Abstract
- Numerous studies indicate that employees are often the weakest link in cybersecurity. Identifying the characteristics that lead employees to engage in risky behaviors remains a significant challenge. Grounded in Protection Motivation Theory, we integrate the concept of IT identity—defined as the extent to which an individual perceives IT usage as integral to their self-concept—to uncover variations in employees' cybersecurity behaviors. Our research addresses two primary questions: (1) What’s the role of IT identity in shaping an individual’s security behavior (2) How does immersive cybersecurity training affect an individual’s IT identity? To explore the first question, we propose a survey-based study of full-time employees to assess whether those with a stronger IT identity demonstrate better cybersecurity behaviors. For the second question, we plan a field study to evaluate whether cybersecurity training enhances participants' IT identity. Our objective is to understand the interplay between employees' rational protective behaviors and their integration of IT artifacts into their self-identity.