Routine-activities theory is a criminology framework that says crime is most likely when three things meet: a motivated offender, a suitable target, and the absence of capable guardianship. In cybersecurity, that means attacks succeed when an attacker finds a reachable user, account, system, or service that is easy to exploit and poorly protected by monitoring, verification, or access controls.
This matters because it helps defenders think in terms of opportunity, not just intent. Phishing, credential theft, and account takeover often work when a lure reaches the right person at the wrong moment and nothing blocks or challenges the action. Defenses such as multifactor authentication, email filtering, least privilege, user reporting, and alerting all increase guardianship or make the target less suitable. The theory is useful for explaining why security awareness must change behavior: it reduces the chances that everyday routines create an easy opening for attackers.