Determinants of cybersecurity investment in ASEAN organizations: an integrated structural equation modeling approach
Issued Date
2025-01-01
Resource Type
eISSN
2673530X
Scopus ID
2-s2.0-105008231080
Journal Title
Frontiers in Communications and Networks
Volume
6
Rights Holder(s)
SCOPUS
Bibliographic Citation
Frontiers in Communications and Networks Vol.6 (2025)
Suggested Citation
Rattanapong P., Sukma N., Darakorn Na Ayuthaya S. Determinants of cybersecurity investment in ASEAN organizations: an integrated structural equation modeling approach. Frontiers in Communications and Networks Vol.6 (2025). doi:10.3389/frcmn.2025.1594554 Retrieved from: https://repository.li.mahidol.ac.th/handle/123456789/110830
Title
Determinants of cybersecurity investment in ASEAN organizations: an integrated structural equation modeling approach
Author(s)
Author's Affiliation
Corresponding Author(s)
Other Contributor(s)
Abstract
This study examines the factors influencing cybersecurity investment decisions in organizations across the ASEAN region’s diverse digital landscape, where varying levels of regulatory maturity and digital adoption create unique security challenges. Using structural equation modeling (SEM) with data from 317 cybersecurity and IT executives, we investigated how risk management practices, financial considerations, and cybersecurity governance and compliance affect investment patterns, both directly and through the mediating role of cybersecurity strategy. The research methodology employed a validated instrument capturing multiple dimensions of organizational practices, including threat assessment processes, budget allocation frameworks, and strategic planning approaches. Our analysis revealed that cybersecurity strategy serves as the primary determinant of investment (β = 0.63, p < 0.001), while being significantly influenced by financial considerations (β = 0.57, p < 0.001), risk management (β = 0.54, p < 0.001), and regulatory environments (β = 0.42, p < 0.001). Notably, different mediation patterns emerged across factors, with financial considerations influencing investment exclusively through strategy (full mediation), whereas risk management and governance factors affected investment both directly and indirectly (partial mediation). Further investigation through multi-group analysis uncovered significant differences between critical infrastructure and other sectors, with regulatory and risk management factors exerting stronger influence in critical infrastructure organizations. Overall, our model explains 68% of the variance in cybersecurity investment decisions, providing robust explanatory power despite the region’s heterogeneity. These findings offer a comprehensive framework for understanding security resource allocation in ASEAN’s diverse digital landscape and provide valuable insights for organizations seeking to optimize their cybersecurity investments. Additionally, the results inform policymakers developing regulatory frameworks that can effectively drive security enhancements while accommodating the economic and technological diversity that characterizes the ASEAN region.