Protective Capability as a Developmental Hierarchy: Evidence That Cyber Security Behaviours Are Ordered, Not Parallel

Abstract

This study aimed to determine whether protective capability is instead developmental: an ordered structure in which each stratum of competence enables the next. Research on protective cyber security behaviour has largely treated such behaviours as a parallel set of practices that users adopt independently. Using a convergent parallel mixed-methods design, four protective behaviours- foundational security hygiene, proactive defence, advanced protection, and recovery and help-seeking were modelled as an ordered structure and estimated through covariance-based structural equation modelling on survey data from 304 social media users in Kenya recruited through non-probability sampling, with corroborating evidence from ten focus-group discussions. The model demonstrated good fit, and all four hypothesised paths were supported, with coefficients strengthening toward the apex of the hierarchy. Two further results identify the structure as sequential rather than merely correlated. Adjacent-level effects were large, whereas the skip-level effect of hygiene on advanced protection was small. Additionally, the influence of hygiene on advanced protection attenuated substantially when proactive defence was controlled, indicating partial mediation through the intervening level. Protective capability transfers strongly between adjacent strata and weakly across them. A further finding qualifies the practical reading: it was the base of the hierarchy, not its apex, that predicted sustained safe participation. The results extend the coping-appraisal component of protection motivation theory by revealing that self-efficacy accumulates hierarchically and imply that security education should be sequenced rather than delivered as an undifferentiated set of practices.