Understanding Security Behaviors in Personal Computer Usage: A Threat Avoidance Perspective

TLDR

Users perceive IT threats as likely and severe, motivating avoidance when safeguards are effective, affordable, and users feel competent. This study aims to understand the IT threat avoidance behaviors of personal computer users. The authors tested a Technology Threat Avoidance Theory–based model with survey data from personal computer users. The study found that avoidance motivation is driven by perceived threat, safeguard effectiveness, cost, and self-efficacy, with a negative interaction between threat and safeguard effectiveness that weakens their influence on avoidance motivation.

Abstract

This study aims to understand the IT threat avoidance behaviors of personal computer users. We tested a research model derived from Technology Threat Avoidance Theory (TTAT) using survey data. We find that users' IT threat avoidance behavior is predicted by avoidance motivation, which, in turn, is determined by perceived threat, safeguard effectiveness, safeguard cost, and self-efficacy. Users develop a threat perception when they believe that the malicious IT is likely to attack them (perceived susceptibility) and the negative consequences will be severe if they are attacked (perceived severity). When threatened, users are more motivated to avoid the threat if they believe that the safeguarding measure is effective (safeguard effectiveness) and inexpensive (safeguard cost) and they have confidence in using it (self-efficacy). In addition, we find that perceived threat and safeguard effectiveness have a negative interaction on avoidance motivation so that a higher level of perceived threat is associated with a weaker relationship between safeguard effectiveness and avoidance motivation or a higher level of safeguard effectiveness is associated with a weaker relationship between perceived threat and avoidance motivation. These findings provide an enriched understanding about personal computer users' IT threat avoidance behavior.