Why users fail or succeed in cyber protection: a behavioural model linking digital literacy to security implementation

Purpose This study aims to investigate how digital literacy is associated with cybersecurity implementation by examining the parallel mediating roles of information security awareness and information security achievement within a knowledge–attitude–practice (KAP) framework. It aims to clarify why digital literacy alone may not be sufficient for reported secure online behaviour. Design/methodology/approach The study uses a predictive correlational design and structural equation modelling. Data were collected from 551 undergraduate students at a public university in Türkiye using four validated instruments measuring digital literacy, information security awareness, information security achievement and cybersecurity implementation. The model was tested using the robust maximum likelihood estimator with bias-corrected bootstrapping (5,000 resamples) to assess direct and indirect associations. Findings Results indicate that digital literacy has significant direct effects on information security awareness, information security achievement and cybersecurity implementation. Both information security awareness and information security achievement significantly predict cybersecurity implementation and operate as parallel partial mediators in the relationship between digital literacy and cybersecurity behaviour. The findings support a KAP-consistent associative pathway in which digital literacy is linked to awareness, awareness is associated with applied security competence and competence is associated with cybersecurity implementation. Originality/value This study advances the cybersecurity behaviour literature by empirically integrating digital literacy, awareness and achievement within a single KAP-based structural model. By identifying dual mediating mechanisms, it offers a more comprehensive account of how digital competencies are statistically associated with secure practices and provides a robust theoretical and practical framework for designing cyber education and awareness interventions.