The ubiquity of devices connected to the internet raises concerns about the security and privacy of smart homes. The effectiveness of interventions to support secure user behaviors is limited by a lack of validated instruments to measure relevant psychological constructs, such as self-efficacy – the belief that one is able to perform certain behaviors. We developed and validated the Cybersecurity Self-Efficacy in Smart Homes (CySESH) scale, a 12-item unidimensional measure of domain-specific self-efficacy beliefs, across five studies (𝑁 = 1247). Three pilot studies generated and refined an item pool. We report evidence from one initial and one major, preregistered validation study for (1) excellent reliability (𝛼 = 0.90), (2) convergent validity with self-efficacy in information security (𝑟SEIS = 0.64, 𝑝 < .001), and (3) discriminant validity with outcome expectations (𝑟OE = 0.26, 𝑝 < .001), self-esteem (𝑟RSE = 0.17, 𝑝 < .001), and optimism (𝑟LOT−R = 0.18, 𝑝 < .001). We discuss CySESH’s potential to advance future HCI research on cybersecurity, practitioner user assessments, and implications for consumer protection policy.

No abstract

Recent challenges in IT security and privacy have heightened interest in cybersecurity Self-Efficacy (SE) as means to influence security-related behaviors. Based on diverging definitions and underlying theories, research methods vary considerably in the field of cybersecurity SE. This may hinder building a replicable evidence base that serves practitioners to effectively foster cybersecurity SE. We report a preregistered systematic literature review investigating (a) instruments constructed to measure cybersecurity SE, (b) proposed roles of self-efficacy, and (c) methods utilized for manipulative interventions. In addition, special emphasis is placed on smart home research to explore the relevant boundaries of the cybersecurity SE literature in terms of IT context-dependent research methods. The final sample included 174 empirical studies from 18 databases with a combined sample size of 55,758 subjects that were published in English between 2010 and 2021 and measured cybersecurity SE. Effects of selection bias were minimized by detailed exclusion criteria, interdisciplinary search strategy, randomization process, double coding, and transparency scope. Results were synthesized narratively and thematically on a level of descriptive statistics and network analyses. We counted 173 different cybersecurity SE measures and analyzed their psychometric quality with respect to reliability and validity. 276 variables were assumed to be causes and/or outcomes of cybersecurity SE. This review demonstrates the current extent of dividedness in cybersecurity SE research methods. We conclude our review with six recommendations that might inspire our research community toward standardization.