A systematic review of multi perspectives on human cybersecurity behavior

Abstract

Although the cornerstones of cybersecurity are technical and data-driven solutions, the human element cannot be disregarded. Understanding users’ behavior is essential to spot security incidents and data breaches. Although previous studies reviewed different angles on cybersecurity behavior, there is still a lack of an overview of the topic through the lenses of cybersecurity theories/models. This systematic review aims to provide multi perspectives on human cybersecurity behavior by evaluating and synthesizing cybersecurity theories/models, independent variables, target variables, moderators, methodologies, participants, units of analysis, technologies/services, countries, and domains. Of 2936 articles collected, 93 studies met the inclusion criteria and were thoroughly analyzed. The main results revealed that the protection motivation theory (PMT) and theory of planned behavior (TPB) were the most common theories in the analyzed literature. 76% of the analyzed studies did not involve a moderator to examine the relationships between predictors and target variables. Most of the studies were conducted at the individual level, mainly involving students and end-users. Social media and mobile devices were the most common tools examined for human cybersecurity behavior. Most of the studies were conducted in the education sector, with a limited number of studies examining the healthcare sector. Behavioral intention and cybersecurity behavior were the primary target/outcome variables in the analyzed studies. The review offers several theoretical contributions and practical implications and provides several research agendas that can be examined in future research.