Abstract:Deterrence theory has been widely adopted in the study of information security management; however, evidence frequently presents sometimes contradictory results. Prior meta-analytic studies have focused primarily on the use of formal deterrence constructs to predict security-compliant behavior, while informal deterrence constructs and security-risk behavior are often neglected as a result. This study aims to meta-analyze the relationships formed between both formal/informal deterrence constructs and security-compliant/risk behaviors in a comprehensive manner beyond what has taken place in prior IS security meta-analysis based on deterrence theory. By searching multiple electronic databases, we have located 40 studies, along with 108 effect sizes, pertinent to our study's purpose. Inverse variance method weighted with sample sizes was used to determine mean effect sizes. The random-effects model was used to report meta-analysis results since Q, I2, and H index showed some degree of heterogeneity existent in the collected data. Publication bias was assessed by means of fail-safe N. All proposed relationships occurring between formal/informal deterrence constructs and security-compliant/-risk behaviors were supported. Formal deterrence constructs exerted weak to moderate effects on security behavior, while informal deterrence constructs exerted moderate to strong effects on security behavior. Further, informal deterrence constructs showed greater mean effect sizes than formal deterrence constructs. Additionally, prediction intervals of deterrence constructs, along with detection certainty, included zero, which indicated that moderators may be present. Based on these findings, the mean effect sizes of deterrence constructs may be more clearly identified when dividing security behavior into both compliant- and risk- behaviors. Further moderators might be employed to improve the inconsistent findings evidenced in deterrence theory.

Does One Size Fit All? Examining the Differential Effects of IS Security Countermeasures

A Meta-Analysis of Deterrence Theory in Information Security Policy Compliance Research

A meta-analysis of the deterrence theory in security-compliant and security-risk behaviors

Information Security Policy Noncompliance: an Integrative Social Influence Model.

Effects of Security Knowledge, Self-Control, and Countermeasures on Cybersecurity Behaviors

Does Deterrence Work in Reducing Information Security Policy Abuse by Employees?

Leveraging fairness and reactance theories to deter reactive computer abuse following enhanced organisational information security policies: an empirical study of the influence of counterfactual reasoning and organisational trust

Cognitive Elaboration on Potential Outcomes and Its Effects on Employees' Information Security Policy Compliance Intention-Exploring the Key Antecedents.

Common Misunderstandings of Deterrence Theory in Information Systems Research and Future Research Directions

Examining the Boundary Effect of Information Systems Security Behavior under Different Usage Purposes

The effects of knowledge mechanisms on employees' information security threat construal

It ain't my business: a coping perspective on employee effortful security behavior.

Deterrence and prevention-based model to mitigate information security insider threats in organisations

Individual and Contextual Variables of Cyber Security Behaviour -- An empirical analysis of national culture, industry, organisation, and individual variables of (in)secure human behaviour

Threats and countermeasures for information system security: A cross-industry study

Cognitive‐affective drivers of employees' daily compliance with information security policies: A multilevel, longitudinal study

Perceived Formal and Informal Sanctions in Deterring Cybercrime in a College Sample

Factors Affecting Perception of Information Security and Their Impacts on IT Adoption and Security Practices.

Hospital Staff’s Adherence to Information Security Policy: A Quest for the Antecedents of Deterrence Variables

Examining the Differential Effectiveness of Fear Appeals in Information Security Management Using Two-Stage Meta-Analysis

The influence of social education level on cybersecurity awareness and behaviour: a comparative study of university students and working graduates