Establishing a Model for the User Acceptance of Cybersecurity Training

Abstract

Cybersecurity is established as fundamental for organisations and individuals engaging with digital technology. A central topic in cybersecurity is user behaviour, which has been shown to be the root cause or enabler in a majority of all cyber incidents with a resultant need to empower users to adopt secure behaviour. Researchers and practitioners agree that a crucial step in empowering users to adopt secure behaviour is training. Subsequently, there are many different methods for cybersecurity training discussed in the scientific literature and that are adopted in practise. However, research suggests that those training efforts are not effective enough, and one commonly mentioned reason is user adoption problems. In essence, users are not engaging with the provided training to the extent needed to benefit from the training as expected. While the perception and adoption of individual training methods are discussed in the scientific literature, cohesive studies on the factors that impact user adoption are few and far between. To that end, this paper focuses on the user acceptance of cybersecurity training using the technology acceptance model as a theory base. Based on 22 included publications, the research provides an overview of the cybersecurity training acceptance factors that have been discussed in the existing scientific literature. The main contributions are a cohesive compilation of existing knowledge about factors that impact the user acceptance of cybersecurity training and the introduction of the CTAM, a cybersecurity training acceptance model which pinpoints four factors—regulatory control, worry, apathy, and trust—that influence users’ intention to adopt cybersecurity training. The results can be used to guide future research as well as to guide practitioners implementing cybersecurity training.

Keywords

• cybersecurity training
• user security behaviour
• usable security
• security education