From Knowledge to Action: A Knowledge–Attitude–Behavior Model of Information Security Awareness Among Hungarian Internet Users

Information security awareness is widely acknowledged as a critical factor in mitigating human-related cybersecurity risks; however, the mechanisms through which knowledge translates into secure behavior remain insufficiently understood. Drawing on the Knowledge-Attitude-Behavior (KAB) framework, this study develops and empirically evaluates a comprehensive Information Security Awareness model using a large-scale survey of Hungarian internet users (n = 3,144). The model operationalizes awareness across ten security domains-ranging from password practices and authentication to incident management and data protection-and captures three analytical perspectives: knowledge, attitude, and behavior. Using a two-stage Partial Least Squares Structural Equation Modeling (PLS-SEM) approach with formative lower- and higher-order constructs, the study examines both direct and indirect relationships among the core dimensions. The results reveal a strong positive effect of knowledge on attitude and a strong effect of attitude on secure behavior. While the direct impact of knowledge on behavior is relatively weak, attitude plays a crucial dual role by both mediating and moderating this relationship. Specifically, attitude partially mediates the effect of knowledge on behavior and significantly strengthens the knowledge–behavior link at higher attitude levels. These findings indicate that knowledge alone has a relatively limited direct association with self-reported secure behavior, while positive security-related attitudes are strongly associated with the translation of knowledge into reported protective practices. The study contributes to the cybersecurity and information systems literature by providing an empirically assessed multidimensional measurement model of information security awareness and by clarifying the central role of attitude in bridging the knowledge–behavior gap. From a practical perspective, the results suggest that awareness programs and training initiatives should move beyond knowledge transfer and place greater emphasis on attitude formation to achieve sustainable behavioral change.