What Goals Drive Employees’ Information Systems Security Behaviors? A Mixed Methods Study of Employees’ Goals in the Workplace
Authors: Schuetz, Sebastian; Gewald, Heiko; Johnston, Allen; Thatcher, Jason Bennett
Journal: Journal of the Association for Information Systems (2025)
DOI: 10.17705/1jais.00950
<jats:p>IT security remains high on the agenda of CIOs, with employees’ adoption of security behaviors—behaviors that employees adopt to protect organizational IT assets—being a top concern. To explain when employees adopt security behaviors, the information systems security (ISec) literature has mainly employed deductive studies that draw on theory-based assumptions about goals—mostly from behavioral theories used in criminology and public health (e.g., avoiding sanctions, avoiding harm from threats, avoiding disapproval and blame). However, as these theories typically do not theorize about employees’ goals specific to the workplace, they offer limited insights into the goals that employees pursue at work. Subsequently, not much is known about the goals that motivate employees’ security behaviors at work. Against this backdrop, this research provides a complementary, inductive-first inquiry into the work-related goals that drive employees’ security behaviors. Using a qualitative-quantitative mixed methods research design, we identify four goals (Study 1) and evaluate their importance for predicting employee security behaviors (Study 2). Overall, we find evidence that employees’ w…