SoK: Self-Efficacy in Human-Centered Security and Privacy Research - A Psychometric View

Self-efficacy is a central motivational construct for explaining user behavior and has gained increasing attention in security and privacy research. However, despite decades of research, its measurement remains inconsistent, and new scales continue to be added to the literature rather than reusing and validating existing ones. This proliferation of overlapping but unvalidated scales obscures what is actually being measured, undermines cross-study comparison, and limits the accumulation of reliable evidence for theory and practice.Our goal is to assess the current degree of fragmentation of measures with a psychometric analysis of their validity. Building on preceding review data, we systematically review the self-efficacy literature in privacy and security from 2010 to 2025, examining its application across distinct domains and specific technologies. We identify, cumulatively, a total of 330 different measures across 327 publications, often with unclear contextual differentiation between scales. In a second step, we analyze the convergence of 148 fully-reported measures comprising 654 items using silicon samples generated by a fine-tuned large language model. The results of the synthetic item and scale correlation estimates reveal substantial heterogeneity, indicating measurement fragmentation.Our findings highlight widespread evidence of current jingle-fallacies, where measures intended to assess self-efficacy capture different psychological factors in multiple cases. This emphasizes the need for standardized, validated scales to improve comparability and reproducibility. We recommend increasing methodological rigor to generate reliable insights into human-centered security and privacy behavior and to ensure the design of more effective interventions.