Fear, Fun or None: A Qualitative Quest Towards Unlocking Cybersecurity Attitudes

Employees, once seen as the weakest link in organizational cybersecurity, are now recognized as crucial defenders against malicious attacks. Thus, understanding employee attitudes towards cybersecurity, a major factor driving security behavior, is essential for protecting organizations. Using semi-structured interviews and focus groups, this study holistically explores attitudes toward cybersecurity, its influencing factors, and the employees’ needs for fostering positive attitudes. The study offers in-depth insights into affective, cognitive, and behavioral components of attitudes, ranging from annoyance and fear to appreciation for cybersecurity measures. Influencing key factors include (in)direct cybersecurity experiences and individual perceptions - both highlighting social influences. For developing positive attitudes, employees express needs related to the company’s social and cultural framework, communication styles, educational contents and formats. The study contributes to developing effective security strategies that address the individual, social, and organizational factors that shape cybersecurity attitudes, ultimately promoting a stronger organizational security.