Mind the gap: a mixed-methods analysis of the cybersecurity knowledge–behavior discrepancy in public Wi-Fi usage

Purpose This paper aims to examine whether perceived public Wi-Fi risk and declarative familiarity with wireless-network security concepts translate into consistent protective behavior. It focuses on the cybersecurity knowledge–behavior discrepancy in public Wi-Fi usage and contextualizes this discrepancy alongside exposure to rogue access points (RAPs). Design/methodology/approach The study applies an exploratory mixed-methods design consisting of two analytically separate components: a cross-sectional survey of primarily working-age respondents (n = 177) and a zero-payload observational field experiment. The survey examined perceived public Wi-Fi risk, wireless-security familiarity, virtual private network (VPN) usage, service set identifier (SSID) verification and auto-connect configuration. The field component deployed non-capturing RAPs in public locations to observe aggregate Layer-2 device-association events without linking observed devices to survey respondents or collecting credentials, payload content, direct personal identifiers or application-layer traffic. Findings Although 71.2% of respondents identified unsecured public Wi-Fi as a cybersecurity risk, many risk-aware respondents still reported inconsistent protective behavior, including irregular VPN usage and infrequent SSID verification. Non-parametric analyses indicated significant behavioral differences across threat-perception categories, but stronger threat perception did not eliminate risky operational behavior. The field component recorded 27 device-association events, including both user-initiated and automated association events. These observations are interpreted as contextual evidence of exposure mechanisms, not as prevalence estimates or population-level susceptibility rates. Practical implications The paper contributes to behavioral information security by distinguishing between user-level mitigation inconsistency and device-level structural exposure in public Wi-Fi environments. Originality/value The paper contributes to behavioral information security by contextualizing the cybersecurity knowledge–behavior discrepancy in public Wi-Fi environments. It juxtaposes survey-based evidence of self-reported awareness and mitigation behavior with contextual observational evidence of RAP associations, while explicitly distinguishing between user-level mitigation inconsistency and device-level structural exposure.