<p>The current study explored the relationship between cybersecurity awareness and protective behaviors among Saudi secondary school students. It further examines the mediating role of cyber threat perception and the moderating effect of internet usage duration. The research was conducted in 2024 on a diverse sample of 1980 secondary school students using a multi-stage sampling method and a multi-center approach across various regions. The research instruments were meticulously designed and validated to align with the cultural context of Saudi. To analyze the data, the study employed confirmatory factor analysis and structural equation modeling using AMOS24 software. Both cybersecurity awareness (<i>β</i> = 0.38, <i>p</i> &lt; 0.001) and internet usage duration (<i>β</i> = 0.27, <i>p</i> &lt; 0.001) positively predicted students’ cyber threat perception, which in turn significantly predicted their data protection behaviors (<i>β</i> = 0.44, <i>p</i> &lt; 0.001). Cyber threat perception mediated the link between cybersecurity awareness and protective behaviors (indirect <i>β</i> = 0.17, <i>p</i> &lt; 0.001), and internet usage duration strengthened both the direct and indirect effects—students with higher daily online time showed a stronger translation of awareness into threat perception and protective action. Accordingly, integrating interactive cybersecurity modules (such as threat simulations and hands-on exercises) within secondary-school programs boosts students’ understanding of threats and leads to improved protective behaviors in their everyday lives. Allocating resources to students with high internet exposure through intensive workshops and parental-teacher partnerships will optimize program impact, as these students derive the most benefit from enhanced awareness and practical training.</p>