## 2 Literature Review and Hypotheses Formulation
### Personal Variables  
Usage behavior and information security awareness are the two personal variables that were theorized to directly affect employees' cost-benefit consideration. Usage behavior of mobile devices provides first-hand experience to the employees and helps employees form judgments about security measures in a similar way asserted by [24]. Individuals form judgments about their behavior and the outcomes of the behavior based on their observations of the events that have occurred. The extent of various mobile applications or device usage leads employees to have direct knowledge of security issues and incidents [26] as well as a chance to learn through experience.  
In [PERSON] et al. [25], for example, users who experienced a direct security breach as a result of mobile devices have been found to suffer a negative emotional state such as anxiety or stress. Such experience is an important source of information and influences one's behavior related to information security measures [27]. Employees who have used their mobile devices to store sensitive information would have formed more concrete judgments of the costs and benefits of mobile security measures. [PERSON] et al. [41] documented that users' concerns about mobile device security threats differed according to the frequency and variety of mobile services in use. We, therefore, posit that usage behavior significantly affects both expected outcome and security inconvenience. The relevant hypotheses are as follows:  
**Hypothesis 4 (H4)**.: _Usage behavior significantly affects expected outcome._
**Hypothesis 5 (H5)**.: _Usage behavior significantly affects security inconvenience._  
[PERSON] et al. [21] have described security awareness as employees' understanding of information security and the relevant concerns. Information security awareness leads to employees' mindfulness of the significance of information security [42]. Thus far, information security awareness has been investigated in terms of its influence on users' perceptions and attitudes [21; 43; 44]. It could be deduced from [PERSON] and [PERSON] [8] that security awareness affects users' decisions to implement security measures for their mobile devices.  
However, [PERSON] [45], in his study of home users, found that information security awareness does not directly affect security behavior among users. Instead, security behavior was significantly affected by the perceived susceptibility to threats. [PERSON] et al. [46] noted that security awareness does not necessarily result in congruent behavior. It could be deduced from these studies that information security awareness may not directly affect behavior, but such awareness significantly influences users' judgment of the behavior. It is expected that information security awareness improves employees' cost-benefit consideration by helping employees to recognize possible outcomes of mobile security behavior and deal with the inconveniences of security measures. We, therefore, hypothesize that information security awareness affects the cost-benefit consideration of mobile security practices. Accordingly, the following hypotheses were constructed:  
**Hypothesis 6 (H6)**.: _Information security awareness significantly affects expected outcome._
**Hypothesis 7 (H7)**.: _Information security awareness significantly affects security inconvenience._