A Decade of Dividedness: A Preregistered Systematic Review of the Cybersecurity Self-Efficacy Methods

Abstract

Recent challenges in IT security and privacy have heightened interest in cybersecurity Self-Efficacy (SE) as means to influence security-related behaviors. Based on diverging definitions and underlying theories, research methods vary considerably in the field of cybersecurity SE. This may hinder building a replicable evidence base that serves practitioners to effectively foster cybersecurity SE. We report a preregistered systematic literature review investigating (a) instruments constructed to measure cybersecurity SE, (b) proposed roles of self-efficacy, and (c) methods utilized for manipulative interventions. In addition, special emphasis is placed on smart home research to explore the relevant boundaries of the cybersecurity SE literature in terms of IT context-dependent research methods. The final sample included 174 empirical studies from 18 databases with a combined sample size of 55,758 subjects that were published in English between 2010 and 2021 and measured cybersecurity SE. Effects of selection bias were minimized by detailed exclusion criteria, interdisciplinary search strategy, randomization process, double coding, and transparency scope. Results were synthesized narratively and thematically on a level of descriptive statistics and network analyses. We counted 173 different cybersecurity SE measures and analyzed their psychometric quality with respect to reliability and validity. 276 variables were assumed to be causes and/or outcomes of cybersecurity SE. This review demonstrates the current extent of dividedness in cybersecurity SE research methods. We conclude our review with six recommendations that might inspire our research community toward standardization.