The optimistic bias in cyber risk perception of German enterprises: do organizational and personal moderators matter?
Alina Salzberger · Organizational Cybersecurity Journal Practice Process and People · 2025
Purpose Although several risk reports highlight a high perception of cyber risk across the economy, executives’ perceptions of cyber risk within their organizations may be lower than expected. This discrepancy could stem from an optimistic bias in cyber risk perception, potentially reducing motivation for effective risk management. Design/methodology/approach This study examines how optimistic bias influences organizational cyber risk perception in German enterprises and its connection to the implementation of cyber risk management strategies. It also investigates whether organizational and personal factors contribute to variations in optimistic bias. For this purpose, a survey was conducted with 1,781 executives from German enterprises using a standardized questionnaire. Findings The results show that German executives display an optimistic bias in their cyber risk perception, regardless of firm size. Specifically, the implementation of cyber risk management measures and a heightened sense of control over potential cyberattacks were linked to a stronger optimistic bias. In contrast, perceived anxiety about future cyberattacks significantly reduced optimistic bias, while prior experience had no significant effect. Originality/value This study seeks to offer valuable insights into the cyber risk awareness of German enterprises, with a distinction between individual risk perceptions and broader societal assessments. By examining potential organizational and personal factors influencing the optimistic bias, it aims to identify debiasing strategies to mitigate overly optimistic perceptions of cyber risks among German executives.