###### Abstract  
Personal mobile devices form an integral part of business activities today. Mobile devices, nevertheless, pose various security issues and data privacy threats, which require a close attention. The rational choice theory was utilized to examine the determinants of employees' security behavior in relation to mobile device usage. Employees were postulated to rationally evaluate the costs and benefits of mobile security measures and decide on the option that is perceived to provide the best expected outcome. Twelve out of thirteen hypotheses examined in this study were found to be significant. We also hypothesized that demographics and work-related variables significantly affect employees' mobile security practices, examined using ordinal logistic regression analysis. The findings indicate the efficacy of the rational choice theory in explaining mobile security behavior. Security inconvenience has been found to be a significant cost to information security measures. Moreover, the findings also showed the influence of gender, job function, past security experience, and perceived risk on the dependent variable. In conclusion, we would like to draw considerable attention to the contribution of security awareness programs and security training to good mobile security behaviors. mobile security; data privacy; security awareness; cost-benefit analysis; rational choice theory +
Footnote †: journal:  
0000-0001-4698-2227-2222-2222-2222-2222-2222-22222-2222-22222-22222-22222-222222-  
security negligence. [PERSON] and [PERSON] [7] found that users tend to implement fewer security measures and have a lower perception of the severity of security threats and lower security self-efficacy on smartphones and tablets compared to their personal computers. In [PERSON] [9], over 20% of mobile device users were unaware of the security measures they were using. [PERSON] et al. [10] found that smartphones are less secure compared to desktop computers. Organizations, hence, have a stake in how employees manage their mobile devices. [PERSON] et al. [11] found that employees tend to use the same device for work and personal purposes, escalating the threat to organizations' information security. The study also reported that users of smartphones did not enable or add security control, tended to disregard security when selecting and downloading applications, and were of the opinion that smartphone security software is not necessary. The reason behind the behavior and attitude was unclear. Experts have recommended the use of mobile device management (MDM) as an approach to restrict employees' mobile application installation rights and impose security practices. MDM is believed to reduce risks related to data security and intellectual property. However, there is a downside to MDM. The management of employees' personal devices puts additional strain on existing security infrastructures and threatens employees' privacy [12; 13]. MDM also may limit and be contraindicative to the bring-your-own-devices (BYOD) culture implemented by organizations [14], restricting employees' freedom on the use of their personal devices for work purposes. According to [PERSON] and [PERSON] [15], BYOD culture positively impacts job satisfaction, job performance, and organizational commitment. The authors, nevertheless, did not include the influence of organizational control on the use of personal devices in their analysis. [PERSON] et al. [16] carried out an extensive analysis of MDM platforms from a security perspective and found that many MDM solutions are merely management solutions with some security features wrapped around specific applications, rendering these inadequate in monitoring the devices' contents, two-way communications patterns, or resource usage [17]. Therefore, information security related to the use of personal mobile devices is still very much dependent on usage behaviors.