Universities across the globe are experiencing a surge of cyberattacks due to the increased usage of information communication technologies (ICTs). To counteract cyberattacks, universities have implemented cybersecurity measures to ensure that students and the universities’ critical infrastructures are protected. Unfortunately, universities in developing countries continue to face increased cyberattacks despite implementing cybersecurity measures. This study explores the factors that affect students’ compliance with universities’ cybersecurity measures.The study used a case of the University of Cape Town in South Africa, adopting qualitative research and an interpretive paradigm. We used a deductive approach to theory using Protection Motivation Theory (PMT) as the lens for inquiry. The sample for the study consisted of 40 participants, of which 35 were students and five were staff members of the University. The sample of the study was selected by convenience. We collected empirical data from the participants using semi-structured interviews. The data was then analysed using thematic analysis on NVivo software. The study found that students’ compliance with cybersecurity measures is affected by their perceptions of the seriousness of the threats, the likelihood of the threats happening, their ability to protect themselves against threat, their belief in the effectiveness of the recommended solutions against cyber threats, and the costs associated with compliance to cybersecurity measures. When students perceive the risk as not severe enough to worry about, they do not find it necessary to comply with the University’s cybersecurity measures. Similarly, when the students deem that the recommended compliance actions will not be practical or affordable, they do not adhere to the university cybersecurity measures.