Abstract:Deterrence theory has been widely adopted in the study of information security management; however, evidence frequently presents sometimes contradictory results. Prior meta-analytic studies have focused primarily on the use of formal deterrence constructs to predict security-compliant behavior, while informal deterrence constructs and security-risk behavior are often neglected as a result. This study aims to meta-analyze the relationships formed between both formal/informal deterrence constructs and security-compliant/risk behaviors in a comprehensive manner beyond what has taken place in prior IS security meta-analysis based on deterrence theory. By searching multiple electronic databases, we have located 40 studies, along with 108 effect sizes, pertinent to our study's purpose. Inverse variance method weighted with sample sizes was used to determine mean effect sizes. The random-effects model was used to report meta-analysis results since Q, I2, and H index showed some degree of heterogeneity existent in the collected data. Publication bias was assessed by means of fail-safe N. All proposed relationships occurring between formal/informal deterrence constructs and security-compliant/-risk behaviors were supported. Formal deterrence constructs exerted weak to moderate effects on security behavior, while informal deterrence constructs exerted moderate to strong effects on security behavior. Further, informal deterrence constructs showed greater mean effect sizes than formal deterrence constructs. Additionally, prediction intervals of deterrence constructs, along with detection certainty, included zero, which indicated that moderators may be present. Based on these findings, the mean effect sizes of deterrence constructs may be more clearly identified when dividing security behavior into both compliant- and risk- behaviors. Further moderators might be employed to improve the inconsistent findings evidenced in deterrence theory.

Effects of Security Knowledge, Self-Control, and Countermeasures on Cybersecurity Behaviors

The effects of knowledge mechanisms on employees' information security threat construal

Fostering Security Providing Leadership: A Resource to Safeguard Against Employee Burnout

Assessing the Moderating Effect of Security Technologies on Employees Compliance with Cybersecurity Control Procedures

Assessing Information Security Competencies of Firm Leaders towards Improving Procedural Information Security Countermeasure: Awareness and Cybersecurity Protective Behavior

Leveraging fairness and reactance theories to deter reactive computer abuse following enhanced organisational information security policies: an empirical study of the influence of counterfactual reasoning and organisational trust

Individual and Contextual Variables of Cyber Security Behaviour -- An empirical analysis of national culture, industry, organisation, and individual variables of (in)secure human behaviour

Does One Size Fit All? Examining the Differential Effects of IS Security Countermeasures

Assessing the Factors Influencing Cybersecurity Effectiveness: A PLS-SEM Approach

Information security policies compliance in a global setting: An employee's perspective

Deterrence and prevention-based model to mitigate information security insider threats in organisations

Cognitive Elaboration on Potential Outcomes and Its Effects on Employees' Information Security Policy Compliance Intention-Exploring the Key Antecedents.

Studying Users' Computer Security Behavior: A Health Belief Perspective

A meta-analysis of the deterrence theory in security-compliant and security-risk behaviors

Driving Behaviour Change with Cybersecurity Awareness

It ain't my business: a coping perspective on employee effortful security behavior.

Organizational Citizenship Behavior Regarding Security: Leadership Approach Perspective.

Cybersecurity compliance behavior: Exploring the influences of individual decision style and other antecedents

Eyes wide open: The role of situational information security awareness for security‐related behaviour

Psychological Capital and Information Security Policy Compliance

The Role of Rational Calculus in Controlling Individual Propensity Toward Information Security Policy Non-Compliance Behavior.