Identifying factors influencing the employee's intention with self-protective behaviors against phishing attacks

Information and communication technology (ICT) continues to advance rapidly and has become an integral part of daily life. While ICT helps people do their work quickly, simply, and effectively, it has also enabled mechanisms that, if exploited, can hamper all the benefits ICT has on offer (Desolda et al., 2023). Phishing is one such mechanism that attackers employ to gather sensitive information from victims; this includes, for instance, authentication credentials, encryption keys, among others (Chiew et al., 2018). A phishing attack is a form of social engineering attack, and its vectors include email, messaging services, and social media platforms, etc. Phishing attacks can have significant repercussions, including financial loss, identity theft, and reputational damage. In addition, attackers also use phishing emails to trick victims into installing spyware, impersonating websites, etc. (Harrison et al., 2015). The consequences of phishing attacks are not limited to individuals; organizations and companies are also affected. For instance, an organization could suffer serious consequences if an employee clicks on a link in a phishing email. The situation is further complicated by the fact that employees possess varying levels of cybersecurity awareness and skills (De Bona and Paci, 2020).

Furthermore, phishing is a highly context-specific attack mechanism that also relies on the victim's ability to distinguish between legitimate and phishing content. Several attributes of human behavior, such as degree of knowledge, attitudes, and behaviors, influence their phishing detection and prevention abilities. In addition, in case of a successful phishing attack, it is the people rather than technology who are blamed as the weakest link in the security chain. Therefore, the knowledge and awareness of phishing attacks, their vectors, and several mechanisms being employed to execute them are of prime importance (Mohammad et al., 2022; Nachin et al., 2019). Susceptibility to phishing varies among individuals according to their awareness levels. Moreover, there is a consensus that boosting cybersecurity awareness helps mitigate phishing attacks targeted towards an organization (Krawczyk-Sokołowska and Caputa, 2023; Mohammad et al., 2022; Nachin et al., 2019).

Having mentioned the importance of training and awareness activities in shaping employees' anti-phishing abilities, it is relevant to consider that all such efforts are still susceptible to employees' non-compliant behaviors and careless attitudes. It is therefore vital to identify factors influencing the employees' intentions to comply with self-protective behaviors against phishing attacks. This will also enable the development of more focused anti-phishing training and awareness activities. Therefore, with a rationale to identify such factors, the primary research question for this study was formulated: What factors influence employees' intentions to engage in self-protective behaviors against phishing attacks? In line with the research question, a study featuring (n = 200) employees working at Iranian higher education institutions (HEIs) was conducted. The justification for considering HEIs in this research lies in their increased exposure to phishing threats, mainly due to their access to sensitive information and university systems. Moreover, the context of HEIs has received limited attention in prior phishing research.

Furthermore, an important consideration before investigating the research question was the selection of an appropriate theoretical framework (Kanth et al., 2013). Therefore, this study adopts the Protection Motivation Theory (PMT) proposed by Rogers (1975). Based on the PMT, this study presents an empirically validated structural model that examines employees' intentions to adopt self-protective behaviors in response to phishing attacks. The study not only contributes to the body of knowledge but also provides practical insights for cybersecurity awareness within organizations to limit phishing attacks and improve employees' anti-phishing capabilities.

The remainder of the paper is organized as follows. Section 2 presents the background and related work. Section 3 presents the hypotheses and outlines the research model. Section 4 presents the details of the research method adopted for this study. Section 5 presents the analysis and findings. Section 6 encompasses the discussion and limitations of the study, and Section 7 concludes the paper.

Phishing is a form of social engineering aimed at deceiving individuals into revealing information against their interests (Abbate, 2020). The attacker (phisher) typically sends emails or messages that mimic legitimate communications from reputable companies or websites. These deceptive messages often contain hyperlinks that direct victims to counterfeit websites that closely resemble legitimate ones. Once there, victims are prompted to enter sensitive information such as credit card numbers or passwords. The malicious actors behind these schemes then exploit this information to pilfer money or assume the victim's identity. Phishing attacks manifest primarily through fraudulent emails (Naqvi et al., 2023), spoofed websites (Chiew et al., 2018), phone calls (Gupta et al., 2018), and text messages (Alani and Tawfik, 2022), impersonating trustworthy entities such as banks, social media platforms, or government agencies. In some instances, these attacks result in the installation of hazardous malware (Hong, 2012). Essentially, a phishing attack combines social engineering with technical tactics to persuade users into unwittingly providing sensitive information, which the attacker can then exploit for financial gain (Kirda and Kruegel, 2006).

Furthermore, a generic phishing attack typically unfolds in four stages (Parekh et al., 2018),: (1) website creation: the attacker crafts and establishes a fake website, meticulously designed to resemble an authentic one, (2) targeted communication: the attacker then sends a URL link to the victim, masquerading as a legitimate organization, user, or association, (3) temptation and visit: the unsuspecting victim is tempted to visit the injected fake website, and (4) data surrender: tragically, the targeted victim clicks on the deceptive link and unintentionally provides valuable personal data. By leveraging this individual information, the attacker engages in impersonation activities.

Moreover, Basit et al. (2021) highlight that a surge in phishing attacks in recent years has affected Internet users, governments, and service-providing organizations alike. A significant challenge arises when the pretext of a phishing email aligns seamlessly with a user's work context, making detection more difficult (Steves et al., 2020). Additionally, Naqvi et al. (2023) reveal that while technical safeguards such as spam filters and email authentication mechanisms reduce the number of malicious phishing attempts, users still experience a lot of phishing emails. Consequently, the research has increasingly focused on understanding behavioral factors that influence users' responses to phishing attempts.

The prior research aimed at understanding behavioral factors in the context of phishing attacks has examined mainly two user categories: end-users and employees. Studies on end-users investigate how individuals perceive and respond to phishing attacks, highlighting the role of cognition, attention, and risk perception in phishing susceptibility (e.g. Downs et al., 2006; Sheng et al., 2010; Vishwanath et al., 2011). Moreover, the end-user category represents a diverse range of users with different backgrounds, abilities, education, and other factors influencing their behaviors when confronted with phishing attacks. The second category of users considered extensively in prior literature is the organizational employees. This is important because employees represent one of the primary targets of phishing attacks in organizational environments. Broadly, the research conducted in organizational contexts explores how work-related factors, organizational policies, and security awareness influence phishing susceptibility (Parsons et al., 2015; Canfield et al., 2016; Wash, 2020). Since the focus of the current work is on factors influencing employees' intentions with self-protective behaviors against phishing attacks, we will discuss the related work concerning employees as primary users within organizational environments. A brief classification of related work on employees can be made into (1) studies examining employees' phishing behavior, (2) studies examining employees' cybersecurity behavior in general, and (3) studies examining employee security policy compliance. We discuss each of these categories in turn.

Among the studies examining employees' phishing behavior, Shahbaznezhad et al. (2021) discuss the factors that influence employees in clicking phishing emails from a broader socio-technical perspective. The authors use a socio-technical model by combining behavioral theories such as Protection Motivation Theory (PMT) and habit theory for investigating individual factors, Theory of Planned Behavior (TPB) for investigating organizational factors, and Deterrence Theory for investigating technological factors. The findings indicate that habit and protective countermeasures impact clicking phishing emails. Moreover, the authors argue that the results of the study can be used to design phishing simulation exercises. In addition, Buckley et al. (2023) examine the relationship between sociodemographic factors, information processing factors, and risky and secure email behaviors. The findings indicate that the likelihood of clicking a phishing link was lower in the case of employees who trusted their intuition and paid more attention to the sender's email address.

Furthermore, Tian et al. (2023) apply self-determination theory to study the susceptibility of phishing attacks across industries. The authors consider finance and non-finance organizations for the study. The findings reveal that there is a varying susceptibility to phishing techniques across industries. Moreover, Frank et al. (2022) employ contextual theory to examine contextual factors that influence employees' phishing susceptibility. The authors develop and validate a multi-dimensional model including social, task, and physical components to explain why employees are likely to fall for phishing emails. The authors identify that context plays a crucial role in developing a thorough understanding of phishing susceptibility. More recently, Pratama et al. (2025) explore factors influencing the behavioral intention of (state-owned enterprise) employees towards phishing emails. The authors apply protection motivation theory to examine how threat awareness, security knowledge, perceived vulnerability, perceived severity, response efficacy, and self-efficacy influence employees' intention to avoid clicking phishing links. The findings indicate that self-efficacy, perceived vulnerability, and perceived severity significantly influence employees' security intention, while threat awareness and security knowledge indirectly shape these perceptions. The results highlight the need for enterprises to enhance employee perceptions of severity, self-efficacy, and security behavior intention through focused intervention and practical training.

In addition, from the perspective of the effectiveness of anti-phishing training, Sumner et al. (2022) examine factors that impact the effectiveness of anti-phishing training and study the correlation between personality traits and phishing susceptibility. The findings revealed that anti-phishing training positively impacts participants' knowledge about phishing attacks, their behavior, and their ability to identify phishing attacks. Moreover, the findings also reveal that the differences in education impact the efficacy of training across people with varying education levels.

From the perspective of studies examining employees' cybersecurity behavior in general, Sulaiman et al. (2022) examine the cybersecurity behavior of governmental employees by applying the protection motivation theory. The findings identify that perceived severity, vulnerability, response efficacy, and self-efficacy significantly influence employee cybersecurity behavior.

Furthermore, from the perspective of studies examining employee security policy compliance, Akib et al. (2025) conducted a study featuring employees from the banking sector. The research focuses on how policy provision, security training, and awareness activities influence employees' security compliance behavior. The authors apply the theory of planned behavior and protection motivation theory to develop an integrated framework for testing. The findings reveal that policy provision and security training and awareness activities significantly impact cybersecurity awareness, thereby influencing compliance attitude and intention to drive protective behavior. In addition, Lee et al. (2023a) examine the impact of employees' psychological contract breach on cybersecurity policy compliance. The study considers both intrinsic and extrinsic factors using the theory of planned behavior and general deterrence theory. The findings reveal that employee motivation and organizational fairness impact cybersecurity compliance intentions. Moreover, from the perspective of insider threats, Safa et al. (2019) present a conceptual framework to mitigate insider attacks using deterrence and prevention approaches. The findings reveal that the severity and certainty of sanctions significantly influence employees' attitudes and prevent them from engaging in security misconduct.

Having discussed the related works, this study aims to examine the factors that influence employees' intention to engage in self-protective behaviors against phishing attacks. It is relevant to note that a recent study by Pratama et al. (2025) examined employees' behavioral intentions to avoid clicking phishing email links within a protection motivation framework. While their study provides valuable insights into phishing-related decision-making, it focuses primarily on a specific organizational context, a specific phishing vector (email), and a limited set of behavioral factors. However, the current study aims to provide a broader understanding of the factors influencing employees' intentions to engage in self-protective behaviors against phishing attacks.

Furthermore, academic employees were selected as participants for this study, as they are particularly vulnerable to phishing attacks due to the openness, accessibility, and collaborative nature of academic environments. Academic institutions, such as universities, store large amounts of sensitive information, including personal data, academic grades, and research records, which makes them an attractive target for attackers. In addition, with the constantly changing staff and students, there are more gaps in anti-phishing preparedness as compared to other sectors.

Moreover, based on the literature review, it was found that this topic has received less attention in technologically developing countries like Iran. In addition, the variables considered in this study have not been widely examined simultaneously, particularly within organizational contexts. To the best of the authors' knowledge, the PMT-based model developed during this study has not been tested previously alongside the variables included in the proposed conceptual model. A summary of the related works discussed in this section is presented in Table 1.

Rogers (1975) developed PMT to describe the mental activity humans participate in to control their conduct in the face of danger to their health and the safety of others. The hypothesis is grounded in the observation that people conduct risk assessments to evaluate current health and safety conditions and engage in related coping strategies. Their decision to take precautions is influenced by this assessment process, which may lead to adaptive or maladaptive behavior. In the context of cybersecurity, PMT has been extensively used over the years, and in this aspect, the theory appears to hold up well (Abumalloh et al., 2021; Alsharida et al., 2023; De Kimpe et al., 2022; Menard et al., 2018). The theory holds that people engage in self-protective behaviors if they perceive a threat as substantial. Threat assessments appear to have a direct and favorable influence on information technology (IT) professionals' online behavior in online environments (Safa et al., 2015). The effectiveness of addressing these threats can be assessed using PMT, in addition to individual threat assessments (Rogers, 1975, 1983).

Furthermore, it is this aspect of PMT that enables an understanding of how individuals respond to perceived threats and adopt protective behaviors across various domains, which makes PMT relevant for this study's context. PMT suggests that individuals' motivation to stay protected is determined by two appraisal processes: their desire to take precautions is influenced by how they perceive the threat (“threat appraisal”) and how they evaluate their options for coping with it (“coping appraisal”). The threat appraisal considers both the perceived likelihood of affecting them (perceived vulnerability), the perceived severity and probable repercussions of the threat. In addition, coping appraisal considers three factors: (1) self-efficacy, which refers to an individual's confidence in their ability to deal with a threat, (2) response efficacy, which refers to the benefit of this response is expected to be concerning the threat, and (3) response cost, which refers to the individuals estimate of how much it will cost in terms of money, time, or effort to respond to the threat (Kemp, 2023). In the context of phishing attacks, employees evaluate the potential risks associated with phishing attacks (e.g. loss of data, damage to reputation, monetary loss) and assess their ability to detect and avoid such threats. In addition, factors such as response efficacy, self-efficacy, and perceived barriers influence employees' coping appraisal, thereby shaping their motivation to adopt self-protective behaviors. Therefore, PMT provides a suitable theoretical framework for explaining how employees develop intentions to adopt self-protective behaviors when facing phishing attacks.

The research model is grounded in PMT and is presented in Figure 1. The model uses PMT coupled with the dimensions of conceptual and procedural knowledge to predict employees' intention to adhere to self-protective measures against phishing attacks. In the research model, perceived threat severity, perceived vulnerability, and perceived risk represent threat appraisal constructs, while perceived barriers, response efficacy, and self-efficacy represent coping appraisal constructs influencing employees' behavioral intentions. The study is based on the premise that both procedural and conceptual knowledge improve users' ability to counter phishing attacks. McCormick (1997) reveal that one's knowledge can be influenced by learning procedural and conceptual knowledge associated with it. Plant (1994) argue that conceptual knowledge is close to the idea of “know that”, and procedural knowledge, “know-how”, in which both ideas are imperative to educate one to resist phishing attacks. Furthermore, Plants' work identifies that conceptual knowledge permits an individual to explain why, and hence the difference between knowing how and knowing why. It is relevant to note that all direct hypotheses (H1-H9) are depicted in the research model; indirect hypotheses (H10-H11) are tested statistically and are not visually represented for clarity. All hypotheses are presented in the subsequent sub-sections with relevant details.

People and businesses are increasingly urged to educate themselves and to become aware of techniques to reduce their susceptibility to phishing (Torten et al., 2018). Nevertheless, research demonstrates that both behavioral intention and perceived threat are positively correlated (Vrhovec and Mihelič, 2021). The study by Rainear and Christensen (2017) found that perceived severity is one of the strongest predictors of intention, providing additional evidence for the association between perceived severity and intention. In this study, perceived severity refers to employees' evaluation of the seriousness of phishing attacks and their potential negative consequences. Consequently, the hypothesis (H1) is proposed:

A person's perception of their perceived vulnerability is how likely they believe they are to face dangerous circumstances, such as becoming a victim of cybercrime (Ifinedo, 2012). According to Vance et al. (2012), perceived vulnerability is the risk that a person would be the victim of an unanticipated incident (such as a data breach incident). Perceived vulnerability is the employee's estimation of how vulnerable their company is to phishing attacks if no precautions are taken to stop them (Piquero et al., 2005). In this study, perceived vulnerability refers to employees' assessments of their susceptibility to phishing threats in the absence of protective measures. In addition, according to numerous research studies (Beu et al., 2023; Vance et al., 2012; Wright et al., 2014), people who perceive vulnerability as being high exhibit a stronger intention to observe mitigation advice. Perceived vulnerability also significantly affects coping responses.

Furthermore, an employee who is more familiar with the information systems in the company will be more equipped to take precautions when there is a suspected risk. Existing studies have shown that employees are more likely to adopt cybersecurity policies when they believe they are vulnerable to cyberattacks (Siponen et al., 2014). Therefore, the following hypothesis (H2) is proposed:

Perceived risk is a person's perception of uncertainty regarding the safety of engaging in a particular action (Mun et al., 2013). Every person has a unique perception of the risk associated with the behavior they engage in. According to Zimbardo (2007), individuals have distinct levels of familiarity with issues; some consider a problem more pertinent to them than others do, and vice versa. The level of participation in this behavior varies with the emotions a person associates with a situation and with the potential financial loss if an attack occurs (Orgill et al., 2004). Pyszczynski et al. (1997) argue that when people feel threatened, their behavior depends on how many risks they can tolerate. The severity of an attack and the amount of loss they believe will result from a risk determine this alteration, a psychological response. The inclination to behave adversely is constantly impacted by perceived risk (Mun et al., 2013; Ridinger et al., 2016). When people perceive a greater risk of cyberattacks, they pay more attention to potential harm. Therefore, people are required to pay greater attention when the program has not completely removed the threat, such as in phishing emails, thereby increasing perceived risk. Therefore, the following hypothesis (H3) is proposed:

The concept of perceived barriers was introduced in cybersecurity literature by Claar and Johnson (2012). Moreover, Yoon et al. (2012) employed the response costs construct, which refers to the perceived effort, time, or resources required to engage in protective behavior. Both studies suggest that protective behavior tends to decrease as barriers and response costs increase. Perceived barriers reflect a person's concern about the challenges they would encounter in acquiring the new behavior. According to Lee et al. (2008), it is directly correlated with preventive security behaviors. According to Djatsa (2019), consumers' online security habits are influenced by perceived restrictions. Therefore, perceived barriers in this study refer to obstacles that a person perceives will prevent them from taking action to prevent phishing attempts. Considering the above, the following hypothesis (H4) is proposed:

In Protection Motivation Theory (PMT), coping appraisal includes response efficacy and self-efficacy (Vrhovec and Mihelič, 2021). Response efficacy refers to an individual's belief that a recommended protective action will effectively mitigate or prevent a threat. Scarpa and Thiene (2011) define response efficacy as the belief that adopting a particular adaptive response can help protect individuals from potential threats. In the context of phishing attacks, response efficacy reflects employees' beliefs that adopting recommended security practices can effectively reduce the risk of phishing attacks. Prior research suggests that intention to adopt a behavior is positively impacted by response efficacy (Bayl-Smith et al., 2022; Verkoeyen and Nepal, 2019). Response efficacy in this study refers to an employee's belief that self-protective measures can effectively reduce the risk of falling victim to phishing attacks. Hence, the following hypothesis (H5) is proposed:

The concept of self-efficacy relates to an individual's belief in their ability to handle possible (threat) scenarios, assuming they are aware of their abilities and characteristics (Bandura, 1982). In the context of phishing attacks, self-efficacy refers to an individual's confidence in their ability to spot a phishing attempt. According to Torten et al. (2018), user adoption of appropriate security behaviors is significantly influenced by self-efficacy. An individual is more likely to have positive thoughts (i.e. an attitude) towards an action if they believe they are capable of performing it (Herath and Rao, 2009). Self-efficacy may be related to attitude towards conduct (Pang et al., 2021; Zhang et al., 2020). Concerning personal information security practices, self-efficacy has been shown to have an illustrative impact on both technological usage and cybersecurity behavior (Rhee et al., 2009). Therefore, the following hypothesis (H6) is proposed:

Conceptual knowledge consists of the understanding and ideas that enable an individual to think about and interpret concepts (i.e. “know that”) in a technological setting (Plant, 1994). Without employees' active participation, it is hard for organizations to safeguard their assets (Ahmed et al., 2014). Employees must, in essence, know what to do and how to do it; as a result, they must have the necessary knowledge and skills (know-how) to contribute to cybersecurity hygiene. Although awareness campaigns and training are unquestionably important and helpful, they often prove to be insufficient (Alahmari et al., 2022). In existing research, the relationship between self-efficacy and knowledge has been examined (Hsu et al., 2007; Hu, 2010). For instance, users are more likely to take appropriate precautions to avoid phishing when they are informed of the associated risks. Thus, the following hypothesis (H7) is proposed:

Procedural knowledge (knowing how) involves the execution of tasks, processes, and procedures. Arachchilage and Love (2014) identify that risks associated with phishing are reduced when both conceptual and procedural expertise are utilized. The authors further examined how conceptual and procedural knowledge affect users' confidence in their ability to deal with phishing threats. The research demonstrates that the combination of conceptual and procedural knowledge positively impacts users' confidence. Furthermore, Liang and Xue (2009) identify that both procedural knowledge and conceptual knowledge have an impact on self-efficacy. Thus, the following hypothesis (H8) was formulated:

A crucial component in the development of beliefs, attitudes, and intentions toward policy compliance is information security awareness. It can be interpreted as general knowledge about information security and an understanding of organizational security rules (Bulgurcu et al., 2010). Individuals who are generally aware of security risks may nevertheless click on unknown links or attachments in certain situations (Moody et al., 2017). One or more information security responses may be undertaken in response to information security awareness (Yoon et al., 2012). In addition, Hughes (2016) note that improving corporate security attitudes can be achieved by increasing employee understanding of information security policies and enforcing them. The following hypothesis (H9) is proposed:

Self-efficacy refers to an individual's perception of what they can accomplish with their abilities (Zainal et al., 2022) and is linked to knowledge (Arachchilage and Love, 2014). Employees confident in their experience and ability to provide valuable knowledge are more likely to exhibit both a stronger intention to share knowledge and more frequent knowledge-sharing behaviors. Moreover, employees with more knowledge or expertise are confident and have a better intention to share knowledge, either voluntarily or when requested to share (Wipawayangkool and Teng, 2019). Conversely, if an employee is not confident about the information, they will have many concerns about providing or sharing wrong or inaccurate information (Razmerita et al., 2016). For example, when users are more confident in taking the necessary precautions to avoid phishing attempts (self-efficacy), they are aware and knowledgeable of the risks involved, resulting in the avoidance of phishing attacks (Arachchilage and Love, 2014). A high level of ability to acquire anti-phishing knowledge (self-efficacy) may reduce the risk of phishing victimization (Martens et al., 2019).

Arachchilage and Hameed (2017) identify the need to cultivate threat perception among users to motivate them to avoid phishing attacks. Self-efficacy is associated with better threat perception, i.e. the more knowledgeable employees are about phishing threats, the higher their threat perception. Moreover, Hsu et al. (2007) and Hu (2010) identify a co-relationship between self-efficacy and knowledge. For example, a user is more confident to take action against a phishing attack if they know how to avoid phishing threats (Arachchilage and Love, 2014). Self-efficacy plays a pivotal mediating role between knowledge and behavioral intention in phishing contexts (Baral and Arachchilage, 2019; Lee et al., 2023b). It influences whether employees feel confident enough to apply their procedural and conceptual knowledge to mitigate phishing attacks. Both types of knowledge are foundational for employees to build a robust defense against phishing. Procedural knowledge equips employees with practical skills, while conceptual knowledge fosters a deeper understanding of the threat landscape, enabling more informed decision-making.

The mediating role of self-efficacy in the relationship between procedural and conceptual knowledge and employees' intention to counter phishing attacks is crucial. Procedural and conceptual knowledge jointly enhance self-efficacy, which, in turn, shapes employees' attitudes and intentions toward mitigating phishing attacks. Effective cybersecurity strategies must therefore integrate knowledge enhancement with efforts to build and sustain self-efficacy, ensuring employees are both capable and confident in defending against phishing threats. Existing research shows that higher levels of both procedural and conceptual knowledge contribute positively to enhancing self-efficacy (Baral and Arachchilage, 2019). When employees understand not only how to detect phishing attempts but also why these attacks occur and what their potential consequences are, their confidence in managing these threats increases. This heightened self-efficacy then motivates protective behaviors, such as scrutinizing suspicious messages, refraining from sharing sensitive information, and reporting phishing attempts.

Therefore, self-efficacy mediation occurs because procedural knowledge alone may not directly translate into intention unless employees believe they can effectively apply that knowledge. Self-efficacy boosts this belief, thereby increasing motivation and intention to act. This is supported by findings that self-efficacy influences motivation and work performance, often through enhancing intrinsic motivation or perceived workplace support (Çetin and Aşkun, 2019; Na-Nan and Sanamthong, 2020). Therefore, the following hypotheses (H10, H11) are proposed:

This study adopted a quantitative research approach to examine the factors influencing employees' intentions to engage in self-protective behaviors against phishing attacks. The constructs used in this study were measured using previously validated scales adapted from prior studies in cybersecurity and phishing literature. Adapting established measurement instruments helps ensure the reliability and validity of the constructs. Specifically, the items measuring perceived threat severity (PS1-PS3) and perceived vulnerability (PV1-PV3) were adapted from Zahedi et al. (2015). In addition, the constructs for measuring perceived risk (PR1-PR4) and perceived barriers (PB1-PB4) were adapted from Anwar et al. (2017) and Ng et al. (2009). Response efficacy items (RE1-RE3) were adapted from Boss et al. (2015). However, self-efficacy, conceptual, and procedural knowledge constructs (SE1-S4, CK1-CK3, PK1-PK3, respectively) were adapted from Arachchilage and Love (2014). Information security awareness was measured using items (ISA1-ISA3) adapted from Zhan et al. (2019), and employees' intention to adopt self-protective behaviors was measured using items (IB1-IB3) adapted from Anwar et al. (2017). The constructs and variables used in the study are presented in Table 2.

All constructs were measured using a five-point Likert scale, with 1 denoting “strongly disagree” and 5 denoting “strongly agree.” The complete questionnaire was reviewed by a panel of four subject experts to ensure content validity and alignment with the research problem. The questionnaire was then uploaded to Google Forms for data collection. The respondents in the study included employees working at universities in Iran. In addition, the reliability and construct validity of the scales were further assessed in this study using statistical measures including Cronbach's alpha, composite reliability (CR), and average variance extracted (AVE).

Moreover, a convenience sampling technique was used for sampling. Non-probability convenience sampling is one of the most common sampling techniques used in social sciences and behavioral intention-related studies (Singh et al., 2024; Sun et al., 2016; Yeng et al., 2022). It is also an efficient way of collecting information in a limited time (Bougie and Sekaran, 2019). During the data collection phase, the respondents were made aware of ethical concerns followed in the study and were assured that their personal details and details of their responses would not be disclosed at any stage of this study. It is relevant to state that G*Power 3.3 software was used for sample size calculation. The power test parameter was set to 0.8 (Cohen, 2013), and the effect size was set to 0.15 (Faul et al., 2007). The test dictated a minimum of 157 cases for the sample size; however, in the current study, 200 respondents completed the survey questionnaire.

To test the proposed research model and hypotheses, the study employed Partial Least Squares Structural Equation Modeling (PLS-SEM). This method is appropriate for examining complex relationships among latent constructs and is widely used in behavioral and information systems research. The analysis followed a two-step approach in line with Hair et al. (2021). First, the measurement model was evaluated to assess the reliability and validity of the constructs. Second, the structural model was assessed to examine the relationships among constructs and test the proposed hypotheses. More details about the analysis are discussed in the following section.

As part of the analysis, the reliability and validity of the constructs were evaluated (measurement model) using criteria such as outer loadings, Cronbach's alpha, composite reliability, and average variance extracted. Moreover, the structural model was analyzed to test the hypothesis and evaluate the relations among constructs in the research model. The results of these assessments are presented in respective sub-sections. In addition, the demographic details of the study participants are presented in Table 3.

Measurement model assessment results are presented in Table 4. The indicator reliability was assessed by examining the outer loadings of each indicator on its respective construct. All outer loading values exceeded the threshold of 0.70, indicating that the indicators adequately represent underlying constructs. The convergent validity was evaluated using the Average Variance Extracted (AVE). The AVE values for all latent variables were more than 0.50, indicating that the constructs explain more than half of the variance of their indicator. The high outer loadings of the indicators further support the convergent validity of the constructs. The internal consistency reliability was evaluated using Cronbach's alpha and Composite Reliability (CR). As shown in Table 4, all variables had values more than the recommended threshold of 0.70. These results indicate satisfactory internal consistency reliability for all constructs. Finally, multicollinearity among indicators was assessed using the Variance Inflation Factor (VIF). All VIF values were below the threshold of 5.0, indicating no multicollinearity concerns in the measurement model.

Furthermore, discriminant validity for the constructs was first assessed using the Fornell-Larcker criterion (Fornell and Larcker, 1981). According to Hair et al. (2019), this criterion requires that the square root of the Average Variance Extracted (AVE) for each construct be greater than its correlations with other constructs. The results from the Fornell-Larcker criterion analysis are presented in Table 5. The results indicate that this condition was satisfied for all constructs, thereby confirming discriminant validity.

Moreover, discriminant validity was evaluated using the Heterotrait-Monotrait ratio (HTMT) (Henseler et al., 2015). The HTMT values should be below the threshold of 0.9 to indicate adequate discriminant validity (Hair et al., 2019). As shown in Table 6, all HTMT values ranged from 0.351 to 0.804 and were below the threshold value. Therefore, the results confirm that discriminant validity was established among the constructs.

To further assess discriminant validity, cross-loadings were examined. The results are presented in Table 7, which indicates that all items load higher on their respective constructs than on other constructs, confirming discriminant validity (Hair et al., 2019).

Once the measurement model's validity and reliability were established, the structural model was evaluated. The hypotheses were tested using a bootstrapping approach with 1,000 samples in SmartPLS, as proposed by Hair et al. (2016). In addition, the coefficient of determination (R²) was examined to assess the model's explanatory power. The results (see Table 8) show that the R² value for behavioral intention (IB) is 0.555, indicating that the six external factors accounted for approximately 55.5% of the variance in IB. In addition, the R² values for perceived vulnerability (PV) and self-efficacy (SE) are 0.375 and 0.452, respectively. R² values greater than 0.33 indicate strong predictive precision (Chin, 1998); therefore, R² values presented in Table 8 demonstrate moderate predictive accuracy and a sizable effect on employees' intentions in this study (Hair et al., 2019). Furthermore, the predictive relevance Q² was assessed using the blindfolding procedure in SmartPLS (see Table 8). A Q² value greater than zero indicates that the model has predictive relevance. The results reveal Q² values of 0.374,0.221, and 0.344 for IB, PV, and SE, respectively. was that all Q² values were >0. Cross-validated redundancy was used to assess the route model's capacity to predict endogenous parameters indirectly from their relevant latent variables, leveraging the associated structural relations. Hair et al. (2021) note that Q² values of 0.02, 0.15, and 0.35, respectively, indicate strong predictive relevance for IB and SE and moderate predictive relevance for PV (Hair et al., 2021).

As mentioned earlier, bootstrapping was employed to estimate significance of the path relationships in the model by generating standard errors of each hypothesis tested (see Figure 2). This was done in line with the procedure recommended by Hair et al. (2019). The testing results of the structural model are presented in Table 9.

As shown in Table 9, the hypotheses H1-H9 were supported for the direct linkages. Employees' intentions to engage in self-protective behaviors against phishing attacks were positively and significantly affected by PS (β = 0.192, p < 0.05) and PV (β = 0.138, p < 0.05); hence, H1 and H2 were supported. H3 was supported, as a negative relationship was observed between PR and IB (β = −0.162, p < 0.05). Employees' intention to engage in self-protective behaviors against phishing attacks is positively and significantly correlated with PB (β = 0.174, p < 0.05), RE (β = 0.196, p < 0.05), and SE (β = 0.142, p < 0.05); hence, H4, H5, and H6 were supported. Additionally, a significant positive relationship was found between CK and SE (β = 0.232, p < 0.05), between PK and SE (β = 0.508, p < 0.05), and between ISA and PV (β = 0.612, p < 0.05); hence, H7, H8, and H9 were supported. Moreover, the results of the mediator study of self-efficacy showed that it does not mediate the relationship between conceptual knowledge and behavioral intention (β = 0.064, t = 1.695, p > 0.05); however, it mediates the relationship between procedural knowledge and behavioral intention (β = 0.072, t = 1.987, p < 0.05); hence H10 was not supported, however, H11 was supported.

The purpose of this study was to investigate the factors that affect employees' intentions to engage in self-protective behaviors against phishing attacks using the Protection Motivation Theory (PMT). As discussed earlier, perceived threat intensity affects employees' intentions. These results are in line with earlier research (Menard et al., 2018; Rogers, 1975). This finding is also consistent with more recent research on phishing attacks, demonstrating that employees who perceive a higher level of threat severity are more likely to adopt protective behaviors against phishing attacks (Shahbaznezhad et al., 2021; Buckley et al., 2023). Additionally, behavioral intention and perceived risk are inversely related: perceived risk of an employee's adherence to the anti-phishing security policy increases the likelihood of security risk behavior and reduces phishing attacks. This implies that employees who believe they can avoid phishing scams are more vulnerable.

Furthermore, the findings indicate a positive correlation between behavioral intention and perceived barriers. Perceived barriers are obstacles that can hinder secure behavior when faced with phishing attacks. Eliminating perceived barrier threats will enhance phishing awareness. This finding aligns with previous studies (Safa et al., 2019; Sulaiman et al., 2022), indicating that organizational and individual barriers can hinder employees' compliance with security practices and phishing mitigation strategies. The results also demonstrate that employees' intentions to adhere to self-protective practices against phishing attacks are influenced by response efficacy and self-efficacy. This means that by giving employees the right information, they would be more aware of how to practice self-protective behaviors. Strong and effective informational messages can improve employees' behavioral intentions when faced with security and environmental hazards, encouraging them to adopt protective behaviors against phishing attempts (Ertan et al., 2020; Herath and Rao, 2009). This is consistent with prior studies (Lee et al., 2023a; Tian et al., 2023), which emphasize the critical role of self-efficacy in cybersecurity behavior.

Furthermore, the results show that both conceptual and procedural knowledge affect self-efficacy. Employees with strong conceptual knowledge are better equipped to understand the rationale for their tasks and the broader organizational context. This understanding reduces uncertainty and ambiguity, which are common sources of workplace anxiety and self-doubt. When employees grasp the “why” and “how” behind their work, they are more likely to feel capable of making informed decisions and tackling new challenges, thereby enhancing their self-efficacy. The impact of conceptual knowledge on employees' self-efficacy is profound and multifaceted. By enabling employees to understand complex systems, develop creative solutions, and continuously grow, conceptual knowledge lays the groundwork for high self-efficacy. This finding extends previous research on security knowledge and phishing awareness. Prior studies (Akib et al., 2025; Sumner et al., 2022) have shown that users' understanding of phishing attacks improves their ability to recognize malicious communications and strengthens their confidence in handling such threats. Organizations that prioritize conceptual learning and foster supportive environments empower their employees to perform at their best, drive innovation, and adapt to an ever-evolving workplace (Daud et al., 2025; Zaki et al., 2019).

Moreover, as employees repeatedly perform tasks, they develop procedural knowledge and proficiency. This hands-on competence directly boosts their confidence, reinforcing the belief that they can handle similar or even more complex tasks in the future. Therefore, employees with strong procedural knowledge adapt more quickly to changes, such as new technologies or updated protocols. Their ability to transfer learned skills to new situations fosters a resilient sense of self-efficacy. Hence, employees with strong procedural knowledge adapt more quickly to changes, such as new technologies or updated protocols. Conceptual and procedural knowledge impact employees' self-efficacy in combating phishing attacks. This enhanced self-efficacy not only improves individual behavior but also fosters a security-conscious culture within organizations, ultimately reducing the risk and impact of phishing attacks. The self-efficacy component received particular emphasis in the study, as it is correlated with users' knowledge levels. This finding is consistent with earlier studies suggesting that practical knowledge plays a crucial role in enabling employees to apply security practices effectively in real-world situations (Frank et al., 2022; Tian et al., 2023).

The results also indicate that perceived vulnerability is directly impacted by information security awareness. Information security awareness plays a critical role in determining employees' perceived vulnerability to phishing attacks. Information security awareness programs aim to educate employees about cyber threats, how to recognize phishing attempts, and the appropriate responses. Research indicates that such awareness significantly influences employees' perceived vulnerability and their subsequent behavior when confronted with phishing emails (Li et al., 2019; Shahbaznezhad et al., 2021). This suggests that awareness not only raises recognition skills but also shapes employees' confidence and perceived ability to handle phishing threats. While awareness alone does not eliminate risk, it is a vital component in reducing the success of phishing attacks and mitigating their psychological and organizational consequences. Continuous, adaptive training programs, combined with supportive technical and cultural measures, are necessary to strengthen this human firewall and protect organizations against phishing threats. Nevertheless, these results provide evidence of a connection among business information security knowledge, adoption of more secure practices, and perceived reduction in vulnerability. Organizations that prioritize cybersecurity are likely to have employees accountable for cybersecurity, have implemented security controls, and are more likely to know how to avoid phishing scams. Similar conclusions have been reported in previous studies examining organizational cybersecurity awareness programs. For instance, Sulaiman et al. (2022) and Shahbaznezhad et al. (2021) found that increased information security awareness significantly improves employees' ability to identify phishing attempts and reduces organizational vulnerability to phishing attacks.

In addition, with respect to mediation, the results indicate that self-efficacy did not mediate the relationship between conceptual knowledge and behavioral intention. Therefore, conceptual knowledge is necessary, but not always sufficient, to increase self-efficacy or translate into stronger intentions to mitigate phishing attacks. Even with adequate conceptual knowledge, employees may lack sufficient self-efficacy to act, or self-efficacy may not significantly influence their intention to engage in protective behaviors. This could be because conceptual knowledge alone does not provide the practical skills or procedural knowledge users need to feel capable of taking effective action. The lack of an effect of mediating self-efficacy on the relationship between conceptual knowledge and employees' intention in phishing attacks stems from the complex and sometimes counterintuitive relationships among knowledge, confidence, attitudes, and behavior. Conceptual knowledge alone does not reliably increase self-efficacy, and self-efficacy does not always mediate the impact of knowledge on intention. This finding differs from some prior studies that reported stronger links between knowledge and protective behavioral intentions in cybersecurity contexts (Sumner et al., 2022). The difference may be explained by the fact that conceptual understanding alone may not provide the practical skills necessary for employees to respond effectively to phishing attacks.

Finally, the results show that self-efficacy mediates the relationship between procedural knowledge and behavioral intention. It transforms knowledge into actionable intentions by boosting confidence, shaping protective attitudes, and motivating proactive behaviors. Organizations aiming to mitigate phishing risks must prioritize employee self-efficacy and equip employees with the knowledge needed to counter evolving phishing threats effectively. Employees with high self-efficacy feel capable of applying their procedural knowledge effectively. This confidence motivates them to engage in protective behaviors such as scrutinizing emails and resisting phishing attempts. Without this belief, even knowledgeable employees may hesitate or fail to act, reducing the impact of their knowledge on intention (Lee et al., 2023b). This finding also supports recent research emphasizing that practical experience and applied security knowledge are essential for translating cybersecurity awareness into protective behaviors in organizational environments (Buckley et al., 2023; Frank et al., 2022).

This article represents an initial step toward comprehending the effectiveness of self-protective behaviors against phishing attacks, which aim to enhance employees' resilience in the digital era. To gain a deeper understanding of responses to phishing attacks within business contexts, concerted efforts must be made to improve data collection. The study's specific findings provide actionable insights for information security professionals, policymakers, and other stakeholders combating phishing attacks. These insights can be adapted to enhance employees' cyber resilience against cybercrime, including ransomware attacks (de Bruijn and Janssen, 2017).

This study contributes to understanding self-protective behaviors against phishing attacks by emphasizing the importance of Protection Motivation Theory. Specifically, it broadens the existing limited focus on phishing attacks while highlighting the impact of employees' intention to comply with self-protective measures. The research model delves into various factors associated with PMT, providing valuable insights for mitigating cyber risks.

According to this study's findings, the PMT model was extended to include conceptual knowledge, procedural knowledge, self-efficacy, and information security awareness. Moreover, the mediating role of self-efficacy (not examined in prior studies) was considered to address a key gap in the state of the art.

The findings of the current study underscore the importance of self-efficacy in the implementation of security behaviors. From the employees' perspective, the results highlight the importance of developing both conceptual and procedural knowledge to effectively recognize and respond to phishing attempts. Employees who understand not only how to identify phishing messages but also why such threats occur are more likely to adopt proactive security behaviors. Therefore, individuals should actively engage in cybersecurity training programs and continuously update their knowledge of emerging phishing techniques. Employees' ability to adhere to security practices, even when unsupervised, is crucial. Consequently, it is advisable to continue the phishing-related awareness, education, and training programs to enhance self-efficacy (Goel and Jain, 2018; Verkijika, 2019). Recognizing that each employee starts with varying levels of technical knowledge, competence, and awareness, those overseeing anti-phishing efforts and informational websites should demonstrate empathy and understanding. This approach will help organizational managers recognize and appreciate the diverse values, beliefs, and traits that employees bring from various groups and across the organization as a whole. Building on this study's findings, managers and supervisors should prioritize both conceptual and procedural knowledge. By doing so, employees can better safeguard themselves and their data by adhering to protective behaviors against phishing attacks. For organizations, the findings emphasize the need to design comprehensive security awareness programs that combine theoretical understanding of cyber threats with practical detection skills. Training initiatives should therefore incorporate interactive exercises, simulated phishing campaigns, and scenario-based learning to strengthen employees' self-efficacy and reduce susceptibility to phishing attacks.

Security professionals can strike a balance by training university employees to handle phishing threats responsibly. Additionally, organizations can implement additional security controls to support employees in adopting security practices, particularly in critical departments. Furthermore, because perceived barrier risk predicts self-reported security behavior risk, addressing perceived barrier risks may improve conscious security behavior. Based on this study, several proactive measures should be implemented by organizational managers and government bodies to mitigate phishing attacks. From a policy perspective, the findings suggest that governmental agencies and regulatory bodies should support the development of national cybersecurity awareness programs and guidelines for employee security training. Policymakers can also encourage organizations, particularly in the higher education sector, to adopt standardized cybersecurity awareness frameworks and provide incentives for implementing continuous phishing awareness training. Within the university community, leaders must implement targeted training, awareness campaigns, and educational initiatives to counteract this susceptibility trend. Given the open and collaborative nature of academic environments, universities should also integrate cybersecurity awareness into staff development programs and institutional policies. Such initiatives can help reduce vulnerabilities arising from high staff turnover, diverse user populations, and extensive information sharing within academic institutions. Additionally, leveraging intrinsic incentives derived from these findings can enhance awareness of phishing.

Beyond training, it is crucial to enhance employees' awareness to mitigate security risks. Developing social and cultural factors that promote conscious care behavior among employees is vital. Equipping employees with robust knowledge and skills in phishing-related security practices can also reduce perceived barriers to effective security. In addition, innovative training technologies, such as virtual reality, augmented reality, and extended reality, can play a pivotal role in fostering longer-lasting psychological incentives to avoid phishing susceptibility. By embracing these state-of-the-art tools, organizations can empower their workforce to stay vigilant and resilient against phishing threats.

The integrated model was validated as a strong predictor of employees' intention to adhere to self-protective measures against phishing attempts, yielding several interesting findings. However, it is worth noting some limitations of this study. Firstly, data for this study were collected at a single point in time and were based on a cross-sectional design. A longitudinal data-collection method would have been more advantageous, as it would enable more precise analysis and allow researchers to track the evolution of the variables. Additionally, by employing a convenience sample that may not accurately reflect the broader population, this study merely indicates participants' intention to adhere to self-protective practices. Future research could compare similar frameworks or analyze the impact of employees' intentions using samples more representative of the general population.

While the current study primarily focuses on evaluating specific interventions, we recognize the importance of addressing gender imbalances and other relevant demographic factors in future research projects. Although gender was not included as a control variable in this study, accounting for gender balance in subsequent research is essential for a comprehensive investigation.

Given the continued rise in phishing attacks over the years, it is evident that technology alone is insufficient to protect against phishing. However, it also requires positive intent and responsible behavior among human users to remain protected online. This paper aimed to identify factors influencing employees' intention to adopt self-protective behaviors against phishing attacks. The paper presented a case study of employees in an academic setting. The findings have implications for other sectors as well, as phishing vectors include mainly email systems and web applications, tools that are standardized and used across several sectors.

The study used PMT to study the relationships between perceived threat severity, perceived vulnerability, perceived risk, perceived barriers, response efficacy, and self-efficacy. The outcomes demonstrate that behavioral intention is impacted by the perceived risk of undesirable outcomes. The outcomes also showed a favorable relationship between conceptual knowledge, procedural knowledge, and self-efficacy. Additionally, the direct effect of information security awareness on perceived vulnerability was found. Overall, the results showed that behavioral intention to engage in self-protective activities against phishing attempts is driven by social pressures and one's beliefs. By increasing users' understanding of phishing attacks through widespread awareness efforts, security policymakers could use the study's findings to further encourage self-protective practices. By highlighting the importance of cultivating an information security culture within a business and its subgroups, this study makes a valuable contribution to the field of information security research. Organizations should ensure their cybersecurity strategies account for these concerns.