[41]	Systematic review	27	Social Science	Investigating human factors in cybersecurity, which are subjective and often complex.
[34]	Taxonomy review	56	Global	Reviewing the existing literature on cybersecurity awareness among young people.
[39]	Systematic review	21	Global	Consolidating a paradigm that examines the influence of temporal constraints on human cybersecurity behaviors.
[40]	Systematic review	60	Social sciences	Understanding the underlying human behavioral factors influencing cyber-information security compliance from theoretical perspectives.
[38]	Systematic review	107	Social sciences	Investigating trends in cybersecurity behavioral research by synthesizing secondary literature.
[35]	Systematic review	43	Computer science	Reviewing research on the recommended cybersecurity practices for social media users from the user’s point of view.
[42]	Systematic review	33	Computer science	Identifying strategies to address human factors in cybersecurity.
[44]	Systematic review	32	Computer science	Identifying information security policy compliance behavior factors, models, and theories.
[45]	Meta-analysis	9	Social science-es	Investigating the impact of cyber optimistic bias on an individual’s security risk perception and its subsequent influence on their decision-making process.
[46]	Systematic review	54	Computer science	Analyzing teenagers’ behavior and its potential susceptibility to exploitation on social media platforms.
[47]	Systematic review	26	Social science	Evaluating common approaches utilized in examining cybersecurity-related behavior.
This Study	Systematic review	39	Global	Conducting a systematic review of cybersecurity behavior from the perspective of IS theories and models to examine the main research themes, influential factors, dominant technologies and services, research methods, active countries, and the interrelationships among these characteristics.

lists the previous reviews on cybersecurity-related literature. It is evident that earlier reviews have focused on specific aims, including cybersecurity awareness [34,35], cybersecurity vulnerability and risk assessment policies and strategies [36,37,38], and determinants affecting cybersecurity behavior, including human factors [37,39,40,41,42,43,44].

Although numerous review studies have been conducted in recent years, providing scholars with valuable information on cybersecurity behavior. It has been noticed that research has neglected the review of cybersecurity behavior from the lenses of IS theories and models. This issue was the driving force behind the decision to conduct this systematic review.

3. Method

This review is based on the results of studies published in digital journals and databases to debate and empirically analyze IS theories and models in cybersecurity behavior. A literature review is crucial to every scientific study [48]. It lays the groundwork for information accumulation, promoting the development and refinement of ideas, filling gaps in existing research, and discovering places past research has missed [49]. A systematic review assists researchers in gaining a deeper understanding of the research topic under investigation [50,51]. Systematic reviews are distinct from traditional or narrative reviews since they are more thorough and provide a well-defined methodology for reviewing a particular topic [52]. This study intends to comprehensively review past studies on cybersecurity behavior involving IS theories and models, focusing on the common research themes, external factors, dominant technologies and services, main research methods, active countries, participants, and the interrelationships among these characteristics. The systematic review is divided into three stages: determining inclusion and exclusion criteria, data sources and search methods, and data coding and analysis.

3.1. Inclusion and Exclusion Criteria

The inclusion/exclusion criteria filter out the collected data and determine which papers to include or exclude, as shown in

Table 2. Inclusion and exclusion criteria.

Inclusion Criteria	Exclusion Criteria
Addresses cybersecurity behavior.	Behavior is covered but not cybersecurity.
Discusses a theoretical model.	Cybersecurity behavior is described without presenting a theoretical model.
Should be written in English.	Articles written in a language other than English.

. The inclusion criteria cover articles that focus on IS theories and models in cybersecurity behavior and must be written in English. On the other hand, the excluded studies were articles written in languages other than English, did not focus on cybersecurity behavior, and did not involve using theories and models.

3.2. Data Sources and Search Strategies

The data were collected through different online databases, such as Emerald, Springer, Taylor, and Francis, IEEE Explore, SAGE, Science Direct, and Google Scholar. The studies were searched in these databases between June–August of 2021. The retrieved studies were restricted to journal articles and conference proceedings. The search string for the studies was ((“cybersecurity” OR “cyber security”) AND (“behavior” OR “behaviour”)). The selection of relevant keywords is critical since it influences the retrieval of relevant articles from databases [53].

The search results retrieved 2210 articles by using the mentioned search string. A total of 227 were found as duplicate articles, and thus, were discarded. The remaining articles become 1983. The inclusion and exclusion criteria were applied strictly for the remaining articles. The entire review process followed the preferred reporting items for systematic reviews and meta-analysis (PRISMA), as depicted in Figure 1. The first and second authors of this research independently analyzed each of the gathered papers to conduct the analysis. The two authors reconciled their discrepancies in analyzing the studies through conversation and further examination of the contested papers. The total number of articles consulted for this study is 39.

3.3. Data Coding and Analysis

The data extracted from the included articles involved different characteristics, such as (a) publication year, (b) theoretical model, (c) independent variables, (d) dependent variables, (e) technologies or services, (f) method, (g) participants, and (h) country. These characteristics correspond to the research questions of this systematic review.

4. Results

The outcomes of this systematic review are provided based on the research questions through analyzing the included studies (N = 39).

Table A1. List of analyzed studies.

#	Source	Year	Theoretical Model	Independent Variables	Dependent Variables	Technology/Service	Methodology	Participants	Country
S01	[83]	2021	Technology Threat Avoidance Theory	“Perceived susceptibility”, “Perceived severity”, “Perceived effectiveness”, “Perceived cost”, and “Self-efficacy”	“Avoidance Motivation” and “Avoidance Behavior”	Internet threats	Quantitative (survey)	Organizational employees	USA
S02	[114]	2019	Social Cognitive Theory	“Information security policy”, “Subjective norm”, “Perceived inconvenience”, “Self-efficacy”, “Outcome expectation”, and “Information security monitoring”	Assurance Behavior	Information system	Mixed method (survey and focus group)	Organizational employees	Malaysia
S03	[91]	2019	Coping Theory	“Perceived externality” and “Triage”	“Procrastination”, “Psychological detachment”, and “Cybersecurity Behavior”	Information system	Quantitative (survey)	Organizational employees	China
S04	[88]	2020	Job Demands-Resources Model	“Continuity demand”, “Mandatory demand”, “Trust enhancement”, and “Professional development”	“Perseverance of effort” and “Intention Behavior”	Information system	Quantitative (survey)	Organizational employees	Not Specified
S05	[100]	2021	Compliance Theory and Control Theory	“Reward expectancy”, “Punishment expectancy”, and “Organizational commitment”	“Compliance Behavior”	Not Specified	Quantitative (survey)	Organizational employees	China
S06	[87]	2021	Decision-making Theory	“Punishment likelihood”, “Reward likelihood”, and “Neutralization scenarios”	“Intention Behavior”	Information system	Quantitative (survey)	Students	USA
S07	[115]	2018	Innovation Diffusion Theory	“Compatibility”, “Ease of use”, “images”, “intention”, “Relative advantage”, “Results demonstrability”, “Trialability”, “Visibility”, and “Voluntariness”	“Intention Behavior”	Internet security software	Quantitative (survey)	Students	Malaysia
S08	[61]	2019	Theory of Planned Behavior	“Perceived price level”, “Information security awareness”, “Subjective norms”, and “Perceived behavioral control”	“Attitude” and “Intention Behavior”	Anti-malware software	Quantitative (survey)	Students	Malaysia
S09	[70]	2017	Protection Motivation Theory and Threat Avoidance Motivation	“Attitude to personal data”, “Perceived risk”, and “Perceived ease of use”	“Perceived usefulness”, “Intention Behavior”, and “Cybersecurity Behavior”	Social networking sites	Mixed method (survey and focus group)	Consumers	Not Specified
S10	[55]	2019	Protection Motivation Theory and Threat Avoidance Motivation	“Self-efficacy”, “Security breach concern level”, “Perceived risk”, “Domain knowledge”, “System characteristics”, “Perceived ease of use”, “Perceived usefulness”, “Value for personalization” and “Attitude to personal data”	“Intention Behavior”, “Cybersecurity Behavior”, “Usage Behavior”, “Value for personalization”, and “Attitude”	Web browser	Quantitative (survey)	Students and academics	China and U.K.
S11	[54]	2020	Technology Threat Avoidance Theory	“Fear”, “Safeguard effectiveness”, “Safeguard cost”, “Self-efficacy”, “Perceived severity”, “Perceived susceptibility”, and “Decision-making style”	“Avoidance Motivation” and “Avoidance Behavior”	Game	Quantitative (survey)	Students	Australia
S12	[89]	2020	Unified Theory of Acceptance and Usage of Technology	“Performance expectancy”, “Effort expectancy”, “Facilitating conditions”, “Hedonic motivation”, “Social influence”, “Habit”, and “Gamification feature”	“Intention Behavior” and “Usage Behavior”	Game	Quantitative (survey)	Students	Australia
S13	[80]	2019	Protection Motivation Theory	“Perceived vulnerability”, “Perceived severity”, “Perceived self-efficacy”, “Perceived response efficacy”, “Perceived costs”, “Organizational determinants”, “Social determinants”, and “Personal determinants”	“Cybersecurity Awareness” and “Cybersecurity Behavior”	Computer	Quantitative (survey)	Organizational employees	Switzerland
S14	[101]	2020	Knowledge, Attitude, and Behavior Model	“Greater employment level”, “Grater perception of personal risk”, “Grater dread and unfamiliarity of InfoSec risks”, and “Greater organizational commitment”	“Cybersecurity Awareness”	Internet of Things	Quantitative (survey)	Organizational employees	Australia
S15	[116]	2019	Theory of Social Preferences	“Cyber attack experience”, “Perceived cybersecurity risk”, “Perceived cybersecurity value”, and “Social preferences”	“Cooperate Intention”	Ecosystem	Quantitative (survey)	Organizational employees	Norway
S16	[117]	2020	Theory of Planned Behavior and Threat Avoidance Motivation	“Subjective norm”, “Attitude”, “Hardness”, “Habit”, “Perceived severity”, and “Perceived vulnerability”	“Compliance Intention”	Not Specified	Quantitative (survey)	Organizational employees	USA
S17	[60]	2020	Protection Motivation Theory, Theory of Planned Behavior, and General Deterrence Theory	“Perceived vulnerability”, “Perceived severity”, “Rewards”, “Perceived shame”, “Response efficacy”, “Self-efficacy”, “Response cost”, “Habit”, “Subjective norms”, “Procedural countermeasures”, “Preventive countermeasures”, and “Detective countermeasures”	“Intention Behavior”	E-mail	Quantitative (survey)	Organizational employees	New Zealand
S18	[92]	2020	Technology Threat Avoidance Theory and Protection Motivation Theory	“Security intention”, “Self-efficacy”, and “Psychological ownership”	“Cybersecurity Behavior”	Smartphone	Quantitative (Survey)	Organizational employees	Not Specified
S19	[90]	2021	Big Five Model	“Risk-taking” and “Decision-making styles”	“Intention Behavior”	Game	Quantitative (Survey)	Students and academics	Iran
S20	[118]	2014	Protection Motivation Theory	“Explicit cybersecurity policy”	“Peer Behavior” and “Cybersecurity Behavior”	Not Specified	Quantitative (Survey)	Organizational employees	USA
S21	[119]	2017	Protection Motivation Theory	“Computer skills”, “Information seeking skills”, “Experience with cybersecurity practice”, “Perceived susceptibility”, “Perceived severity”, “Self-efficacy”, “Perceived barriers”, “Perceived benefits”, “Response efficacy”, “Cues to action”, and “Peer behavior”	“Cybersecurity Behavior”	Not Specified	Quantitative (Survey)	Organizational employees	Not Specified
S22	[97]	2019	6-T Internet attitude model	“Social networking sites”, “Communication”, “Video-watching”, “Game-playing”, “Photo-sharing”, “Academy”, “Recreational info. searching”, “Friends making”, “Transaction”, “Individual factors”, and “Parental factors”	“Usage Behavior”	Smartphone	Quantitative (Survey)	Students and parents	Taiwan
S23	[12]	2021	Protection Motivation Theory	“Situational support”, “Self-efficacy”, and “Response efficacy”	“Behavioral comprehensiveness” and “Behavioral habits”	Not Specified	Quantitative (Survey)	Students	China
S24	[71]	2021	Theory of Planned Behavior	“Agreeableness”, “Conscientiousness”, “Extraversion”, “Neuroticism”, and “Openness”	“Intention Behavior” and “Cybersecurity Awareness”	Social networking sites	Quantitative (Survey)	Consumers	Not Specified
S25	[81]	2021	Protection Motivation Theory, Theory of Reasoned Action, and General Deterrence Theory	“National smartphone cybersecurity policies”, “Response cost”, “Top management participation”, “Technology (smartphone-specific) security threats”, “Attitude”, “Self-efficacy”, “Subjective norms”, “Perceived risk vulnerability”, “Perceived response efficacy”, “Perceived severity of sanction”, and “Perceived certainty of sanction”	“Intention Behavior” and “Compliance Behavior”	Smartphone	Quantitative (Survey)	Organizational employees	U.K., USA, and UAE
S26	[64]	2019	Protection Motivation Theory	“Peer behavior”, “Cues to action”, “Prior experience with information security practice”, “Perceived severity”, “Perceived vulnerability”, “Perceived barriers”, “Response efficacy”, and “Self-efficacy”	“Cybersecurity Behavior”	Not Specified	Quantitative (Survey)	Organizational employees	USA
S27	[94]	2019	Technology Threat Avoidance Theory and Regret Theory	“Anti-Phishing self-efficacy” and “Anticipated regret”	“Avoidance Motivation” and “Avoidance Behavior”	Smartphone	Quantitative (Survey)	Consumers	Not Specified
S28	[82]	2020	Protection Motivation Theory and General Deterrence Theory	“Self-efficacy”, “Perceived severity of sanction”, “Perceived risk vulnerability”, “Response cost”, “Perceived certainty of sanction”, “Severity of the adverse consequences”, “Response efficacy”, “Uncertainty avoidance”, “Power distance”, “Individualism vs. collection”, and “Masculinity vs. femininity”	“Intention Behavior”	Smartphone	Quantitative (Survey)	Organizational employees	USA and UAE
S29	[56]	2018	Protection Motivation Theory	“Severity”, “Susceptibility”, “Self-efficacy”, “Response efficacy”, “Response costs”, “Experience”, “Workplace information sensitivity appraisal”, “Responsibility”, “Psychological ownership”, and “Organisational citizenship behaviors”	“Intention Behavior”	Malware	Quantitative (Survey)	Organizational employees	Not Specified
S30	[99]	2020	Individual cybersecurity compliance behavior model and Donalds and Osei-Bryson model	“Dominant decision style”, “General security orientation”, “General security awareness”, “Dominant orientation”, and “Security self-efficacy”	“Compliance Behavior”	Not Specified	Quantitative (Survey)	Students and academics	Jamaica
S31	[120]	2021	Protection Motivation Theory	“Perceived severity”, “Perceived vulnerability”, “Perceived barriers”, “Response efficacy”, and “Security self-efficacy”	“Cybersecurity Behavior”	Not Specified	Quantitative (Survey)	Organizational employees	Saudi Arabia
S32	[58]	2020	Technology Threat Avoidance Theory	“Perceived susceptibility”, “Perceived severity”, “Perceived effectiveness”, “Perceived cost”, and “Self-efficacy”	“Avoidance Motivation”, “Avoidance Behavior”, and “Cybersecurity Behavior”	Not Specified	Quantitative (Survey)	Organizational employees	USA
S33	[93]	2017	Actor-network Theory	“Familiarity” and “Internet experience proxies”	“Cybersecurity Behavior”	Internet threats	Quantitative (Survey)	Students	U.K. and USA
S34	[72]	2020	Protection Motivation Theory and Affect heuristic model	“Affect”, “Perceived risk”, and “Perceived benefit”	“Cybersecurity Behavior”	Social networking sites	Quantitative (Survey)	Consumers	U.K.
S35	[63]	2019	Protection Motivation Theory and Health Belief Model	“Perceived vulnerability”, “Prior experience with computer security”, “Perceived severity”, “Security self-efficacy”, “Response efficacy”, “Cues to action”, “Peer behavior”, “Computer skills”, and “Familiarity with cyber threats”	“Cybersecurity Behavior”	Not Specified	Quantitative (Survey)	Students	Malaysia
S36	[59]	2016	Technology Threat Avoidance Theory	“Perceived susceptibility”, “Perceived severity”, “Perceived threat”, “Safeguard effectiveness”, “Safeguard cost”, and “Self-efficacy”	“Avoidance Motivation” and “Avoidance Behavior”	Malware	Quantitative (Survey)	Students	USA
S37	[84]	2019	Protection Motivation Theory and Health Belief Model	“Computer skills”, “Experience with cybersecurity practice”, “Perceived vulnerability”, “Perceived severity”, “Self-efficacy”, “Perceived barriers”, “Perceived benefits”, “Response efficacy”, “Cues to action”, and “Peer behavior”	“Cybersecurity Behavior”	Not Specified	Quantitative (Survey)	Organizational employees	USA
S38	[121]	2012	Protection Motivation Theory and General Deterrence Theory	“Threat severity”, “Threat vulnerability”, “Self-efficacy”, “Response efficacy”, “Response cost”, “Sanction severity”, “Sanction certainty”, “Agreeableness”, “Conscientiousness”, “Extraversion”, “Neuroticism”, and “Openness”	“Intention Behavior”	Not Specified	Quantitative (Survey)	Organizational employees	USA
S39	[98]	2021	Not Specified	“Human Intention and Perception”, “Perceived Trust and beliefs”, “Perceived e-mail security”, “Perceived Privacy”, and “Information Sharing”	“Usage Behavior”	E-mail	Quantitative (Survey)	Organizational employees	Japan, South Korea, India, Australia, Hong Kong, Taiwan, Singapore, New Zealand, Malaysia, Indonesia, and the Philippines

(Appendix A) shows the classification analysis of the analyzed research articles on cybersecurity behavior. Figure 2 depicts the distribution of the examined articles throughout the years they were published. These studies span the years 2012 to 2021. Most cybersecurity research articles were published in the last three years (2019, 2020, 2021), clearly showing the research community’s increasing interest in this research topic.

4.1. Prominent Theories and Models in Cybersecurity Behavior

Numerous research studies investigated cybersecurity behavior through different theories and models.

Table 3. Prominent theories and models in cybersecurity behavior.

Theories and Models	Frequency
Protection Motivation Theory	17
Technology Threat Avoidance Theory	6
General Deterrence Theory	4
Theory of Planned Behavior	4
Threat Avoidance Motivation	3
Health Belief Model	2
Control Theory	1
Theory of Reasoned Action	1
Decision-making Theory	1
Compliance Theory	1
Donalds and Osei-Bryson Model	1
Knowledge, Attitude, and Behavior Model	1
Actor-network Theory	1
Regret Theory	1
Affect Heuristic Model	1
Theory of Social Preferences	1
Big Five Model	1
Social Cognitive Theory	1
6-T Internet Attitude Model	1
Coping Theory	1
Job Demands-Resources Model	1
Unified Theory of Acceptance and Usage of Technology	1
Individual Cybersecurity Compliance Behavior Model	1
Innovation Diffusion Theory	1

illustrates the prominent theories and models used in understanding what impacts cybersecurity behavior. The protection motivation theory (PMT), with 17 studies, dominates the list of theories and models, followed by the technology threat avoidance theory (TTAT), with 6 studies. In addition, the theory of planned behavior (TPB) and the general deterrence theory (GDT) represent the third and fourth categories in the list with four studies each, followed by the threat avoidance motivation (TAM) (N = 3) and health belief model (HBM) (N = 2). However, the other theories and models appeared only once in the analyzed studies, as shown in Table 3.

Table 4. Strengths and limitations of prominent theories and models.

Theories/Models	Strengths	Limitations
Protection Motivation Theory (PMT)	PMT explains how people respond to fear appeals. It considers two elements related to protection motivation: threat appraisal and coping appraisal [54]. Cybersecurity behavior studies have shown that PMT effectively changes behavior [55].	PMT fails to consider environmental elements, which affect behavior. For example, it does not consider the effect of social norms. Additionally, it does not consider cognitive variables influencing decision making. For instance, it does not consider the role of experience in behavior [56]. PMT also lacks consideration of individual differences [18]. PMT assumes everyone responds to threats similarly, but this is not always true. This is because individuals have different perceptions of what is threatening, and their reactions may vary based on their past experiences, beliefs, and attitudes.
Technology Threat Avoidance Theory (TTAT)	TTAT adopts a broad perspective in explaining the users’ awareness of technology threats and their motivation to avoid them [57]. In addition to threat and coping appraisal, it considers elements related to coping. More importantly, it includes factors related to risk tolerance and social influence [58]. It has been found to be a valid framework for examining users’ cybersecurity behavior toward malware [59].	TTAT does not cover individual threat motivations adequately [58]. Individual characteristics, such as the propensity for risk and impulsivity, influence people’s actions. Its broad nature also makes implementing it in practical settings difficult. Additionally, TTAT focuses mainly on technical measures to prevent cyber threats and overlooks other critical aspects of cybersecurity, such as policy, governance, and organizational culture.
General Deterrence Theory (GDT)	GDT adopts a rational approach to deterring negative behavior by using countermeasures, such as sanctions and other disincentives [60]. Increasing the perception that offenders will be caught and punished can promote positive behavior.	GDT fails to consider that negative actions are often irrational. In addition to personal factors, other environmental variables can influence an individual to engage in harmful behavior [60]. Offenders might feel that they can get away by committing an offense. This is particularly common in cybersecurity, as attackers can remain anonymous. Similarly, if the sanction is minor, attackers can agree to bear the risk.
Theory of Planned Behavior (TPB)	TPB considers the role of subjective norms in influencing the initiation and maintenance of behavior [61]. It also considers the role of perceived behavioral control and attitudes in affecting the intention to use technology [62]. This theory has also been used to model behavior in cybersecurity [61].	While the TPB considers the availability of the resources needed to perform the required behavior [61], it fails to consider personal factors that influence motivation and intention. Although the theory considers normative influences, it fails to consider environmental factors. It posits that the decision-making process is linear, which might not be the case in all situations. The TPB assumes that attitudes and intentions are the primary determinants of behavior [19]. However, there may be a significant gap between individuals’ attitudes and actual behavior, particularly in examining cybersecurity behavior. Additionally, the TPB assumes that individuals have control over their behavior. However, in cybersecurity behavior, individuals may not have complete control over their actions due to other factors, such as technical constraints or external threats.
Threat Avoidance Motivation (TAM)	TAM posits that the motivation to avoid a threat is premised on perceived vulnerability and severity [55]. Its main strength is that it offers a framework for describing how individuals avoid threats. It also adopts a rational approach to explaining the behavior of people.	The theory adopts a narrow approach to explaining the motivation to avoid threats. Another limitation of the theory is that it may be based on an incomplete or inaccurate understanding of the existing threats. This can result in individuals focusing on the wrong threats or failing to prepare for potential attacks adequately. The theory can also be challenging to evaluate cybersecurity behavior in organizations with large and complex security environments. This is due to the limitations of effective threat avoidance strategies. In general, it has not been examined sufficiently in cybersecurity behavior research.
Health Belief Model (HBM)	HBM considers cognitive elements that influence behavior. This is based on four factors: susceptibility, benefits, severity, and barriers [63]. This broad examination of an individual’s beliefs enables the adoption of holistic strategies for changing behavior. HBM can be leveraged to promote positive cybersecurity behavior.	HBM is a psychological model, which means that other external factors influencing behavior, such as economic and environmental factors, are not considered. Additionally, it does not explain routine factors that routinely influence decision making. It also lacks an explanation of the beliefs and attitudes affecting behavior. It does not account for peer pressure and social norms controlling behavior.

highlights the strengths and limitations of the significant theories and models that appeared at least twice in the analysis. While PMT considers factors related to threat appraisal and coping appraisal, it fails to acknowledge the impact of social norms. In addition, TTAT adopts a broad perspective in identifying the determinants of threat avoidance in cybersecurity. However, it fails to cover individual threat motivations sufficiently. Further, the GDT emphasizes rationality in modeling behavior. The downside of this approach is that people can be irrational sometimes. TPB’s main strength is that it considers subjective norms, perceived behavioral control, and attitudes in affecting behavior. However, it fails to consider personal factors that influence motivation and intention. Although TAM explains avoiding threats, evaluating cybersecurity behavior in organizations with large and complex security environments can also be challenging. Further, HBM is broad and considers cognitive elements influencing behavior. Still, it fails to consider economic and environmental factors affecting behavior. In summary, it can be noticed that there is no single theory that covers all the factors affecting cybersecurity behavior. Understanding the strengths and limitations of each theory enables future research to consider various perspectives through the development of hybrid theoretical models.

4.2. Common Research Themes

To understand the research themes of the analyzed articles, we have relied on surveying the dependent variables measured in each study.

Table 5. Research themes in cybersecurity behavior.

Research Themes	Frequency
Intention behavior	14
Cybersecurity behavior	14
Avoidance behavior	5
Avoidance motivation	5
Usage behavior	4
Compliance behavior	3
Cybersecurity awareness	3
Attitude	2
Procrastination	1
Perceived usefulness	1
Value for personalization	1
Assurance behavior	1
Perseverance of effort	1
Behavioral comprehensiveness	1
Cooperate intention	1
Psychological detachment	1
Behavioral habits	1
Compliance intention	1
Peer behavior	1

shows the research themes in the analyzed articles. It can be seen that the cybersecurity behavior and intention behavior counted the highest purpose for conducting most of the studies, with 14 studies for each. This is followed by avoidance behavior and avoidance motivation, with five studies each. Further, the analysis also shows four studies for usage behavior and three for each compliance behavior and cybersecurity awareness.

Compliance behavior refers to individual practices related to adhering to laws and regulations. Compliance behavior adheres to cybersecurity laws, regulations, and procedures [64]. An example of a regulation that must be complied with within the cybersecurity realm is the Gramm-Leach-Bliley Act, which requires financial institutions to explain their information-sharing practices and safeguard sensitive information [65]. On the contrary, cybersecurity behavior is specific to cybersecurity but not limited to laws and regulations. In other words, cybersecurity behavior goes beyond the law to include acting in a manner that aligns with best practices, industry values, and standards.

4.3. External Factors Affecting Cybersecurity

External factors refer to those that are not a part of the original theories/models and were used to extend these theories/ models to examine the users’ cybersecurity behavior in specific technologies or services. The role of external factors has a significant positive or negative impact on individuals’ behaviors. Therefore, we have analyzed the included studies through the lenses of the external factors affecting cybersecurity behavior, as shown in

Table 6. External factors affecting cybersecurity behavior.

External Factors	Frequency
Self-efficacy	16
Perceived severity	12
Response efficacy	10
Perceived vulnerability	7
Perceived susceptibility	5
Response costs	5
Subjective norm	5
Cues to action	4
Peer behavior	4
Perceived barriers	4
Perceived risk	3
Perceived benefit	3
Habit	3
Security self-efficacy	3
Computer skills	3
Perceived cost	3
Severity	2
Perceived certainty of sanction	2
Psychological ownership	2
Perceived response efficacy	2
Safeguard cost	2
Neuroticism	2
Perceived effectiveness	2
Perceived risk vulnerability	2
Agreeableness	2
Openness	2
Risk-taking	2
Perceived severity of sanction	2
Safeguard effectiveness	2
Extraversion	2
Conscientiousness	2
Perceived usefulness	2
Familiarity	2
Perceived ease of use	2
Decision-making style	2

. It is imperative to report that only the factors that appeared at least twice in the analyzed studies were depicted. It can be observed that the most influential factor is self-efficacy (N = 16), followed by perceived severity (N = 12), response efficacy (N = 10), perceived vulnerability (N = 7), and five studies for subjective norm, response costs, and perceived susceptibility.

4.4. Relationship between Cybersecurity Research Themes and External Factors

Mind mapping is believed to be a suitable way to represent the relationship between cybersecurity research themes and external factors. Mind mapping, also known as concept mapping, visually represents links between ideas or concepts [66]. Figure 3 presents the mind map of the research themes (i.e., dependent variables) in the analyzed articles and the external factors affecting different behaviors. The relationship is assessed based on the significance of the results in the analyzed articles. In that, only the factors that showed significant differences were considered in the mind map.

It can be observed that self-efficacy, response efficacy, response cost, subjective norms, perceived usefulness, and perceived ease of use significantly impact intention behavior. Moreover, perceived severity, self-efficacy, perceived vulnerability, cues to action, response efficacy, peer behavior, and perceived barriers significantly affect cybersecurity behavior. Moreover, self-efficacy, perceived susceptibility, perceived severity, perceived cost, safeguard effectiveness, safeguard cost, and perceived effectiveness have substantial effects on avoidance behavior. In addition, it was found that self-efficacy, perceived susceptibility, perceived severity, perceived cost, safeguard effectiveness, safeguard cost, and perceived effectiveness have significant impacts on avoidance motivation. Furthermore, perceived ease of use, facilitating conditions, self-efficacy, trust, and habit considerably impact usage behavior. Moreover, attitude, response cost, subjective norms, and self-efficacy significantly impact compliance behavior. Additionally, it was noticed that perceived costs, response efficacy, self-efficacy, perceived severity, and perceived vulnerability have significant impacts on cybersecurity awareness.

4.5. Dominant Technologies and Services in Cybersecurity

It is imperative to report that cyber threats can affect several technologies and services. Therefore, this systematic review considers analyzing the dominant technologies and services studied in the previous cybersecurity behavior research.

Table 7. Dominant technologies and services in cybersecurity.

Technologies and Services	Frequency
Not specified	12
Smartphones	5
Information systems	4
Games	3
Social networking sites	3
Internet threats	2
E-mail	2
Malware	2
Computer	1
Ecosystem	1
Web browser	1
Internet security software	1
Anti-malware software	1
Internet of Things	1

shows the prevailing technologies and services used in cybersecurity behavior research. It is observed that smartphones (N = 5) are the most common technology used in the analyzed studies. This is followed by information systems (N = 4), social networking sites, and games, with three studies each, and e-mail, malware, and Internet threats, with two studies each. It is also essential to indicate that 12 studies did not report the technology or service used.

Social networking sites collect large quantities of data daily [67,68]. Therefore, appropriate cybersecurity behavior among social media users is critical to preserving privacy. Some security best practices on social media include managing privacy settings, maintaining personal information, using secure devices, and being cautious [69]. For instance, Addae et al. [70] devised a personal data attitude assessment instrument by employing psychometric principles, enabling the reliable quantification and comparison of attitudes. The research involved administering an online questionnaire to 247 participants. The results indicate that factors shaping individuals’ attitudes toward personal data encompass privacy concerns, protective practices, awareness, cost-benefit analysis, security, and responsibility. Consequently, the trustworthiness of social networking can be evaluated based on these six constructs for both individuals and organizations. Another study [71] employed principles derived from the TPB to investigate the mediating effect of information security awareness on users’ intentions to examine privacy settings on Facebook. The results indicate that information security awareness does, indeed, mediate security behavior in certain personality traits, particularly openness, and conscientiousness. The study highlights that openness and conscientiousness can shape individuals’ and organizations’ perceptions of social networks’ trustworthiness, particularly when those in decision-making roles exhibit these traits. In addition, Van Schaik et al. [72] demonstrated that the “affect heuristic” significantly shapes risk perception within the cybersecurity domain. This indicates that an individual’s perception of the risk associated with a specific technology is directly influenced by the affective response elicited by that technology. Consequently, if individuals perceive using a typical social networking platform as advantageous, they will likely regard it as beneficial and trustworthy. A parallel perception can be anticipated within organizational contexts.

Smartphones also collect highly confidential data from users, including location, messages, phone calls, images, and personal information. Hence, positive cybersecurity behavior can help secure the data on these devices. Web browsers, which are utilized to surf the web, can be exploited, resulting in cyberattacks. Therefore, users must exhibit positive behavior when visiting websites and updating their browsers and extensions [73]. Computer games, like other applications, can be conduits for attacks. Gamers, therefore, must be careful not to divulge sensitive information on these platforms. In addition, malware and Internet threats are often successful due to negative cybersecurity behavior. Failure to update applications could increase the impact of threats.

4.6. Leading Research Methods

Identifying the research methods used in the analyzed articles assists further research in selecting the suitable method for the intervention. Therefore, we have examined the research methods used in the analyzed studies. We observed that the majority of the analyzed studies have relied on the quantitative method of questionnaire surveys (N = 37). On the other hand, only two of the analyzed studies exposed a mixed method of questionnaire surveys and focus groups. It is imperative to mention that none of the analyzed studies have relied on the qualitative approach.

4.7. Active Countries in Cybersecurity Behavior Research

Analyzing the countries in any behavioral research helps determine those active and inactive in the domain, highlight the existing challenges, and suggest further research opportunities. The determinants affecting cybersecurity behavior vary between developing and developed countries. Therefore, it is worth analyzing the countries in this research arena. Figure 4 shows the active countries in cybersecurity behavior research. It is evident that studies were carried out mainly in the United States (USA) (N = 12), followed by Malaysia (N = 5), and Australia, China, and the United Kingdom (U.K.), with four studies each. Additionally, New Zealand, Taiwan, and the United Arab Emirates (UAE), with two studies each. It is imperative to mention that seven of the analyzed studies did not specify the country of study.

4.8. Relationship between Cybersecurity Research Themes and Study Regions

Identifying the relationship between research themes, which were characterized through the dependent variables in each study, and study regions helps understand each region’s focus and suggests further research in the domain. Figure 5 shows the cybersecurity research trends among active countries. It can be noticed that intention behavior toward a specific technology/service was mostly studied in the USA (N = 4), followed by the UAE, U.K., Australia, and Malaysia, with two studies each. Moreover, the cybersecurity behavior was mainly examined in the USA (N = 5), followed by the U.K. (N = 3), and China (N = 2). Moreover, avoidance motivation and avoidance behavior were intensively studied in three studies carried out in the USA and one in Australia. Further, the usage behavior was mainly studied in Australia (N = 3), followed by Taiwan (N = 2), and a single study was conducted in other countries. Furthermore, compliance behavior was researched in the USA (N = 2), followed by China, U.K., Jamaica, and the UAE, with one study each. In addition, cybersecurity awareness was scarcely studied, with one study in Australia and Switzerland.

4.9. Main Participants in Cybersecurity Behavior Research

Understanding the participants in previous cybersecurity behavior research assists in conducting future trials. The analysis also helps us to understand whether the existing research has emphasized the individual or organizational level. Figure 6 demonstrates the distribution of the analyzed studies in terms of participants. It can be observed that cybersecurity behavior studies were primarily focused on organizational employees (N = 22), including managers, decision-makers, IT experts, and end-user employees. This is followed by students (N = 13), consumers (N = 4), academics (N = 3), including researchers and lecturers, and parents (N = 1).

5. Discussion

Cybersecurity behavior and human characteristics are correlated [74]. Cybersecurity is essential for preserving privacy and avoiding illegal monitoring, and information exchange and intelligence collection can be valuable tools for implementing cybersecurity [75]. The primary purpose of this research was to conduct a systematic review to critically analyze and synthesize the articles published on cybersecurity behavior to improve the understanding of the common research themes, external factors, dominant technologies and services, main research methods, active countries, and participants. Understanding these characteristics would provide more insights into the existing challenges in cybersecurity behavior and offer opportunities for future research trials. Figure 7 summarizes the main review findings through a mind map, depicting the relationship between each characteristic and its main conclusions.

5.1. Rapid Growth in Cybersecurity Behavior Research

The results showed that there had been a rise in the number of articles published between 2012 and 2021, with a significant boom between 2019 and 2021. The considerable number of publications, specifically during the last few years, contributes to the increasing research interest in examining what impacts cybersecurity behavior. The growing interest stems from several reasons. For instance, individual errors cause 95% of cybersecurity incidents [76]. In 2019, 88% of organizations worldwide were exposed to spear-phishing attacks [77]. Thus, it is believed that the number of publications on cybersecurity behavior will be doubled in the next few years. This belief is due to the expectation that the number of IoT-connected devices will reach 75 billion in 2025 [76], which requires individuals and organizations to make cybersecurity behavior a part of their culture.

5.2. Analysis of Theories and Models in Cybersecurity Behavior

For the IS theories and models, the results showed that PMT is the most frequently used theory, with 17 studies. The prominent use of PMT stems from the theory’s aim to explain fear appeals and suggests that individuals protect themselves through several factors, such as perceived severity and perceived vulnerability [78,79]. In addition, PMT assists in explaining individual differences in protective cybersecurity behaviors, as action-based decisions are built on individual risk perceptions [72]. By critically analyzing the PMT-related studies, it has been found that most of them focused on exploring the cybersecurity behavior (N = 10) and the intention behavior (N = 7). For example, some studies used the PMT to study the factors affecting cybersecurity behavior in social networking sites [70,72], web browsers [55], and computers [80]. Moreover, other studies employed the PMT to study the intention behavior toward smartphone use [81,82] and malware [56]. This is followed by TTAT-related studies (N = 6) that mainly focused on analyzing avoidance motivation and avoidance behavior. For instance, the TTAT is used to analyze the avoidance motivation and avoidance behavior in playing games [54], dealing with Internet threats [83], and malware [59]. The TPB and GDT-related studies (N = 4) also focused on analyzing the intention behavior. For example, the TBP is utilized to study the intention behavior toward using social networking sites [71] and anti-malware software [61]. Moreover, the GDT is employed to analyze the intention behavior toward using e-mail [60] and smartphones [81,82]. Moreover, the TAM-related studies (N = 3) mainly focused on exploring cybersecurity behavior. For example, the TAM is used to study the cybersecurity behavior toward using web browsers [55] and social networking sites [70]. In addition, the HBM-related studies (N = 2) focused on analyzing cybersecurity behavior [63,84] where the technology or service is not specified. Since we are dealing with ‘behavior’, more theories need to be explored to further understand what impacts cybersecurity behavior by individuals and organizations. The existing literature sheds inadequate exposure to the social, psychological, and technical determinants.

5.3. Cybersecurity Research Themes and Key Factors

This review analyzed the research themes of the collected articles by examining the dependent variables in each study. The findings showed that ‘intention behavior’ and ‘cybersecurity behavior’ were the most common purposes for conducting the studies. The studies that relied on the ‘intention behavior’ aimed to examine the users’ behavior toward using different technologies and services from the perspective of security incidents. The studies that examined ‘cybersecurity behavior’ aimed to investigate the determinants affecting users’ behavior toward cybersecurity. The findings also indicated that the extant literature has not adequately addressed the aspects of cybersecurity awareness and compliance behavior, thereby presenting opportunities for additional investigative endeavors. A recent systematic review corroborates this observation [85].

For the external factors, the results indicated that self-efficacy is the most influential factor affecting cybersecurity behavior, followed by perceived severity, response efficacy, and perceived vulnerability. Undoubtedly, these are the factors derived from the PMT theory. These results suggest that further research needs to consider the role of social, technical, and psychological factors in understanding cybersecurity behavior. While analyzing the external factors, it has been noticed that the role of moderators is neglected in the extant literature. This issue was also discussed in a recent study conducted on employees’ security behavior [86].

This review also analyzed the relationship between the cybersecurity research themes and the external factors, technologies/services, and active countries. In terms of ‘intention behavior’, it was found that self-efficacy, response efficacy, response cost, subjective norms, perceived usefulness, and perceived ease of use significantly impact intention behavior. The studies mainly focused on examining the intention behavior toward using several technologies/services, such as information systems [87,88], Internet security software [71], malware [56], anti-malware software [61], social networking sites [70,71], web browsers [55], games [89,90], e-mails [60], and smartphones [81,82]. The ‘intention behavior’ has been primarily studied in the USA, UAE, U.K., Australia, and Malaysia, respectively.

In terms of cybersecurity behavior, the results showed that perceived severity, self-efficacy, perceived vulnerability, cues to action, response efficacy, peer behavior, and perceived barriers were the most influential factors. The technologies/services under this theme include information systems [91], social networking sites [70,72], web browsers [55], computers [80], smartphones [92], and Internet threats [93]. Understanding what impacts cybersecurity behavior was mainly studied in the USA, U.K., and China, respectively.

For avoidance behavior and avoidance motivation, the results indicated that self-efficacy, perceived susceptibility, perceived severity, perceived cost, safeguard effectiveness, safeguard cost, and perceived effectiveness were the dominant influential factors. The leading technologies/services investigated under this theme include Internet threats [83], games [54], smartphones [94], and malware [59]. The USA and Australia were the only active countries conducting studies on avoidance behavior and avoidance motivation. The increasing interest in these two countries stems from the COVID-19 pandemic-related cybercrime reported cases, which have increased to 300% in the USA [95] and 75% in Australia [96].

Concerning the ‘usage behavior’, the findings showed that perceived ease of use, facilitating conditions, self-efficacy, trust, and habit have significant impacts on using several technologies/services from the perspective of cybercrimes and security incidents. These technologies/services include web browsers [59], games [89], smartphones [97], and e-mails [98]. This theme has been mainly studied in Australia and Taiwan.

In terms of ‘compliance behavior’, the results found that attitude, response cost, subjective norms, and self-efficacy were the most influential factors. Smartphones were the primary technology examined under this cluster [81]. The other studies that examined compliance behavior specified neither the technology nor the service used [99,100]. The USA has dominated the list for conducting studies related to this cluster.

For ‘cybersecurity awareness’, the results indicated that perceived costs, response efficacy, self-efficacy, perceived severity, and perceived vulnerability were the most common determinants affecting the individuals’ cybersecurity awareness. The main technologies/services examined under this theme include computers [80], IoT [101], and social networking sites [71]. This has been mainly studied in Australia and Switzerland.

5.4. Cybersecurity Research Trends in Diverse Cultural and Socioeconomic Settings

Understanding the relationship between cybersecurity research themes and influential factors on the one hand and the active countries on the other hand assists further research in the domain. For instance, the majority of the examined studies were conducted in individualistic contexts with limited exposure to collectivistic societies. This phenomenon encourages further empirical research to be carried out in those contexts. Moreover, most of the analyzed studies were carried out in developed countries. Understanding the determinants affecting cybersecurity might differ in developing countries from those in developed countries due to the differences in technology infrastructure, participants’ awareness, culture, etc. This observation, in turn, encourages more research in those countries.

5.5. Research Methodologies in Cybersecurity Behavior

The results showed that 95% of the analyzed articles relied on quantitative research methods through questionnaire surveys, while the rest used mixed research methods involving questionnaire surveys and focus groups. This result suggests considering the mixed research method in future studies as relying on questionnaire surveys only might not be adequate to explain the causal relationships among the variables in the research model.

5.6. Participants in Cybersecurity Behavior Research

This review also analyzed the participants involved in each study. This classification helps understand whether the existing research has emphasized the individual or organizational level. The results found that 56% of the analyzed studies focused on organizational employees, followed by students with 33%. This observation provides evidence that understanding what impacts cybersecurity behavior at the individual level is still in its infancy stage, which opens the door for further research.

6. Conclusions and Future Research Agendas

The increasing number of cybercrimes and security incidents has promoted the concept of cybersecurity behavior to protect individuals and organizations from such threats efficiently. However, this topic is still in its infancy stage and requires further investigation. Therefore, this systematic review was conducted to gain deeper insights into the common research themes, external factors affecting cybersecurity behavior, dominant technologies and services, main research methods, active countries, and participants. We believe this review will be a valuable guide for scholars and practitioners in providing the existing gaps and suggesting opportunities for further research.

This review sheds light on several gaps in research. First, the PMT was the most frequently used theory in understanding the determinants influencing cybersecurity behavior. Most of the examined studies concentrated on the role of security determinants, such as perceived severity, response efficacy, and perceived vulnerability, in understanding cybersecurity behavior, with little attention paid to the role of social, psychological, and technical determinants. This phenomenon requires the need for more research that involves theories covering these factors. Second, insufficient knowledge of what affects cybersecurity awareness and compliance behavior opens the door for further research trials. Third, we have noticed that the role of moderators is neglected in the extant literature. Therefore, we suggest that further research involves the role of moderators as their absence might raise inconsistent effects of the factors across studies [102]. Fourth, most of the examined studies were conducted in individualistic contexts with limited exposure to collectivistic societies. This issue encourages further empirical research to be conducted in those contexts. Fifth, 95% of the analyzed articles have relied on quantitative research methods through questionnaire surveys for data collection. Therefore, further empirical research is encouraged to consider mixed methods as relying on questionnaire surveys only might not be adequate to explain the causal relationships among the variables in the research model. Sixth, since most of the reviewed studies have relied on conventional analysis techniques, such as SEM, more advanced analytical methods can be used in future studies. For example, machine learning algorithms can analyze large amounts of data and identify interesting patterns in these data [103,104]. Machine learning and deep learning play essential roles in securing computer systems from unauthorized access and managing system penetration by anticipating and comprehending the behavior and traffic of harmful software [105]. Therefore, future research might use machine learning algorithms to analyze individual cybersecurity behavior by processing large amounts of data to identify patterns and correlations that could indicate potential security threats. Seventh, 56% of the analyzed studies have focused on organizational employees in explaining what affects cybersecurity behavior. This observation provides evidence that understanding what impacts cybersecurity behavior at the individual level is still in short supply, which requires further investigation.

To address the gaps in cybersecurity behavior research at the individual level, this review proposes a number of future research agendas. Future research should focus on the impact of social and psychological factors, such as peer influence, cultural values, and individual beliefs and attitudes, on cybersecurity behavior. Technical determinants, such as technology literacy and accessibility, should also be considered. Additionally, further research should be conducted to understand the factors influencing awareness and compliance with cybersecurity best practices and policies. This can include studies on the impact of training and education programs and the role of incentives and consequences. The role of moderators, such as age, sex, and technical experience, in shaping the effects of other determinants on cybersecurity behavior should also be investigated at the individual level. This can help to explain inconsistencies in the existing literature. Moreover, research at the individual level should be conducted in collectivistic societies to understand how cultural values and group norms shape cybersecurity behavior. Future research needs to be conducted longitudinally to understand how cybersecurity behavior changes over time and in response to different factors and events. Comparative studies can also be suggested across different cultures and regions to understand how cultural and regional factors influence cybersecurity behavior.

In summary, cybersecurity is crucial for both organizations and individuals. It has been observed that an increasing number of non-expert social media users are becoming aware of the significance of various security measures [106]. Furthermore, individuals are less inclined to divulge personal information due to privacy concerns [107]. As stated in [108], security, privacy, and resilience are vital components of healthcare applications. Additionally, the Metaverse is not immune to security and privacy violations linked to human behavior, as noted in [109,110]. Consequently, Kannelønning and Katsikas [47] underscored the necessity for implementing policies to regulate employee conduct within organizations. Enhanced education and awareness contribute to improved cybersecurity behavior [111,112]. Therefore, raising information security awareness can foster positive behavior among employees [113].