Threat Perceptions, Avoidance Motivation and Security Behaviors Correlations ()
1. Introduction
The purpose of the study was to examine the relationship between Millennials’ perceptions of cybersecurity threat, users’ online security behaviors and avoidance motivation. The study focused on Millennials as the target population. A thorough review of the factors influencing the perceptions of cybersecurity threat supported the examination of the relationship between perceived threat, users’ online security behaviors, and avoidance motivation. The health belief model served as the theoretical foundations to develop a model to examine the relationship between perceptions of cybersecurity threat, users’ online security behaviors, and avoidance motivation. The theoretical framework allowed for a better understanding of how computer users perceived threat of a cyber-attack and the correlation between this factor, the online security behaviors and avoidance motivation that Millennials manifested on the internet. A quantitative approach supported the examination of the problem and the collection of the data. The investigation method was based on a web-based survey to gather data and test the model adapted from the health belief model. The survey provided insights into Millennials’ threat perception, online security behaviors, and avoidance motivation.
The growing interest that researchers have in users’ perceptions of cybersecurity risks is because individuals, as well as organizations, have become more dependent on technology and the internet to accomplish daily operations [1] [2]. The reliance on technology exposes users to various forms of cyber-attacks [1] [2] [3]. The increased use of the internet caused by users demanding great service delivery via the internet has made secure computing and cybersecurity a chief concern [4]. The US government has established a cyber command within the military whose mission is to protect against cyber-attacks from adversaries [5]. The public and private sectors seem to pay less attention to secure computing and cybersecurity practices [4]. The public sector relies on observations, friends, and media to assist with cyber defense strategies [6] [7] [8] [9].
Researchers in information security discipline have leveraged theories from other disciplines to study information security phenomena. The application of the theories in information security has been the subject of a lot of criticism [10]. Scholars have found that the findings based on the protection motivation theory within the information security literature are inconsistent with theoretical expectations [11].
Researchers used the health belief model to explain phenomena in information security [12]. Reference [13] used the health belief model to analyze home personal computer security adoption behavior. Reference [14] used the health belief model to examine user computer security behaviors. Both studies do not test the relationship between perceived threat, users’ security behaviors and avoidance motivation. Both studies omitted perceived threat as an element impacting security behaviors. Reference [15] used the health belief model to examine home computer users’ security awareness, information privacy, and security behaviors. The study solely relied on constructs from the health belief model and did not present any correlation between threat perception and security behaviors. Reference [15] focused security awareness, information privacy and their impact on home computer users’ security behaviors.
The study contributed to a better understanding of the relationship between Millennials’ perceptions of threat, cybersecurity practice, users’ online security behaviors, and avoidance motivation. As a significant group of the population, Millennials constitute an essential part of the workforce for most organizations [16]. Millennials are the savviest generation regarding the use of information technology products [17] [18] [19]. The significance of the study was that it partially addresses security managers’ concerns regarding the lack of studies on Millennials’ security-related perceptions and behaviors [20]. There was a gap of knowledge on the understanding of the relationship between Millennials’ perceptions of threat, cybersecurity practice, users’ online security behaviors, and avoidance motivation. The study can help government agencies, businesses, and scholars understand Millennials’ perception of cybersecurity threat, their online security behaviors and avoidance motivation. Organizations must understand users’ online security behaviors and avoidance motivation to develop adequate training and policies materials [21]. The findings of the study can support the development of security tools and training tailored to Millennials. Researchers, scholars, and practitioners can take advantage of the study by using the knowledge gained to implement new measures that promote safe online behaviors. Scholars and researchers can build on the results of the study to develop new tools to improve information security.
In the following sections, the paper presents a discussion from scholars and researchers on a holistic approach to the importance of understanding threat perceptions to explain behaviors and motivation. The paper examines the role that perceptions of threat played in shaping online security behaviors and avoidance motivation. The paper presents a description of the methodology used, data analysis, and results.
2. Review of the Literature
2.1. Millennial Cybersecurity Posture
With the excessive number of cyber-attacks, ensuring the security of computer systems continues to be a challenge to organizations as well as to individuals. In the first quarter of 2016 report, the Anti-Phishing Working Group stated that the total number of unique phishing websites observed was 289,371. The number grew steadily from 48,114 in October 2015 to 123,555 observed in March 2016. The increase represents a 250% jump over six months [22]. Reference [23] reported that in 2016, there were 1209 total breaches with 1.1 billion identities exposed. Most Millennials have risky online security behaviors [24]. Reference [25] reported that as much as 66% of Millennials have connected to a public Wi-Fi network in previous months, and 42% shared a password with a non-family member in 2016. Millennials need to know the type of cyber-attacks they are vulnerable to and how their perceptions of cybersecurity threat affect their security behavior online [26]. Twenty percent of the surveyed participants have never changed the online banking password, and many Millennials use the same password to sign into different accounts/websites. Millennials often skip two-step authentications when they are available and engage in other risky behaviors [25]. It is not clear how the users’ perceptions of cybersecurity threat influence online security behaviors [20].
2.2. Risk Perception in the Cyberspace
Media outlets increasingly report cyber-attacks and incidents. Every month, there are reports of significant incidents affecting hundreds of thousands of users [27]. Despite these reports, it is unclear if Millennials have the requisite knowledge to protect themselves [28]. Some users might have a false sense of security and expose themselves to security risks as a result [29]. The increased number of data breaches through hacking incidents has become a phenomenon of interest for internet security researchers [30]. As the breaches are targeting more online shopping sites, it is likely that users’ knowledge and perceptions of the internet have changed over time [31] [32]. Although internet users are conscious of the potential cyber threats, it does not prevent them from connecting their computers and other smart devices to the internet [33].
Security awareness is one of the essential elements of information security management [34] [35]. Security awareness is the extent to which the members of an organization understand the importance of information security, individual responsibilities, and the minimum security required by the organization and behave accordingly. Today, practitioners and researchers agree that security awareness is critical to a successful and effective information security management and that it will be more cost-effective to invest in security awareness improvement than technology [36] [37]. The current knowledge of security awareness is limited because researchers have not studied the behavioral aspect of security awareness and its operationalization and conceptualization in existing research have been too broad for the most part [34].
2.3. Health Belief Model
In past security behavioral research, the research relies on constructs developed under the health belief model [14] [38]. Perceived severity, perceived susceptibility, perceived threat, perceived benefits, perceived barriers, cues to action, general security orientation, and self-efficacy are all factors in human behaviors. All these constructs have a particular influence on the security behaviors of computer end-users [15]. Cybersecurity awareness of risks influences users’ attitudes and behaviors toward safety [39] [40]. Most of the studies conducted on the use of the internet and users’ risk perceptions focused on scenarios that identified some of the variables in the risk equation as opposed to the type of threat that exists on the internet [41]. Studies that focused on the social impact of cyber-attacks are rare [42]. Below is outlined the construct under the health belief model which represent the dependent variable examined in the study:
Perceived threat. The construct defines the result of the individual’s assessment of one susceptibility and the severity of the danger or disease [43]. The same construct applies in the cyberspace, where cyber-threats can impact internet users in various ways [44].
Below is a view of the theoretical framework (Figure 1).
3. Methodology and Data Analysis
3.1. Methodology
The quantitative methodology supported the approach of the study. In a quantitative method, applying deductive reasoning with the results and responses allows to move from specific to general [45]. Reference [46] developed a survey instrument (see Appendix A) that served as a basis to develop the survey instrument for the study. The researcher had received permission from the authors to use and modify the survey instrument. Validity and reliability are essential elements of a quantitative methodology [47]. A quantitative methodology fits because the variables to measure and the results are numerical data [48]. Quantitative methodology was appropriate as it is evidence-based practice in psychology and used to measure the changes in variables [49].
Survey research was appropriate because of the examination of the relationship between variables [50]. The objective was to examine the relationship between the perceptions of cybersecurity threat, users’ online security behavior and avoidance motivation of Millennials. An analysis of the correlation helped determine the relationship between variables and make predictions [51].
3.2. Research Questions and Hypothesis
The dependent variables were the users’ online security behaviors (OSB) and avoidance motivation. The independent variable was perceived threat (PTH).
3.2.1. Research Questions
RQ1: What is the relationship between Millennial’s perceived threat of malware and users’ online security behaviors?
RQ2: What is the relationship between Millennial’s perceived threat of malware and users’ avoidance motivation?
3.2.2. Hypotheses
H1o: A correlation does not exist between Millennials’ perceived threat and users’ online security behaviors.
H1A: A correlation does exist between Millennials’ perceived threat and users’ online security behaviors.
H2o: A correlation does not exist between Millennials’ perceived threat and users’ avoidance motivation.
H2A: A correlation does exist between Millennials’ perceived threat and users’ avoidance motivation.
3.3. Population and Sample
The population of research represents the group targeted, or the group referred to in the conclusion [52]. The population was Millennial in the United States who met a set of criteria as defined below. Millennials represent the largest generation in the US labor force, with more than one third participating in the labor force. As of 2017, roughly 35% or 35 million of Millennials were looking for work or working [53]. The population included Millennial professionals among Survey Monkey audience, who own a computer and have regular access to the internet. The study did not focus on a specific industry, and the participants had to be employed to meet the professionalism criteria. For the purpose of the study, a professional was defined as someone who uses professional knowledge and skills to address the issues that arise in the workplace [54]. Therefore, the target population criteria included: 1) any Millennials, which refers to individuals born between 1982 and 2000 [55], 2) participants must have a current job, 3) participants must own a computer, 4) participants must have regular access to the internet, and 5) participants must be accessible through the Survey Monkey platform. Survey Monkey has over 2.5 million daily respondents answering surveys on the platform [56]. The target population represented all the respondents on the platform who met the criteria above. The researcher did not obtain an estimation of the target population since Survey Monkey could not provide an estimate of how many Survey Monkey users met criteria a through d. The information collected from each participant during the survey process served as the primary data.
The sample size was determined by using the ANZMTG Statistical Decision Tree, which is a sample calculator that leverages the power calculation for Pearson’s and Spearman’s correlation method. The ANZMTG Statistical Decision Tree is a tool used to determine the sample size in function of the predefined criteria inputted in the tool. The tool confirmed that a sample size of 38 participants was appropriate with a power of 1 − β = 0.9, a correlation coefficient of ρ = 0.5 for a large effect size, and a significance level of α = 0.05, which are the only criteria relevant to calculating the sample size for the Spearman’s correlation test [57] [58] [59]. With the given parameters, the ANZMTG Statistical Decision Tree analysis tool indicated a 90% confidence of obtaining the correct result if the study was repeated with different random samples. Additionally, the level of significance indicated that there is only a 5% risk of false-positive findings with a total sample size of 38 participants for a Spearman’s correlation test [59] [60]. To ensure greater reliability of the findings, the author went beyond the recommended sample size and conducted the study with a sample size of 109 participants.
3.4. Data Collection
Participants received a clear and unambiguous statement regarding the voluntary nature of the survey. Also, the statement expressed the researcher’s commitment to ensuring the participants’ anonymity and the protection of PII. Survey Monkey served as a medium to collect data. The data collection process followed a sequence of ten steps as described below:
Step 1. The authors of the survey instrument (see Appendix A) leveraged for the study have granted permission to use and potentially modify the survey instrument selected. The instrument (Likert-type scales) was previously validated in previous studies [46]. In several studies, researchers have developed surveys by combining surveys or using questions from previously validated survey instruments [14] [61] [62].
Step 2. Modifications to the survey instrument consisted of replacing a word such as spyware with malware. The modifications were limited and did not affect any of the significant elements of the survey instrument. The modifications strengthened the content validity which is considered mandatory [63]. Content validity refers to the level to which inferences are legitimate to operationalize the theoretical constructs in the study [64].
Step 3. Survey Monkey was the platform used to conduct the survey. The researcher sent a letter to request permission and received authorization to use the Survey Monkey website.
Step 4. A Survey Monkey account was created to gain access to the products offered on the website. The survey instrument was created using a custom survey creation builder available on the Survey Monkey website.
Step 5. Invitations were sent to 155 Millennial who had met the targeting criteria. The invitation included the research topic, instructions on how to complete the survey, and a Uniform Resource Locator (URL) link that redirected participants to the online survey once they clicked on it.
Step 6. Once the potential participants clicked on the URL link in the invitation, they had to review an informed consent form which explained the nature of the research, the security measures in place to protect their anonymity and PII and the survey expectations. Participants had the choice to continue the survey or to exit the website [65].
Step 7. Participants who chose to continue with the survey moved on to the next page, where they had to answer four qualifying questions (see Appendix B) to verify their eligibility to participate.
Step 8. If the participants chose to exit the survey here, the survey did not collect their PII, and they were directed to a thank you page which expresses gratitude for their time. The website also automatically directed the participants who had completed the survey to a thank you page at the end. Survey Monkey saved the answers.
Step 9. At the end of the survey period, all data saved on Survey Monkey databases were downloaded on an external hard drive and analyzed.
Step 10. The data were encrypted and stored in a secure room. The researcher archived the data contained in the hard drive for 5 years [66]. After 5 years, the researcher will destroy the data.
4. Data Analysis
A quantitative, non-experimental, correlational design was the best fit because it facilitated the analysis of the relationship between dependent and independent variables [67]. A quantitative, non-experimental, correlational design supported cause-effect and causal relationship analysis [68]. The research design was useful to analyze strategies [69]. Correlation allowed the identification of the relationship that may exist between two or more variables [68]. The data analysis process followed a sequence of five steps as described below:
Step 1. A valid copy of SPSS (Statistical Package for Social Sciences) was obtained. SPSS was the statistical tool of choice to analyze the data collected. The data were analyzed using correlation analysis.
Step 2. All the data were entered into SPSS for non-parametric Spearman correlation analysis. Spearman’s correlation was appropriate for the study as the variables were measured on scales that were ordinal, and the data were considered non-parametric [70]. The study met the three assumptions necessary for the use of Spearman’s correlation test. All the variables for the study were measured on an ordinal scale, the observation values for the variables were paired, and there was a monotonic relationship between each pair of variables. Even if a monotonic relationship is difficult to observe, a Spearman correlation test still apply [71].
Step 3. The coefficient of correlation indicated the direction and strength of the relationship between the dependent and independent variables. It allowed for a better appreciation of the influence that one variable had on the other when there was a change in value. The measure of the coefficient of correlation supports all appropriate inferences to the general population [72]. The independent variables considered were perceived threat. The dependent variables were users’ online security behaviors and avoidance motivation. The calculation of the coefficient of correlation helped to determine the direction and strength of the relationship between each pair of variables. The determination was based on the following measures: 1) 0.00 - 0.19 is considered as “very weak”, 2) 0.20 - 0.39 is “weak”, 0.40 - 0.59 is “moderate”, 0.60 - 0.79 is “strong”, and 0.80 - 1.0 is “very strong” [73].
Step 4. An interpretation of the statistical metrics such as median, mean, mode, standard deviation, variance, and count of information presented descriptive statistics of the sample. The non-parametric Spearman correlation analysis supported the decision of whether to reject or fail to reject each null hypothesis using a p-value threshold p < 0.05 to determine the level of significance.
Step 5. Additional analysis was conducted using the data collected with the second group of demographic questions which inquired about the participant’s: 1) age group, 2) gender, 3) region, 4) household income, and 5) internet experience. The analysis aimed at identifying any trends related to each demographic category and to compare between categories and the independent variable. For the purpose of the study, avoidance behavior was relabeled as online security behaviors for data analysis.
4.1. Participant Demographics
The Survey Monkey website provided the researcher with the platform to administer the survey to the participants of the study. The targeted audience for the study included Millennial with or without a college degree, 35 job functions from writer to researcher, 19 options for industry from advertising and marketing to utilities/energy/extraction, and five job levels (owner/executive/C-level, senior management, middle management, intermediate, and entry-level). The first page of the survey contained the informed consent form. Participation in the survey required that each participant agreed to the consent form by clicking the “Yes” box to proceed to the next page where the participant had to answer three qualifying questions. The qualifying questions served as a second layer of screening. Participants who met the criteria had to answer “Yes” to each of the four questions to start answering the survey questions. Any selection of the “No” box on either page (informed consent or qualifying criteria) automatically disqualified the participant.
The demographic question of the survey focused on participants’ number of years of internet experience. All the participants in the survey were Millennial. Participants had a diverse background, as they came from various regions within the United States and represented a broad spectrum of industry sectors. Survey Monkey website provided the platform through which the survey questions were administered. The participants were all members of the Survey Monkey pool of active users or panelists. In addition to the demographic question within the survey, Survey Monkey collected a few demographic data regarding the participants’ age, gender, household income, region, and device type. The additional demographic questions were added to the survey questions for all participants to answer.
4.2. Presentation of the Data
The researcher downloaded and stored the data collected through the Survey Monkey website on a personal computer. The data was saved in an SPSS format/file and subsequently imported into SPSS Statistics Standard GradPack 24 for descriptive and correlation analysis. Participants’ responses were organized into a demographic section and correlational statistics section. The demographic section presented the data about the participants’ age group, gender, region, household income, and internet experience. The correlational variables section presented the result of the data preparation analysis and the correlation test.
A total of 155 participants agreed to take the survey study. From the total number of participants, four participants were disqualified because they did not agree to the Informed Consent form, 19 participants were disqualified because they did not meet the qualifying criteria, 23 of the participants who consented and qualified to participate in the study did not complete the survey. The remaining 109 participants who completed the survey represented the sample study. The researcher a larger sample even though the recommended sample size was determined with a power of 1 − β = 0.9, which indicates a 90% confidence of obtaining the correct result if the study was repeated with different random samples. The power selected is superior to the minimum recommended value. Additionally, the significance level of α = 0.05 met the recommended value for most academic studies [59].
Before starting the analysis of the data collected for the study, it was essential to measure and assess the reliability of the survey instrument. Cronbach’s alpha test helped verify the survey instrument reliability. Cronbach’s alpha is an appropriate test to measure the internal consistency and reliability of a research instrument [74]. The survey instrument centered around 44 statements which constituted the core questions in the survey. The core questions included: 1) five statements measuring the perceived susceptibility construct on a 7-point Likert scale, 2) ten statements measuring the perceived severity construct with a 7-point Likert scale, 3) five statements measuring the perceived threat construct with a 7-point Likert scale, 4) six statements measuring the perceived benefits construct with a 7-point Likert, 5) three statement measuring the perceived barriers construct with a 7-point Likert scale, 6) ten statement measuring the self-efficacy in cybersecurity with a 10-point Likert scale, and 7) three statements measuring the avoidance motivation construct with a 7-point Likert scale, and 8) two statements measuring the online security behaviors construct with a 7-point Likert scale.
A Cronbach’s alpha test was performed to measure the internal validity and reliability of each variable considered in the study. Because the study examined several constructs, a test was performed for each variable to avoid inflating the value of alpha [75]. Reference [76] agreed that a Cronbach’s alpha value 0.70 or above indicates an acceptable level of internal consistency and reliability. Reference [75] indicated that a Cronbach’s alpha value between 0.70 and 0.95 is desirable to support the internal consistency and reliability of an instrument. A higher value may indicate redundancy in the instrument but is still reliable. Other researchers agreed that to confirm internal consistency reliability, the Cronbach alpha value should be at least 0.60 for exploratory studies and 0.70 for confirmatory studies [60]. Reference [77] indicated that 0.70 should be considered as an acceptable reliability coefficient.
An alpha value of 0.839 was measured for the five original questions for perceived threat (see Table 1). A coefficient greater than 0.8 is considered as good. This value indicates that there is a good internal consistency of the items in the scale measuring the perceived threat variable [78] [79].
![]()
Table 1. Perceived threat reliability statistics.
An alpha value of 0.969 was measured for the three original questions for avoidance motivation (see Table 2). An alpha value greater than 0.9 is considered as excellent and indicates excellent internal consistency within the survey instrument measuring the avoidance motivation variable [79].
![]()
Table 2. Avoidance motivation reliability statistics.
An alpha value of 0.926 was measured for the two original questions for online security behaviors (see Table 3). A coefficient greater than 0.9 is considered as excellent. This value indicates that there is an excellent internal consistency of the items in the scale measuring the online security behaviors variable [79].
![]()
Table 3. Online security behaviors reliability statistics.
4.3. Descriptive Analysis and Demographic Results
Table 4 presents the frequency distribution of the participants’ number of years of internet experience. The table shows the different ranges under which each participant identified. Most participants had over 20 years of internet experience representing 45.0% of the sample. Participants representing 42.2% of the sample had between 11 and 20 years of internet experience, followed by 12.8% with 6 to 10 years of internet experience (see Table 4).
Table 5 presents the frequency distribution of all the participants’ age. Given that the sample only included Millennials, the age range could only vary between 19 to 37. The table shows that only two age groups were represented in the sample. Participants between the age of 25 to 29 had the highest percentage with 56.9% while the remaining of participants identified between 19 to 24 with 43.1% (see Table 5).
Table 6 presents the frequency distribution of the gender of all the participants. The table shows that most participants were female representing 67.9% of the sample. Male represented 32.1% of the participants (see Table 6).
Table 7 presents the frequency distribution that provides an insight into the income range of the participants. The table represents the household income of participants. Most participants earned from $50,000 - $74,999 representing 32.1%, while 21.1% earned from $25,000 - $49,999, and 18.3% earned from $75,000 - $99,999 (see Table 7).
4.4. Data Preparation and Screening Analysis
Table 8 presents the frequency distribution related to participants’ perceived threat of a cyber-attack. The result included a total of 109 values corresponding to the sample size. There was no missing value, as each participant answered all the questions.
Table 9 presents the frequency distribution related to participants’ avoidance motivation by using anti-virus software. The result included a total of 109 values corresponding to the sample size. There was no missing value, as each participant answered all the questions.
Table 10 presents the frequency distribution related to participants’ online security behaviors of using anti-virus software. The result included a total of 109 values corresponding to the sample size. There was no missing value, as each participant answered all the questions.
The researcher performed calculations to determine the mean, median, mode standard variation, and variance of each variable in examining the relationship between Millennials’ perception of threat and users’ avoidance motivation and online security behaviors. The survey questions were assessed using Likert scale ordinal variables with the following weighted formats: 1 = “strongly disagree”, 2 = “disagree”, 3 = “somewhat disagree”, 4 = “neither agree nor disagree”, 5 = “somewhat agree”, 6 = “agree”, and 7 = “strongly agree”. Table 11 presents the result of the analysis, which indicates that perceived threat had the highest mean score (M = 5.44) of all the variables measured with a 7-point Likert scale. The mean indicates a substantial degree of likelihood that users may be more influenced by their perceptions of threat in adopting good online security behaviors. An assessment of the standard deviation indicates that users’ online security behavior had the highest average distance from the mean (M = 4.36) with σ = 2.053, which indicates that participant online security behaviors were more spread out.
a. Multiple modes exist. The smallest value is shown.
Factor analysis test was performed to allows the researcher to determine if factor extraction is necessary for data reduction by exploring the structure of the data [80]. The analysis was conducted on three factors (perceived threat, avoidance motivation, and online security behaviors) to determine the existence of variability between the set of elements. The scree plot below was used to make a determination. Reference [81] stated that in a scree plot, the eigenvalues are plotted in descending order against the factor numbers. The researcher inspected and counted the different values (corresponding the eigenvalue superior to 1) before the last drop to determine the number of factors. The following figures present the results obtained for each variable.
Figure 2 shows that only one component had an eigenvalue greater than one. Table 12 shows that one component explained 61% of the variance within the perceived threat variable. One item had the most impact on the variance.
![]()
Figure 2. Scree plot of the five statements measuring perceived threat.
![]()
Table 12. Perceived threat total variance explained.
Figure 3 shows that only one component had an eigenvalue greater than one for avoidance motivation. Table 13 shows that one components explained 94% of the variance within the avoidance motivation variable. One item had the most impact on the variance.
![]()
Figure 3. Scree plot of the three statements measuring avoidance motivation.
![]()
Table 13. Avoidance motivation total variance explained.
Figure 4 shows that only one component had an eigenvalue greater than one. Table 14 shows that one component explained 93% of the variance within the online security behaviors variable. One item had the most impact on the online security behaviors variance.
![]()
Figure 4. Scree plot of the two statements measuring online security behaviors.
![]()
Table 14. Online security behaviors total variance explained.
Spearman’s correlation was selected as the best fit to analyze the data collected because the research design met the assumptions of the Spearman’s correlation test [71]. First, the variables for the study were measured on an ordinal scale (7-point Likert scale). Second, the variables measured paired observations. Third, there was a monotonic relationship between each pair of variables, which are illustrated in the scatter plots below (see Figure 5 and Figure 6).
![]()
Figure 5. A simple scatter plot of online security behaviors and perceived threat.
![]()
Figure 6. A simple scatter plot of avoidance motivation and perceived threat.
4.5. Research Questions
The two central research questions for the study were: 1) what is the relationship between Millennial’s perceived threat of malware and users’ online security behaviors? 2) what is the relationship between Millennial’s perceived threat of malware and users’ avoidance motivation? The dependent variables were the users’ online security behaviors (OSB) and avoidance motivation (AMO). The independent variable was perceived threat (PTH). In the study, the researchers defined two hypotheses. A test of the two hypotheses helped determine if there was a significant relationship between Millennial’ perceptions of threat, users’ online security behaviors and avoidance motivation. The central research questions take into consideration the independent variable which produces the following research questions and hypotheses:
The first question and corresponding hypotheses developed in the study were the followings:
RQ1: What is the relationship between Millennial’s perceived threat of malware and users’ online security behaviors?
H1o: A correlation does not exist between Millennials’ perceived threat and users’ online security behaviors.
H1A: A correlation does exist between Millennials’ perceived threat and users’ online security behaviors.
Table 15 presents the result of the Spearman’s correlation test, which showed that the coefficient correlation was 0.098, and the two-tailed significance level was 0.309. The finding showed that a very weak positive correlation existed between perceived threat and online security behaviors, and there was not a statistically significant relationship (ρ = 0.098, 0.309 > 0.05). The result from the statistical test provided enough evidence to fail to reject the null hypothesis (H1o) in support of the study.
![]()
Table 15. Spearman’s correlation between PTH and OSB.
The second question and corresponding hypotheses developed in the study were the followings:
RQ2: what is the relationship between Millennial’s perceived threat of malware and users’ avoidance motivation?
H2o: a correlation does not exist between Millennials’ perceived threat and users’ avoidance motivation.
H2A: a correlation does exist between Millennials’ perceived threat and users’ avoidance motivation.
Table 16 presents the result of the Spearman’s correlation test, which showed that the coefficient correlation was 0.225, and the two-tailed significance level was 0.019. The finding showed that a weak positive correlation existed between perceived threat and avoidance motivation, and there was a statistically significant relationship (ρ = 0.225, 0.019 < 0.05). The result from the statistical test provided enough evidence to reject the null hypothesis (H2o) in support of the study.
![]()
Table 16. Spearman’s correlation between PTH and AMO.
*Correlation is significant at the 0.05 level (2-tailed).
5. Findings and Conclusions
5.1. Implications for Practice
The problem addressed in the study was that the relationship between Millennials’ perceptions of cybersecurity threat and users’ online security behaviors had not been identified [20]. There was a gap of knowledge on the understanding of the relationship between Millennial perceptions of cybersecurity threat, online security behaviors, and avoidance motivation. The findings of the study showed that a statistically significant correlation does not exist between the independent variable (PTH) and the dependent variable (OSB). On the other hand, the study showed that a statistically significant correlation does exist between the independent variable (PTH) and the dependent variable (AMO). The results of the correlation analysis indicated that Millennial professionals’ perceived threat of a cyber-attack and the motivation to avoid it by installing and using anti-malware have a significant relationship. Enterprise leaders can leverage these findings and consider how they impact their organization’s security posture. The study provides valuable insight into the Millennials’ perceptions of cybersecurity threat. The knowledge gained from the study can help enterprise leaders tailor information assurance training for their Millennial staff as 45% of the participants agreed that malware presented a danger to their security.
5.2. Conclusions
A Spearman’s correlation analysis was performed to determine the strength of the relationship between the independent variable (PTH) associated with cybersecurity risk perceptions, users’ online security behaviors and avoidance motivation. Spearman’s correlation was selected as the best statistical test because the study met the three assumptions necessary for the use of Spearman’s correlation test. All the variables for the study were measured on an ordinal scale, the observation values for the variables were paired, and there was a monotonic relationship between variables.
The research questions for the study inquired about the relationship between the construct associated with Millennials’ perceptions, users’ online security behaviors and avoidance motivation. To answer these questions, the researcher developed two central research questions based on the independent variable: perceived threat (PTH); and the dependent variables which were online security behaviors (OSB) and avoidance motivation (AMO).
The first research question examined the relationship between Millennials’ perceived threat and users’ online security behaviors. The corresponding hypotheses were as follows: The null hypothesis (H1o): A correlation does not exist between Millennials’ perceived threat and users’ online security behaviors. The alternative hypothesis (H1A): A correlation does exist between Millennials’ perceived threat and users’ online security behaviors. Table 15 presented the result of the Spearman’s correlation test, which showed that the coefficient correlation was 0.098, and the two-tailed significance level was 0.309. The finding showed that a very weak positive correlation existed between perceived threat and online security behaviors, and there was not a statistically significant relationship (ρ = 0.098, 0.309 > 0.05). The result from the statistical test provided enough evidence to fail to reject the null hypothesis (H1o). Additional studies are required to support this finding given that studies on users’ avoidance motivation are limited and do not directly address the relationship between perceived threat and avoidance motivation in a cybersecurity context.
The second research question examined the relationship between Millennials’ perceived threat and users’ avoidance motivation. The corresponding hypotheses were as follows: The null hypothesis (H2o): A correlation does not exist between Millennials’ perceived threat and users’ avoidance motivation. The alternative hypothesis (H2A): A correlation does exist between Millennials’ perceived threat and users’ avoidance motivation. Table 16 presented the result of the Spearman’s correlation test, which showed that the coefficient correlation was 0.225, and the two-tailed significance level was 0.019. The finding showed that a weak positive correlation existed between perceived threat and avoidance motivation, and there was a statistically significant relationship (ρ = 0.225, 0.019 < 0.05). The result from the statistical test provided enough evidence to reject the null hypothesis (H2O) in support of the study. This finding is consistent with findings elsewhere [48]. Reference [46] found that perceived threat positively affects avoidance motivation. This can inform businesses looking to sell anti-malware software to potential users. Governments, policy makers, executives and IT managers can rely on the findings when developing policies and cybersecurity awareness campaigns and training aimed at improving users’ cyber threat awareness and motivate users to use security tools.
Acknowledgements
This study has benefited from the contribution received from Dr. Schmitt; whose guidance was instrumental in the completion of this paper. I could not be more grateful to have received and implemented some of her suggestions
Appendix A
Survey Instrument
Appendix B
Survey Questions
Qualifying Questions
1) Were you born between 1982 and 2000?
Yes
No
2) Are you currently employed?
Yes
No
3) Do you own a computer?
Yes
No
4) Do you have regular access to the internet?
Yes
No