| Protecting digital assets is a growing concern for organizations, as cyber-attacks can impact business performance, affect reputation, and compromise intellectual property. Information technology (IT) security in general, and cybersecurity in particular, is a fast-evolving area that requires continuous evaluation and innovation. As cybersecurity technology improved over the past few years, there has been a shift in the attack methods toward focusing on the human element, also known as social engineering. The aim of social engineering is to take advantage of IT users' desktop interface behavior and use it to access sensitive information. Unlike earlier research, which assessed only student populations, this study involved evaluating IT professionals, as this population is a specific target of attackers due to the level of access to critical information and networks. This quantitative regression study, which included 408 IT professionals across the United States, involved evaluating the effect of threat awareness and countermeasure awareness on IT professionals' desktop security behaviors. The findings show that threat awareness and countermeasure awareness explain 61.2% of the variability in desktop security behavior and that countermeasure awareness is more significant in terms of affecting desktop behaviors. The findings support earlier research, which found that protective motivation theory (PMT) is an effective predictor of desktop security behavior of a student population, and expands the effect of PMT to an IT professional population. The research found a determinant relationship between threat awareness and countermeasure awareness with the five elements of PMT. The research showed that all elements of PMT, except perceived vulnerability, significantly determine IT professionals' desktop security behavior. From a practitioner's perspective, the findings indicate that any IT security strategy of IT professionals should include awareness training and the focus of the awareness training should be on countermeasures rather than threat awareness. |
