Information technology has touched our entire way of life, creating new opportunities as well as new risks. Adolescents and young adults are susceptible to these risks because of their intensive use of these technologies. In this sense, fear of cyber-attacks and privacy concerns have been shown to be part of their concerns, which theoretically should lead to behavioral changes. This exploratory study, based on the Protection Motivation Theory, was conducted with young university students in Mexico with the aim of explaining how fear of cyberattacks and privacy concerns influence cybersecurity behavior. We evaluated our model with Generalized Structured Component Analysis (GSCA), despicted that these constructs explain the impact on intention and use. Our results show that there is an impact on behavioral intention, but not on actual behavior, contributing to the discussion on the effectiveness of PMT for this problem and providing evidence of a “cybersecurity paradox”. In practical terms, we show that messages and awareness should focus on actual behavior, explaining the ease of use, and the benefits of cybersecurity, among others.