Universities and research centers have been targeted by numerous cybersecurity incidents. The largest number of users of these institutions are students, who generally exhibit low risk perception and command insufficient knowledge of cybersecurity practices. This exploratory study employed the constructs of habit, social influence, and self-efficacy from the Unified Theory of Acceptance and Use of Technology to evaluate how these concepts influence the intentions toward and utilization of cybersecurity measures by university students in Mexico City. We assessed our model using Generalized Structured Component Analysis (GSCA), which revealed that these constructs explained the impact on both intention and use. In practical terms, our study ratifies the need to include these topics in courses from the first semester. It also demonstrates that conversations among young people do not generally include such topics. Therefore, policymakers should generate awareness that integrates cybersecurity into the discourse and language of the youth. From a theoretical point of view, the study enables us to delve into the usefulness of GSCA and elucidates how to report GSCA.