Routine activity theory is a criminological model that explains victimization as a product of exposure, everyday behavior, and opportunity. It argues that crime becomes more likely when a suitable target and a motivated offender converge in the absence of effective guardianship. The model is useful in cybersecurity because many attacks succeed not by defeating complex tools, but by exploiting ordinary workflows, repeated communication patterns, and predictable moments of attention.
In practice, phishing, business email compromise, and other social engineering attacks often target routine actions such as checking mail, approving requests, or logging into familiar services. Defenders use this lens to reduce opportunity: they add verification steps, monitor high-risk workflows, limit unnecessary exposure, and train staff to pause before acting on urgent messages. In this way, routine activity theory helps security teams focus on habits and context, not just user error.