Changes

TTAT describes the processes and factors influencing individual users’ IT threat avoidance behavior. Drawing on cybernetic theory (Carver & Scheier, 1982; Edwards, 1992), TTAT posits that IT threat avoidance behavior can be represented by a cybernetic process in which users intend to enlarge the distance between their current security state and the undesired (unsafe) end state. With the help of coping theory (Lazarus, 1966; Lazarus & Folkman, 1984), TTAT submits that users experience two cognitive processes, threat appraisal and coping appraisal.  First, users appraise or assess the situation whether the IT threat exists and to what degree it exists. Then they decide what action they will take to avoid it—problem-focused coping and/or emotion-focused coping. TTAT identifies some key factors that explain user perception and motivation in this process. Integrating the literature of risk analysis (Baskerville, 1991a; Baskerville, 1991b) and health psychology (Janz & Becker, 1984; Rogers, 1983; Weinstein, 2000), TTAT suggests that users’ threat perception is determined by the perceived probability of the threat's occurrence and the perceived severity of the threat's negative consequences. Based on prior research on health protective behavior (Janz & Becker, 1984; Maddus & Rogers, 1983) and self-efficacy (Bandura, 1982; Compeau & Higgins, 1995), TTAT proposes that users conceive three factors to assess to what extent the threat can be made avoidable by taking a safeguarding measure—the effectiveness of the safeguarding measure, the costs of the measure, and users' self-efficacy of applying the measure.

TTAT describes the processes and factors influencing individual users’ IT threat avoidance behavior. Drawing on cybernetic theory (Carver & Scheier, 1982; Edwards, 1992), TTAT posits that IT threat avoidance behavior can be represented by a cybernetic process in which users intend to enlarge the distance between their current security state and the undesired (unsafe) end state. With the help of coping theory (Lazarus, 1966; Lazarus & Folkman, 1984), TTAT submits that users experience two cognitive processes, threat appraisal and coping appraisal.  First, users appraise or assess the situation whether the IT threat exists and to what degree it exists. Then they decide what action they will take to avoid it—problem-focused coping and/or emotion-focused coping. TTAT identifies some key factors that explain user perception and motivation in this process. Integrating the literature of risk analysis (Baskerville, 1991a; Baskerville, 1991b) and health psychology (Janz & Becker, 1984; Rogers, 1983; Weinstein, 2000), TTAT suggests that users’ threat perception is determined by the perceived probability of the threat's occurrence and the perceived severity of the threat's negative consequences. Based on prior research on health protective behavior (Janz & Becker, 1984; Maddus & Rogers, 1983) and self-efficacy (Bandura, 1982; Compeau & Higgins, 1995), TTAT proposes that users conceive three factors to assess to what extent the threat can be made avoidable by taking a safeguarding measure—the effectiveness of the safeguarding measure, the costs of the measure, and users' self-efficacy of applying the measure.

== Diagram/schematic of theory ==

 

<small>Bandura, A. (1982). Self-Efficacy Mechanism in Human Agency. ''American Psychologist, 37'', 122-147.</small>

 

<small>Baskerville, R. (1991a). "Risk Analysis: An Interpretive Feasibility Tool in Justifying Information Systems Security". ''European Journal of Information Systems, 1''(2), 121-130.</small>

== Originating author(s) ==

<small>Baskerville, R. (1991b). "Risk Analysis as a Source of Professional Knowledge". ''Computer & Security, 10''(8), 749-764.</small>

* Liang and Xue (2009)

<small>Carver, C. S., & Scheier, M. F. (1982). Control Theory: A Useful Conceptual Framework for Personality-Social, Clinical, and Health Psychology. ''Psychological Bulletin, 92''(1), 111-135.</small>

Bandura, A. (1982). Self-Efficacy Mechanism in Human Agency. ''American Psychologist, 37'', 122-147.

Baskerville, R. (1991a). "Risk Analysis: An Interpretive Feasibility Tool in Justifying Information Systems Security". ''European Journal of Information Systems, 1''(2), 121-130.

<small>Compeau, D. R., & Higgins, C. A. (1995). Computer Self-Efficacy: Development of A Measure and Initial Test. ''MIS Quarterly, 19''(2), 189-211.</small>

Baskerville, R. (1991b). "Risk Analysis as a Source of Professional Knowledge". ''Computer & Security, 10''(8), 749-764.

<small>Edwards, J. (1992). A Cybernetic Theory of Stress, Coping, and Weil-Being in Organizations. ''Academy of Management Review, 17''(2), 238-274.</small>

Carver, C. S., & Scheier, M. F. (1982). Control Theory: A Useful Conceptual Framework for Personality-Social, Clinical, and Health Psychology. ''Psychological Bulletin, 92''(1), 111-135.

<small>Janz, N. K., & Becker, M. H. (1984). The Health Belief Model: A Decade Later. ''Health Education Quarterly, 11''(1), 1-45.</small>

Compeau, D. R., & Higgins, C. A. (1995). Computer Self-Efficacy: Development of A Measure and Initial Test. ''MIS Quarterly, 19''(2), 189-211.

<small>Lazarus, R. (1966). ''Psychological Stress and the Coping Process.'' New York: McGraw-Hill.</small>

Edwards, J. (1992). A Cybernetic Theory of Stress, Coping, and Weil-Being in Organizations. ''Academy of Management Review, 17''(2), 238-274.

<small>Lazarus, R., & Folkman, S. (1984). ''Stress, Coping, and Adaptation.'' New York: Springer-Verlag.</small>

Janz, N. K., & Becker, M. H. (1984). The Health Belief Model: A Decade Later. ''Health Education Quarterly, 11''(1), 1-45.

<small>Liang, H., & Xue, Y. (2009, March). Avoidance of Information Technology Threats: A Theoretical Perspective. ''MIS Quarterly, 33''(1), 71-90.</small>

Lazarus, R. (1966). ''Psychological Stress and the Coping Process.'' New York: McGraw-Hill.

<small>Maddus, J. E., & Rogers, R. W. (1983). Protection Motivation and Self-Efficacy : A Revised Theory of Fear Appeals and Attitude Change. ''Journal of Experimental Social Psychology, 19'', 469-479.</small>

Lazarus, R., & Folkman, S. (1984). ''Stress, Coping, and Adaptation.'' New York: Springer-Verlag.

<small>Rogers, R. W. (1983). Cognitive and Physiological Process in Fear Appeals and Attitude Change: A Revised Theory of Protection Motivation. In R. Petty, ''Social Psychophysiology: A Source Book'' (pp. 153-176). New York: Guilford Press.</small>

Liang, H., & Xue, Y. (2009, March). Avoidance of Information Technology Threats: A Theoretical Perspective. ''MIS Quarterly, 33''(1), 71-90.

<small>Weinstein, N. D. (2000). Perceived Probability, Perceived Severity, and Health-Protective Behavior. ''Health Psychology, 19''(1), 65-74.</small>

Maddus, J. E., & Rogers, R. W. (1983). Protection Motivation and Self-Efficacy : A Revised Theory of Fear Appeals and Attitude Change. ''Journal of Experimental Social Psychology, 19'', 469-479.

== Diagram/schematic of theory ==

Rogers, R. W. (1983). Cognitive and Physiological Process in Fear Appeals and Attitude Change: A Revised Theory of Protection Motivation. In R. Petty, ''Social Psychophysiology: A Source Book'' (pp. 153-176). New York: Guilford Press.

== Originating author(s) ==

* Liang and Xue (2009)

Weinstein, N. D. (2000). Perceived Probability, Perceived Severity, and Health-Protective Behavior. ''Health Psychology, 19''(1), 65-74.

Liang, H., & Xue, Y. (2009, March). Avoidance of Information Technology Threats: A Theoretical Perspective. ''MIS Quarterly, 33''(1), 71-90.

== Originating area ==

== Originating area ==