The Internet of Things (IoT) is a revolutionary concept that heavily relies on the network infrastructure to connect large number of devices whose main purpose is to collect data and communicate among one another in the bid to enhance their decision-making capabilities. However, with this great evolution comes various challenges that threatens the information technology industry; these include security and privacy issues. The presence of a large number of interconnected technologies open a grey area in the IT field which has been worsened by the lack of capacity of various institutions to identify, assess and monitor important components to ensure compliance with security policies. Thus, there is need for a clear understanding of the issues at hand and how they can be solved in order to fully harness this capability.

Saudi Arabia has a goal of ensuring that it has at least two cities among the top 100 smart cities of the future. However, increasing connectivity and incorporation of smart solutions in cities still raises concerns over cyber security with threats arising daily including denial of services and phishing as some of the most significant. Saudi Arabia, therefore, needs a cybersecurity policy framework that will ensure effective protection for all stakeholders in the smart city from these cyber threats. User acceptance is foremost important in any new technology, including smart-cities. Due to ongoing cyber threats and in the absence of an efficient cyber policies, Saudi end-user community is not keen to accept newer technologies where their interaction with online medium is required. The proliferation of smart cities globally affords the opportunity to analyze and compare the efforts made in Saudi Arabia with other nations like the USA, India and Singapore which is the premier smart city model in the globe currently. This review looks at the similarities and differences between KSA’s cyber security policy framework with these three nations. The review will note some of the defining characteristics and approaches to cyber security in the smart cities of USA, India, and Singapore. After reviewing the current framework in Saudi Arabia, this paper will make suggestions such as updating Saudi’s cybercrime legislation like in the US or formulating a master cyber security plan as seen in Singapore that will improve KSA’s framework creating the best framework model for cyber security in its smart cities.

This study aims to explore the challenges and issues in adopting cybersecurity practices in smart Saudi cities and to develop and validate a newly developed cybersecurity-based unified theory of acceptance and use of technology 3 (UTAUT3) model. The study has a twofold purpose. First, it identified the key challenges and issues in adopting smart cities in Saudi smart cities. Second, it developed a technology-based model to adopt cybersecurity practices in Saudi smart cities. Two surveys were conducted to achieve these objectives. The first survey identified challenges and gaps in adopting cybersecurity practices in smart cities, revealing concerns about weak cybersecurity platforms, privacy breaches, and the impact of IT infrastructure advancements on Saudi culture (N = 554: common public). The second survey focused on developing and validating a cybersecurity-based UTAUT3 model (N = 108: IT professionals), emphasizing nine factors: performance expectancy, effort expectancy, social influence, facilitating conditions, safety, resiliency, availability, confidentiality, and integrity of cybersecurity. The model’s validity and reliability were assessed, demonstrating its potential for understanding user behavior and adoption patterns in smart cities. The study findings provide valuable insights into the factors influencing the adoption of cybersecurity measures in smart Saudi cities, highlighting the need for targeted strategies, effective awareness programs, and collaboration between stakeholders to promote a secure and resilient digital environment. Future research may focus on refining the model, extending its applicability to other regions or countries, and investigating the impact of emerging technologies and evolving cyber threats on user behavior and cybersecurity practices.