Factors that influence secure behaviour while using mobile digital devices

Abstract

Purpose

The use of mobile digital devices requires secure behaviour while using these devices. To influence this behaviour, one should be able to adequately measure the behaviour. The purpose of this study is to establish a model for measuring secure behaviour, and to use this model to measure the secure behaviour of individuals while using mobile digital devices such as smartphones and laptops.

Design/methodology/approach

Based on a wide-ranging questionnaire (N = 1000), this study investigates the degree of influence that a relatively large number of factors have on secure behaviour while using mobile digital devices. These factors include knowledge and cognitive attitude, but also affective attitude, as well as several types of bias.

Findings

This study has provided a model for measuring secure behaviour. The results of the measurements show that knowledge, bias, cognitive attitude and affective attitude all have impact on secure behaviour while using mobile digital devices. Moreover, none of these factors is of minor importance.

Practical implications

This study shows that it is important to also consider previously undervalued factors, such as affective attitude and various types of bias, when designing interventions to improve secure behaviour while using mobile digital devices.

Originality/value

Most research on secure behaviour has only looked at a small number of influencing factors, usually limited to knowledge and cognitive attitude. This study shows that one needs a more elaborate model for measuring secure behaviour, and that previously undervalued factors have a clear influence on secure behaviour.

Citation

Spruit, M., Oosting, D. and Kreffer, C. (2024), "Factors that influence secure behaviour while using mobile digital devices", Information and Computer Security, Vol. ahead-of-print No. ahead-of-print. https://doi.org/10.1108/ICS-02-2024-0035

1. Introduction

Society is becoming increasingly digitised. Many people have mobile digital devices, such as a smartphone or a laptop. This makes it possible to have digital information and support at almost all times and everywhere. Moreover, most devices are connected to the internet, which means that people are linked to a large number of other people and systems.

The fact that the internet connects so many people and systems is useful, but it also has a downside. The internet is a melting pot of all kinds of digital threats (Bitton et al., 2018; Gulshan and Chauhan, 2021). To restrict damage from these threats, it is necessary to behave securely while using mobile digital devices. This includes secure execution of actions in the digital environment on the one hand, for example not clicking on suspicious links in an email. On the other hand, it means implementation of the necessary security controls to improve the level of security, for example by using strong passwords and making regular backups. In practice, many people do not do this sufficiently (Allam et al., 2014; CBS, 2022; Hewitt and White, 2021; Livingstone et al., 2011; Witsenboer et al., 2022).

Much research has been conducted into explaining security behaviour. A large part of this research has focused on how situation perception influences the motivation for behaviour. Perception, in turn, is based on knowledge about and interpretation of the situation (Bernstein, 2016). Models with this perspective include protection motivation theory (Rogers, 1975; Sommestad et al., 2015; Verkijika, 2018) and the theory of situation awareness (Endsley, 1995; Ofte and Katsikas, 2023). Furthermore, studies were published in which people’s attitude towards security was included as an influence on behaviour. Models with this perspective include the theory of reasoned action (Fishbein and Ajzen, 1980), the theory of planned behaviour (Ajzen, 1985) and the knowledge-attitude-behaviour model (Kruger and Kearney, 2006; Parsons et al., 2017).

It is well-known that attitude is made up of cognitive, affective and behavioural components (Bernstein, 2016; Ostrom, 1969; Robbins and Judge, 2019; Svenningsson et al., 2022). However, in most studies that include attitude, this is especially true for the cognitive component (Bitton et al., 2018; Kruger and Kearney, 2006; Lebek et al., 2014; Parsons et al., 2017; Rahim et al., 2015). Few studies have focused on the influence of affective attitude on security behaviour (Kok et al., 2020; Salameh and Loh, 2022). As a result, there is little data on the influence of affective attitude on security behaviour. This applies even more to the influence of different types of bias (Boysen and Vogel, 2009; Hewitt and White, 2021). Therefore, the available research data does not provide a complete picture of which factors influence security behaviour and to what extent.

We conducted a survey into which factors influence secure behaviour while using mobile digital devices. The factors include knowledge, several types of bias, cognitive attitude and affective attitude. We investigated the extent to which these factors influence behaviour and the relative strength of their influence.

2. Theoretical background

Acting with mobile digital devices requires secure behaviour. This behaviour consists of actions and controls that someone performs consciously. From the behavioural science literature, we know that the main predictor for this behaviour is a person’s motivation, also called (behavioural) intention, to perform the behaviour (Ajzen et al., 2009; Bernstein, 2016; Lebek et al., 2014; Michie et al., 2011; Robbins and Judge, 2019; Sheeran, 2002). Obviously, the person must also have the skills required for the behaviour (Michie et al., 2011). In this study, we consider only actions and controls that do not require specific difficult skills, the absence of which can be a cause of not behaving securely. Therefore, we do not consider the factor skills in this study. Furthermore, the environment must not make the necessary behaviour too difficult or even impossible, i.e. the environment must offer the person the opportunity to perform the required behaviour (Michie et al., 2011; Pollini et al., 2022). In this study, we consider only actions and controls that can be performed relatively easily in the given environment, i.e. the person is given the opportunity to perform the actions and controls. Therefore, we also do not consider the factor opportunity in this study.

Someone’s motivation to behave securely in a given situation is influenced by the person’s (risk) perception of that situation (Endsley, 1995; Rogers, 1975; Rundmo and Nordfjaern, 2017; Spruit, 1998). This is somewhat obvious, because a person must first have an idea of the risks in a given situation before motivation can arise in that person to do something about those risks. Perception, in turn, is strongly influenced by the person’s knowledge about the situation, i.e. knowledge about the environment, the relevant threats, the potential impact of the threats and the actions and controls that are effective against these threats (Ben-Asher and Gonzalez, 2015; Rasmussen, 1983; Rohrmann and Renn, 2000; Sommestad et al., 2015). To be able to behave securely while using mobile digital devices, it is sufficient to have knowledge as specified by the first three levels in Bloom’s taxonomy, i.e. remembering, comprehension and application (Bloom et al., 1956; Krathwohl, 2002). The person then knows which actions are safe in a given situation, which controls are required and how the controls should be implemented. Unfortunately, not everyone has this knowledge to a sufficient degree (CBS, 2022; EC, 2019). As a result, people do not have a good understanding of the risks they run and the behaviour that is necessary, and as a result they may not be sufficiently motivated to behave securely. In this study, we consider knowledge about threats and their impact.

If someone does have the right knowledge about the environment, the relevant threats, their potential impact and the relevant actions and controls, this does not ensure good perception. Kahneman and others have described that through various types of bias a person’s perception may be distorted (Bernstein, 2016; Kahneman, 2011; Kahneman et al., 1982; Robbins and Judge, 2019). For example, people tend to see risks that they expect to see or that fit well with their opinion (confirmation bias) (Klayman, 1995; Knäuper et al., 2016; Nickerson, 1998). Moreover, people overestimate the risks corresponding to threats about which they have a lot of information or that received a lot of media attention (availability bias) (Carroll, 1978; Dubé-Rioux and Russo, 1988; Tversky and Kahneman, 1973). Furthermore, people tend to overrate their own knowledge and skills and underrate risks (optimism bias) (Bränström et al., 2005; Campbell et al., 2007; DeJoy, 1989; Nandedkar and Midha, 2012; Sharot, 2011). There are other types of bias (Kahneman, 2011), but we assume that in particular the three types of bias mentioned above could have a noticeable influence on secure behaviour while using mobile digital devices. Therefore, we consider these three types of bias in this study.

From the behavioural science literature, we know that even if someone has the right perception of the behaviour that is reasonably appropriate in a given situation, this does not necessarily mean that the person will have a positive attitude about it. The person may know which behaviour is appropriate, but still think or feel that one should behave differently. In this case, the attitude of that person towards the given behaviour is negative. This discourages motivation for the behaviour and by extension the behaviour itself (Abdullah et al., 2020; Ajzen, 1991; Bernstein, 2016; Kummeneje and Rundmo, 2020; Robbins and Judge, 2019; Safa et al., 2015; Spruit, 1998).

The (risk) attitude someone has towards secure behaviour while using mobile digital devices is made up of three components: cognitive, affective and behavioural attitude (Bernstein, 2016; Ostrom, 1969; Robbins and Judge, 2019; Svenningsson et al., 2022). Usually, these components are in line with each other and reinforce each other. However, sometimes that is not the case, and attitude is mainly determined by only one of the components (Edwards, 1990; Loewenstein et al., 2001).

Cognitive attitude is a reasoning-based attitude. It is based on the extent to which someone believes that the required behaviour is useful (effective and proportional), urgent and does not involve unreasonable cost and effort (Cialdini, 2003; Davis, 1989; Greaves, 2017; Robbins and Judge, 2019).

Affective attitude is a feelings-based attitude. It is based on a combination of feelings (Robbins and Judge, 2019). Firstly, one’s gut feeling regarding the required behaviour, for example, fear of computer viruses (Loewenstein et al., 2001; Lupton and Tulloch, 1999). Secondly, procrastination, or irrational delaying of tasks, especially those that one considers less pleasant (Harriott and Ferrari, 1996; He, 2017; Solomon and Rothblum, 1984). And lastly, the subjective norm, or the pressure to conform to what one thinks others find desirable behaviour (Ajzen, 1991; Winter et al., 2022), especially if this comes from relevant peer groups, such as colleagues, friends, parents and teachers (Asch, 1955; Lawson and Stagner, 1957), important persons, such as managers and police officers (Dobbie et al., 2019; Hu et al., 2012) and influencers, such as politicians and vloggers on the internet (Freberg et al., 2010). In addition, (emotional) involvement can play a role, for example because the person has participated in formulating security actions and controls (“invented here”) (De Rivera et al., 2002; Hatten and Ruhland, 1995; Senge, 1996). However, the latter is less obvious with mobile digital devices, because secure behaviour while using mobile digital devices consists of standard actions and controls.

Behavioural attitude is based on aligning one’s opinion and behaviour to smooth out discrepancies between the two (Festinger, 1957; Robbins and Judge, 2019; Wicker, 1969). This component is normally not the cause of certain behaviour, but rather follows from the behaviour and influences the cognitive and affective attitude in such a way that they align with the behaviour (Festinger, 1957). Since this study focuses on causes of behaviour, we do not consider this component of attitude.

Both cognitive and affective attitude can directly influence behaviour. Both components, as well as its aspects, are therefore included in this study.

If a person has an accurate perception of the behaviour that is reasonably appropriate in a given situation, and also a positive attitude towards that behaviour, then this person will not necessarily be motivated to carry out the behaviour in practice. This only happens if the person believes that the given behaviour is normally practicable (perceived efficacy) (Ajzen, 1991), and believes that they are capable of practising the behaviour themselves (self-efficacy) (Bandura, 1977; Safa et al., 2015). Since in this study we only consider actions and controls that should be feasible for everyone, we do not include the factors perceived efficacy and self-efficacy in this study.

Finally, the expected positive or negative consequences caused by the environment can influence someone’s motivation for certain behaviour. For example, the expectation of a positive consequence, such as a reward associated with the behaviour, can strengthen motivation (Bernstein, 2016; Robbins and Judge, 2019). On the other hand, the expectation of a negative consequence, such as a punishment associated with the behaviour, can weaken motivation. Since this study focuses on personal mobile digital devices, where the owner is responsible for the required behaviour, these factors are not relevant to this study.

The factors that influence the extent to which someone behaves securely while using mobile digital devices such as smartphones have been summarised in Figure 1.

3. Research methodology

3.1 Participants

The questionnaire was sent out online by a panel organisation with a representative database of Dutch people aged 20 and over. The questionnaire could be filled in anonymously from a smartphone, tablet, laptop or desktop computer. No information was requested that could identify the respondent. Every response was checked for correct completion.

The respondents had to indicate whether they owned at least one smartphone, tablet or laptop. Devices on loan from an employer were not allowed as these devices may have had controls applied to them by a company administrator. The other questions in the questionnaire were solely about self-managed smartphones, tablets and/or laptops. Respondents who did not own a smartphone, tablet or laptop were not included in the analysis.

3.2 Selected security practices

The questionnaire focuses on security behaviour. It looks at whether the respondent has performed certain security behaviour while using mobile digital devices. Based on eight semi-structured interviews with cybersecurity specialists (four assistant professors of computer science, two university cybersecurity researchers and two cybersecurity consultants), a number of security practices have been selected for this study. Each of the practices should be unambiguous and both necessary and common for secure behaviour while using mobile digital devices. Also, the practice should not be realised automatically by default, and both the initiative for the practice and its implementation should lie with the user of the device.

The following seven security practices have been selected:

• Use different passwords for email, online banking, online shopping and social media, with or without the help of a password manager.

• Install security software such as antimalware and a firewall.

• Use Virtual Private Network (VPN) software for a secure connection to and over the Internet.

• Check privacy settings of new apps and software and adjust them if necessary.

• Restrict access to sensitive data on social media so that this data cannot be accessed by everybody.

• Reject unnecessary cookies from websites or adjust them if necessary and possible.

• Turn off the location service on the device when this service is not required.

3.3 Factors

Several factors influence whether security behaviour is carried out. In the theoretical background, it has been argued that both a person’s perception (knowledge and bias) and a person’s attitude (cognitive and affective attitude) can be relevant to security behaviour in relation to mobile digital devices.

Knowledge means recognising which actions and controls are necessary and how they should be performed, as well as what the consequences may be if they are not performed.

Bias comes in several types. Not all of them are relevant to not performing security behaviour. This study includes the types of bias that could potentially influence secure behaviour while using mobile digital devices. These biases are optimism, availability and confirmation bias. With optimism bias, optimism can relate to both the possible impact of the underlying threats as well as the likelihood of their occurrence.

Cognitive attitude includes several rational aspects, namely the opinion about the usefulness of the behaviour, about the urgency of the behaviour and about the cost and effort it takes to perform the behaviour.

Affective attitude includes a number of aspects that relate to the feelings of the respondent, namely gut feeling, procrastination and subjective norm.

Table 1 summarises the factors and aspects considered in this study that may influence the necessary secure behaviour while using mobile digital devices.

Based on the theoretical background, we could not make reliable statements about the relative importance of the factors and aspects, so they have not been given different weights in advance.

3.4 Questionnaire

The respondents could indicate whether they recognised each selected security practice, and, if so, whether they had performed the practice. The questions aimed at practices for one’s own mobile digital devices, so not devices on loan from the employer.

The option “Sometimes” could also be chosen because: The respondents may have several devices that they use in different ways and some security practices, such as rejecting cookies, do not necessarily have to be performed at all times. For a number of practices, such as restricting access to sensitive data on social media, the respondent could also choose the option “Not applicable”. Subsequently, the respondent could indicate for each known but not performed security practice which aspects from Table 1, in the respondent’s view, had been a decisive cause for not performing the practice.

For each security practice, possible causes for not performing the practice have been formulated for each aspect from Table 1. Table 2 shows possible causes for not performing the practice “Use VPN software for a secure connection to and over the Internet”, or in short “Use VPN software”. The possible causes for not performing each of the other practices have been formulated analogously.

Respondents who had not performed a certain practice could choose the causes which had been decisive for them for not performing the practice. To prevent minor influences of aspects from being counted too heavily, a respondent could choose a maximum of two causes for each security practice that was not performed. If two aspects have been chosen, each of the two is weighted by a factor of 0.5. No other weights have been applied.

In addition, the questionnaire included some demographic questions about the respondent, as well as some questions about their internet use, the importance of their data and whether the respondent had had one or more incidents involving a mobile digital device or had witnessed an incident elsewhere.

Five people (one cybersecurity researcher and four people with different backgrounds and little knowledge about human behaviour and cybersecurity) were asked to complete the questionnaire in thinking aloud sessions (Boren and Ramey, 2000). In such sessions, the respondent reads each question aloud, while, also aloud, explaining what he or she thinks the question means, what answer he or she chooses and the rationale for the answer. If necessary, the researchers asked control questions to ensure that the answers were well understood and consistent with actual perception, attitude and behaviour. These sessions gave us the opportunity to determine whether the wording of the questions was not unnecessarily difficult and whether the interpretation of the questions was as we intended and was not ambiguous.

The complete questionnaire will be made available in open access DANS EASY Repository.

4. Results

In total, we received 1,000 correctly completed questionnaires. There were no extreme outliers. The respondents were 49.4% male and 50.6% female. The average age of the respondents was 49.4 years old (SD = 16.8). The youngest respondent was 20 years old, and the oldest respondent was 89 years old. The education level of the respondents was 27.0% low, 42.4% intermediate and 30.6% high. This distribution is close to that for The Netherlands as a whole (CBS, 2023).

The observation that many people behave in a way that is not secure while using mobile digital devices is supported by this study. On average, the respondents performed 4.92 of the 7 selected security practices (SD = 1.68), albeit not always (the option “Sometimes” also counted). Figure 2 shows that only 20.7% of the respondents performed all the selected security practices, always or sometimes. More than 1% of the respondents never performed any of these security practices.

Table 3 shows that the average number of security practices performed by respondents depends on demographic factors, although the differences are small (but statistically significant). Men show a slightly higher score than women. Respondents under 50 years old score slightly higher than those aged 50 and over. Furthermore, a small increase is visible with increasing education level.

Some security practices were performed more often than others. Figure 3 shows that 92.5% of respondents always or sometimes used different passwords for online banking, email, online shopping and social media, possibly using a password manager. This means that 7.5% of the respondents never performed this simple practice. At 42.6%, using a VPN to get a secure connection to and over the internet is the least performed security practice.

Given the large number of respondents who did not perform one or more of the selected security practices and therefore are less protected against security threats, it is important to see what the causes are for not performing the practices.

If someone does not have the knowledge required for a security practice or does not have it sufficiently, then it is either not possible for the person to perform the practice, or the person does not understand why the practice is necessary and does not perform the practice for that reason. The lack of knowledge may relate to the functionality of the given practice or the impact it may have if the practice is not performed. Figure 4 shows the extent to which the respondents’ lack of sufficient knowledge was a decisive cause for not performing each of the selected practices. The lack of sufficient knowledge with regard to both functionality and impact appear to be important causes for not performing practices.

If someone has sufficient knowledge for a security practice, but has a distorted perception due to bias, this may be a cause for not performing the practice. Figure 5 shows to what extent the respondents’ distorted perception due to bias was a decisive cause for not performing each of the practices. A distinction has been made between optimism bias, availability bias and confirmation bias. Optimism bias in particular appears to have a significant influence. The availability bias and the confirmation bias have a smaller but still noticeable influence.

If someone has sufficient knowledge for a given security practice and the perception is not distorted by bias, then the person may still rationally believe that it is not necessary to perform the practice. This cognitive attitude is based on the extent to which the person believes that the practice is useful and urgent and that it does not involve unreasonable cost and effort. Figure 6 shows the extent to which the respondents’ cognitive attitude was a decisive cause for not performing each of the practices. Opinion about urgency appears to have a significant influence. Cost and effort appear to play an important role for not using different passwords. Opinion about usefulness has a relatively small but still noticeable influence.

Affective attitude may also explain the opinion that the selected security practices do not have to be performed. Affective attitude is based on a combination of gut feeling about the practices, procrastination and subjective norm. Figure 7 shows to what extent the respondents’ affective attitude was a decisive factor for not performing each of the practices. All three aspects, gut feeling, procrastination and subjective norm, appear to have a clearly noticeable influence.

All factors included in the study appear to have a greater or lesser influence on not performing the selected practices. Some factors or aspects appear to have a somewhat smaller, but noticeable, influence. These include availability bias, confirmation bias and opinion about usefulness. Other factors or aspects, such as knowledge, optimism bias and sense of urgency appear to have a substantial influence.

Figure 8 shows the relative influence of knowledge, bias, cognitive attitude and affective attitude on secure behaviour while using mobile digital devices. The figure shows that the influence of the factors is of the same order of magnitude, but there are some outliers. For example, lack of knowledge is relatively often the cause for not using VPN software. This also applies to not using different passwords, but Figure 3 shows that this only concerns a limited number of respondents. Not restricting access to sensitive data on social media is relatively often caused by bias. Figure 5 shows that it mainly concerns optimism bias.

On average, none of the factors knowledge, bias, cognitive attitude and affective attitude was overshadowed by the others. It therefore seems that previously undervalued factors also influence secure behaviour while using mobile digital devices. This mainly concerns affective attitude and various types of bias.

5. Discussion

This study included three types of bias that we suspected could influence the choice of whether to perform a certain security practice. The study has shown that these three types of bias do indeed have an impact, albeit to differing degrees. However, it is possible that other types of bias may also have an influence (Kahneman, 2011; Robbins and Judge, 2019). Further research into the influence of other types of bias could provide more information.

A limitation of the questionnaire is that the influence of each of the factors could only be examined with a limited number of questions in order not to make the questionnaire too extensive and time-consuming. By conducting further research with a smaller group of people, the influence of the factors could be determined more accurately by asking more questions per factor and providing more nuanced answer options. The accuracy could be further increased by using in-depth interviews instead of a questionnaire (Adams and Cox, 2008).

Self-reporting based on a questionnaire is an effective way of finding out about security behaviour and the influence that various factors have on it. However, this kind of self-reporting is less reliable than observing behaviour in practice and then finding out the influence of factors with the help of in-depth interviews (Gollwitzer et al., 2022; Junco, 2013; Kkeli and Michaelides, 2023; Prince et al., 2020; Siponen and Vance, 2010). This said, behavioural observation and in-depth interviews are not feasible with a large group of people, which is why we opted for self-reporting based on a questionnaire. A number of pilot interviews were conducted in preparation for this study. The participants were questioned in an in-depth interview after they had completed the questionnaire. The interviews showed that the perceived influence of the various factors on whether to perform the selected security practices corresponds reasonably well with the outcomes of the questionnaire. In a few interviews, we saw a small deviation in the knowledge factor compared to the questionnaire they had previously completed, but in most interviews, we did not see any significant differences. Nevertheless, it is possible that the results from the questionnaire suffered from some deviation (Sember et al., 2020). In addition, influences that could not be questioned reliably during the interviews may have been somewhat misjudged.

This study shows that previously undervalued factors also influence secure behaviour while using mobile digital devices. It is therefore important to take these factors into account when designing interventions to improve people’s behaviour while using their mobile digital devices. Of course, a number of other factors that were not relevant to this study, such as the expected positive or negative consequences from the environment, could be relevant to designing interventions.

6. Conclusions

Although extensive research has been conducted into explaining security behaviour, most of the models that result from this research have only looked into a limited number of influencing factors. Based on a wide-ranging questionnaire (N = 1,000), this study has investigated the degree of influence for a larger number of factors on secure behaviour while using mobile digital devices such as smartphones and laptops. The results show that perception, based on knowledge and bias, as well as attitude, with a cognitive and an affective component, influence secure behaviour while using mobile digital devices. Moreover, the influence of each of these factors is clearly noticeable. None of the factors is of minor importance. Types of bias not considered in this study may also be of influence, and the influence of some factors, such as subjective norm, may have been somewhat underestimated.

This research shows that it is important to also consider previously undervalued factors, such as affective attitude and various types of bias, in further behavioural research and when designing interventions to improve secure behaviour while using mobile digital devices.

Figures

Figure 1.

Factors that influence secure behaviour while using mobile digital devices

Figure 2.

Percentage of respondents that performed 0 to 7 of the selected security practices

Figure 3.

Percentage of respondents that performed a security practice

Figure 4.

Percentage of respondents for whom lack of knowledge was a decisive cause for not performing a security practice

Figure 5.

Percentage of respondents for whom bias was a decisive cause for not performing a security practice

Figure 6.

Percentage of respondents for whom cognitive attitude was a decisive cause for not performing a security practice

Figure 7.

Percentage of respondents for whom affective attitude was a decisive cause for not performing a security practice

Figure 8.

Percentage of respondents for whom knowledge, bias, cognitive attitude or affective attitude was a decisive cause for not performing a security practice

Table 1.

The factors and aspects considered that may influence secure behaviour while using mobile digital devices

Main factor	Factor	Aspect
Perception	Knowledge	Functionality
		Impact
	Optimism bias	Impact
		Probability
	Availability bias	Id.
	Confirmation bias	Id.
Attitude	Cognitive attitude	Usefulness
		Urgency
		Cost and effort
	Affective attitude	Gut feeling
		Procrastination
		Subjective norm

Source: Created by authors

Table 2.

Possible causes the respondents could choose for not using VPN software

Factor	Aspect	Possible cause for not using VPN software
Knowledge	Functionality	“Because I don’t know how to choose/use VPN software”
	Impact	“Because government should be able to see what I’m doing on the Internet”
Optimism bias	Impact	“Because I have nothing to hide”
	Probability	“Because I’m not on the radar of criminals”
Availability bias	Id.	“Because I don’t know anyone who has suffered from leaking his Internet address”
Confirmation bias	Id.	“Because it seems strange to me that I would be digitally tapped”
Cognitive attitude	Usefulness	“Because I don’t see why I would use a VPN”
	Urgency	“Because I didn’t think about it”
	Cost and effort	“Because using a VPN would take me too much effort/time”
Affective attitude	Gut feeling	“Because I just don’t feel like it / I’m lazy”
	Procrastination	“I was planning to, but I haven’t gotten around to it yet”
	Subjective norm	“Because hardly anyone uses a VPN” “Because people in my immediate environment don’t use a VPN”

Source: Created by authors

Table 3.

The average number of security practices performed as a function of demographic factors

Demographic factor	N	Average number of practices	SD	T-test
All respondents	1,000	4.92	1.679
Man	494	5.09	1.729	t (998) = 3.159 p = 0.002
Woman	506	4.76	1.616
Age < 50	502	5.13	1.776	t (998) = −3.911 p < 0.001
Age ≥ 50	498	4.72	1.552
Low level of education	270	4.60	1.701	tLH (574) = −3.871 p < 0.001
Medium level of education	424	4.96	1.608
High level of education	306	5.16	1.720

Source: Created by authors