30 Communicating to Mitigate Behavioral Cyber Risks: The Case of Employee Vulnerability
Albena Björck, Carlo Pugnetti, Carlos Casián · 2023
Cyber-attacks are an increasingly significant safety and risk issue for companies of any size and many organizations have already been attacked. Preparing for such an event is imperative for every organization - besides up-to-date technological infrastructure, employee awareness, and alert online behavior are critical components of any defense mechanism. Although the importance of and urgency for employee preparedness and the role of cyber-risk communication in that process have been stressed in academic papers and business practice, there remains a dire need for empirical research. Thus, we investigate the hidden mental models driving employee behavior by applying structured brainstorming to distill common themes and define communication goals. We then translate these insights into instructional risk messages and actions. Our study contributes to the field of internal risk and safety communication in numerous ways: First, by focusing on the employee risk perceptions of cyber risk we unpack the internalization triggering the effect of learning and behavioral change in a pre-crisis phase. Second, we develop risk communication messages targeting these perceptions and internalization goals. Lastly, we develop a diagnostic questionnaire to evaluate the cyber-risk readiness and maturity of the employees in order to customize the risk communication effort.