What does the Theory of Planned Behavior add to the picture of why people behave (in)securely?
Behavior follows conscious intention, which is shaped by three factors: personal attitude, subjective norms (social pressure), and perceived behavioral control.
* Theory of Planned Behavior: attitude + subjective norms + perceived control shape an intention that drives behaviour. *
The Theory of Planned Behavior (Ajzen, 1991) states human behavior isn't spontaneous but results from a deliberate intention, influenced by:
- Persönliche Einstellung (attitude) — "What do I personally think of the measure?" If I find MFA pointless, my intention to use it properly is weak.
- Subjektive Normen (subjective norms) — "What do the others think?" Social pressure: if my team mocks security rules, I'll bend them; if the boss visibly locks their screen, so will I.
- Wahrgenommene Verhaltenskontrolle (perceived behavioral control) — "How easy or hard is this for me?" — the analogue of PMT's Selbstwirksamkeit.
What it adds over PMT: the social dimension. PMT models the individual's risk calculus; TPB explains why security culture is contagious — subjective norms mean colleagues and leadership are an awareness instrument. This is the theoretical basis for the Geschäftsleitung's Vorbildfunktion (role-model function).
Go deeper:
Theory of planned behavior — Wikipedia — Ajzens Modell (Einstellung, subjektive Normen, wahrgenommene Verhaltenskontrolle) und die soziale Dimension.