When Risk Awareness Is Not Enough: The Role of Threat Perception in Cybersecurity Behavior among Digital Executives

Abstract

Purpose: Increasing cyber incidents show that organizational security depends not only on technology but also on human decision-making. However, prior behavioral cybersecurity research provides limited evidence on how technically experienced professionals translate cyber risk awareness into protective action. Drawing on the Technology Threat Avoidance Theory (TTAT) and the Behavioral Cybersecurity Framework (BCF), this study identifies the cognitive determinants of Cybersecurity Behavior (CSB) and examines the mediating role of Threat Perception (TP).
Methodology: A quantitative, cross-sectional, post-positivist study analyzed six constructs using Partial Least Squares Structural Equation Modeling (PLS-SEM). Data were collected through non-probabilistic sampling from 311 digital executives in Lima, Peru. Importance–Performance Map Analysis (IPMA) identified managerial priorities.
Results: TP directly influenced CSB (? = 0.305, p = 0.002) and significantly mediated the effect of Severity Perception (SP) (? = 0.165, p = 0.006). Privacy Concern (PC) and Risk Perception (RP) were non-significant. The model explained 15.0% of CSB variance (R² = 0.150), while IPMA identified Response Costs (RC) as the main managerial improvement opportunity.
Implications: Cybersecurity interventions should strengthen the perceived relevance of cyber threats while reducing operational barriers, extending TTAT by showing that severity awareness alone does not activate protective behavior among technically experienced executives.
Originality: Using evidence from digital executives in an emerging economy, this study shows that technical expertise alone does not ensure secure behavior. Threat Perception bridges the gap between risk awareness and protective action, extending behavioral cybersecurity theory in expert decision-making contexts.