# Exploring the Frontiers of Cybersecurity Behavior: A Systematic Review of Studies and Theories
## 4 Results
### Prominent Theories and Models in Cybersecurity Behavior  
Numerous research studies investigated cybersecurity behavior through different theories and models. Table 3 illustrates the prominent theories and models used in understanding what impacts cybersecurity behavior. The protection motivation theory (PMT), with 17 studies, dominates the list of theories and models, followed by the technology threat avoidance theory (TTAT), with 6 studies. In addition, the theory of planned behavior (TPB) and the general deterrence theory (GDT) represent the third and fourth categories in the list with four studies each, followed by the threat avoidance motivation (TAM) (N = 3) and health belief model (HBM) (N = 2). However, the other theories and models appeared only once in the analyzed studies, as shown in Table 3.  
Table 4 highlights the strengths and limitations of the significant theories and models that appeared at least twice in the analysis. While PMT considers factors related to threat appraisal and coping appraisal, it fails to acknowledge the impact of social norms. In addition, TTAT adopts a broad perspective in identifying the determinants of threat avoidance in cybersecurity. However, it fails to cover individual threat motivations sufficiently. Further, the GDT emphasizes rationality in modeling behavior. The downside of this approach is that people can be irrational sometimes. TPB's main strength is that it considers subjective norms, perceived behavioral control, and attitudes in affecting behavior. However, it fails to consider personal factors that influence motivation and intention. Although TAM  
Figure 2: Articles distribution by publication years. explains avoiding threats, evaluating cybersecurity behavior in organizations with large and complex security environments can also be challenging. Further, HBM is broad and considers cognitive elements influencing behavior. Still, it fails to consider economic and environmental factors affecting behavior. In summary, it can be noticed that there is no single theory that covers all the factors affecting cybersecurity behavior. Understanding the strengths and limitations of each theory enables future research to consider various perspectives through the development of hybrid theoretical models. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Theories/Models** & **Strengths** & **Limitations** \\ \hline \multirow{6}{*}{\begin{tabular}{c} Protection \\ Motivation Theory \\ (PMT) \\ \end{tabular} } & \multirow{6}{*}{\
\begin{tabular}{c} PMT explains how people respond to fear \\ appeals. It considers two elements related \\ to protection motivation: threat appraisal \\ and coping appraisal [54]. Cybersecurity \\ behavior studies have shown that PMT \\ effectively changes behavior [55]. \\ \end{tabular} } & \multirow{6}{*}{
\begin{tabular}{c} PMT fails to consider environmental elements, which affect \\ behavior. For example, it does not consider the effect of social \\ norms. Additionally, it does not consider cognitive variables \\ influencing decision making. For instance, it does not \\ consider the role of experience in behavior [56]. PMT also \\ lacks consideration of individual differences [18]. PMT \\ assumes everyone responds to threats similarly, but this is not \\ always true. This is because individuals have different \\ perceptions of what is threatening, and their reactions may \\ vary based on their past experiences, beliefs, and attitudes. \\ \end{tabular} } \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Strengths and limitations of prominent theories and models.