Beyond the direct impact of sanctions and subjective norms in cybersecurity
Sunitha Prabhu, David Kocsis, Tek Yew Lew
Abstract
Purpose Cybersecurity literature has traditionally examined sanctions and subjective norms as separate drivers of security intentions. This may lead to an incomplete understanding of their interaction and explain some inconsistencies in prior research. This paper aims to investigate how the motivation for social approval and punishment avoidance interplay to shape insider cybersecurity intentions, specifically, examining whether subjective norms moderate the effect of sanctions. Design/methodology/approach An online survey with 120 employees focused on password reuse. Data were analysed using SPSS and AMOS, employing moderation analysis to test the interaction between formal sanctions and subjective norms. Findings Results reveal a dual role of subjective norms: a direct impact on intentions and a significant moderating effect on sanctions, potentially amplifying or diminishing their effectiveness depending on certain social conditions. This interaction offers a richer, more integrated understanding of insider behavioural motivation. Practical implications Organisations aiming for sustained cybersecurity compliance should prioritise cultivating strong social norms. Doing so may reduce reliance on punitive sanctions while achieving high levels of compliance. Originality/value While the theory of planned behaviour (TPB) and deterrence theory (DT) have been frequently used in cybersecurity literature, this study uniquely proposes that subjective norms, a key construct in TPB, may serve as a boundary condition for the effectiveness of formal sanctions, a central element of DT. Demonstrating this moderating effect, the study offers a novel perspective on integrating social and formal control mechanisms, potentially clarifying inconsistent findings in existing literature. Subjective norms thus not only shape security intentions but also moderate the impact of sanctions.