The Internet of Things (IoT) refers to the network of interconnected physical devices that can connect to the Internet. There has been an increase in purchase and adoption of consumer-oriented products and devices embedded with IoT capability. Consumer IoT devices connect to the online environment using a standard internet connection, yet many consumers lack confidence in their ability to protect themselves against potential security vulnerabilities and threats linked to their IoT devices. Consumer IoT security self-efficacy represents the ability of consumers to carry out responsive security behaviours and the belief that the applied responsive behaviour will have the desired impact. The purpose of this study is to investigate the antecedents and consequences of consumer IoT security self-efficacy. A conceptual model was developed and tested through a quantitative survey of 230 South African IoT consumers. The findings show that consumer IoT device knowledge and consumer IoT general controllability are key antecedents of consumer IoT security self-efficacy. The consequences of consumer IoT security self-efficacy are improved IoT security behavioural intentions, technology practices and behavioural practices. There is also a positive relationship between the IoT security behavioural intention and IoT security behavioural practices. Findings confirm consumer IoT self-efficacy as an effective means by which to sustain improvements in security behaviours and practices. Self-efficacy in turn can be enhanced by consumer protection agencies, manufacturers, service providers etc. working to increase consumer knowledge about IoT devices and their security implications. Designing IoT devices to give consumers greater control over security will further enhance their self-efficacy.