Managing Risks and Perceptions in Everyday Organisational Cybersecurity
Sunitha Prabhu · AJIS. Australasian journal of information systems/AJIS. Australian journal of information systems/Australian journal of information systems · 2025
Employee compliance is crucial for effective cybersecurity, yet the underlying psychological drivers of risky behaviours remain complex. Deliberate cybersecurity risks can arise through active behaviours (actions) or passive behaviours (inaction). Despite growing conceptual recognition of this distinction, empirical evidence remains limited. This study examines how threat perception and neutralisation differentially shape cybersecurity intentions across these two risk domains. Survey data from 490 UK employees, covering four common cybersecurity behaviours were analysed. The findings show that both perceived threat and neutralisation significantly influence intentions, but in different ways. Neutralisation more strongly predicts active risk-taking, whereas perceived threat is a stronger predictor of passive risk-taking. Moreover, passive risk-taking was reported more frequently than active risk-taking, challenging assumptions that employee-driven cybersecurity vulnerabilities primarily stem from overt policy violations. By identifying distinct psychological mechanisms underlying active and passive risk-taking, this study provides practical insights for the design of targeted cybersecurity interventions. Future studies could examine contextual factors that moderate the interplay between threat perception and neutralisation across risk domains.