## 4 Results and Analysis
### Analysis of Compliance Behavior
#### 4.1.3 Protection Motivation Behaviors and Compliance
Reference [64] briefly outlined that existing information security behavior research addresses one threat and one behavior at a time while users perform multiple security behaviors to mitigate security threats. Their study examined three security threats (data loss, security-related performance degradation, identify theft) on 279 computer users and showed that users perform multiple security behaviors to deal with these threats. The study's results have been analyzed with multidimensional scaling analysis and have shown that response efficacy and response cost are the key factors that explain why people choose a specific security behavior. Reference [65] evaluated the factors influencing employees' intention of engaging in antimalware behaviors. A PMT-based research model was proposed with additional experience factors (psychological ownership, organizational citizenship, security responsibility). The research model tested 526 employees with three different antimalware security behaviors (i.e., scanning USB with antivirus, avoiding clicking on suspicious emails, installing appropriate software updates). This study determined that all PMT factors were positively significant to facilitate antimalware behaviors except response cost; moreover, additional factors showed unique variance in different security behaviors. A study conducted by [66] examined IT employees' behavior towards information security. It has been argued in this study most of the InfoSec research focused on non-IT employees, whereas this study focused only on IT employees. The proposed research framework developed with PMT, DT (deterrence theory), and TRA (theory of reasoned action). This study provided exciting and unexpected results, and researchers proposed ten hypotheses; only three hypotheses were supported. Self-efficacy and perceived effect have positive effects on IT employees' intention to practice information security. Reference [45] examined moral intensity effects with organizational criticality on insiders' protection behaviors; researchers considered moral intensity a multidimensional construct. That was a scenario-based quantitative study performed upon 216 employees of a university. The researchers designed four scenarios; the first two scenarios for high criticality protection behaviors, and the other two involved low criticality protection behaviors. The study results showed that dimensions of moral intensity affect moral beliefs and vary with different organizational criticality among insiders. Reference [27] have presented a multi theory framework to assess higher education employees' behavior toward ISPC. Four significant theories (PMT, GDT, TPB, OT) constructs were used for compliance assessment. A total of 206 higher education employees responded correctly to this study. This study concluded that PMT (perceived vulnerability, response efficacy, and response cost) is the best predictor of ISPC in higher education. In contrast, punishments for peer pressures, sanctions, and top management supervision do not matter in this context. Likewise, [67] presented a framework based on eight behavioral theories constructs. They took nine influential variables and tested them with a survey of 433 employees. Their study concluded that among multiple ISB factors, self-efficacy and religion or self-morality are the best predictors of employees' ISPC. A summary of the PMB's selected literature is provided in Table 6.