Purpose The purpose of this paper is to investigate the determinants of individuals’ acceptance of cybersecurity chatbots (CSCs). Integrating theories of protection motivation and institutional trust, this study examines the effects of threat appraisals, coping appraisals and trust in the CSC provider on the intention to use CSCs, thereby extending chatbot acceptance research into the cybersecurity domain. Design/methodology/approach The authors empirically test the research model using data from two field studies conducted in Europe and the United States. Data were analyzed using partial least squares structural equation modeling (PLS-SEM). Study 1 tests the role of threat and coping appraisals, while Study 2 replicates the model and incorporates trust in the CSC provider. Findings The findings show that CSC acceptance is shaped by threat appraisals (e.g. perceived susceptibility) and coping appraisals (e.g. self-efficacy), as well as by trust in the CSC provider. Originality/value By conceptualizing CSCs as awareness-supporting tools in voluntary, citizen-level contexts, the study advances cybersecurity awareness research beyond organizational settings and enriches Protection Motivation Theory by introducing institutional trust as a provider-focused appraisal influencing acceptance. This study also extends chatbot acceptance research by demonstrating that CSC acceptance is explained by protection motivation processes beyond traditional technology acceptance factors. It integrates institutional trust as a provider-related determinant, showing that trust in the CSC provider shapes coping appraisals and, in turn, CSC acceptance.

Purpose This study investigates the impact of comprehensive security measures on user experience in large enterprises, primarily focusing on interactions with corporate IT resources. Amid the digital era’s evolving landscape, where cybersecurity emerges as a pivotal element for organizational integrity, this study aims to dissect the paradox between implementing rigorous security protocols and maintaining an optimal user experience. Design/methodology/approach Drawing on data collected from Chief Information Security Officers of 52 large Czech enterprises in the first half of 2023, the research scrutinizes how enhanced security measures can inadvertently compromise user satisfaction. Center for Internet Security Controls and National Institute of Standards and Technology standards were used to efficiently collect and measure data. Findings Findings indicate a nuanced relationship between security levels and user satisfaction, revealing that organizations with a high maturity level in security management potentially sustain or improve user satisfaction despite stringent security measures. Originality/value This study offers a new perspective on the issue from the perspective of large companies. The data obtained are unique in terms of sensitivity.

Purpose The purpose of this paper is to develop a quantitative framework that translates cyber attribution uncertainty into defensive control priorities. Organizations lack systematic methods to convert sector-specific attribution probabilities into differentiated security investments. This study introduces a probability-weighted tactic-scoring function that converts estimated public attribution status into ranked defensive priorities for both known and unknown attackers, providing a defensible basis for resource allocation decisions. Design/methodology/approach This study analyzes 14,096 cyber incidents (2016–2023) using a two-stage framework. Stage 1 uses logistic models with sector-by-attack-class interactions to estimate attribution probabilities. Stage 2 integrates these with MITRE ATT&CK behavioral data using Bayesian-smoothed frequencies, generating separate priority scores for known and unknown attackers. Bootstrap validation and sensitivity analyses confirm robustness. Findings The framework reveals a fundamental divide in defensive priorities based on public attribution status. Defense Evasion (TA0005) is the universal top priority. The decision value lies in secondary priorities, which diverge as a function of attribution likelihood: Persistence (TA0003) dominates when attribution is unlikely (<40%), while Discovery (TA0007) dominates when attribution is likely (>70%). This pattern, whether reflecting adversary strategy or differential observability, provides actionable guidance for resource allocation. Patterns remain stable under parameter variation and resampling. Practical implications Organizations can map predicted attribution to control priorities. Low-attribution sectors benefit from emphasizing persistence detection; high attribution sectors benefit from discovery-focused controls. This study illustrates how tactic priorities translate to NIST SP 800–53 control families. Originality/value The probability-weighted scoring functional generalizes to any context with estimable class distributions, behavioral frequencies and uncertainty gates. This framework bridges attribution research and defensive strategy by quantitatively linking empirical attribution patterns to sector-specific control priorities, moving organizations beyond generic best practices toward attribution-aware security investment.

PurposeThis paper aims to explore key management actions for implementing security on the cloud, which is a critical issue as many organizations are moving business processes and data on it. The cloud is a flexible, low cost and highly available technology, but it comes with increased complexity in maintaining the cloud consumer’s security. In this research, a model was built to assist strategic decision-makers in choosing from a diverse range of actions that can be taken to manage cloud security.Design/methodology/approachPublished research from 2010 to 2022 was reviewed to identify alternatives to management actions pertaining to cloud security. Analytical hierarchical process (AHP) was applied to rate the most important action(s). For this, the alternatives, along with selection criteria, were summarized through thematic analysis. To gauge the relative importance of the alternatives, a questionnaire was distributed among cloud security practitioners to poll their opinion. AHP was then applied to the aggregated survey responses.FindingsIt was found that the respondents gave the highest importance to aligning information security with business needs. Building a cloud-specific risk management framework was rated second, while the actions: enforce and monitor contractual obligations, and update organizational structure, were rated third and fourth, respectively.Research limitations/implicationsThe research takes a general view without catering to specialized industry-based scenarios.Originality/valueThis paper highlights the role of management actions when implementing cloud security. It presents an AHP-based multi-criteria decision-making model that can be used by strategic decision-makers in selecting the optimum mode of action. Finally, the criteria used in the AHP model highlight how each alternative contributes to cloud security.

PurposeThis paper aims to discuss the experiences designing and conducting an experiential learning virtual incident response tabletop exercise (VIRTTX) to review a business's security posture as it adapts to remote working because of the Coronavirus 2019 (COVID-19). The pandemic forced businesses to move operations from offices to remote working. Given that this happened quickly for many, some firms had little time to factor in appropriate cyber-hygiene and incident prevention measures, thereby exposing themselves to vulnerabilities such as phishing and other scams.Design/methodology/approachThe exercise was designed and facilitated through Microsoft Teams. The approach used included a literature review and an experiential learning method that used scenario-based, active pedagogical strategies such as case studies, simulations, role-playing and discussion-focused techniques to develop and evaluate processes and procedures used in preventing, detecting, mitigating, responding and recovering from cyber incidents.FindingsThe exercise highlighted the value of using scenario-based exercises in cyber security training. It elaborated that scenario-based incident response (IR) exercises are beneficial because well-crafted and well-executed exercises raise cyber security awareness among managers and IT professionals. Such activities with integrated operational and decision-making components enable businesses to evaluate IR and disaster recovery (DR) procedures, including communication flows, to improve decision-making at strategic levels and enhance the technical skills of cyber security personnel.Practical implicationsIt maintained that the primary implication for practice is that they enhance security awareness through practical experiential, hands-on exercises such as this VIRTTX. These exercises bring together staff from across a business to evaluate existing IR/DR processes to determine if they are fit for purpose, establish existing gaps and identify strategies to prevent future threats, including during challenging circumstances such as the COVID-19 outbreak. Furthermore, the use of TTXs or TTEs for scenario-based incident response exercises was extremely useful for cyber security practice because well-crafted and well-executed exercises have been found to serve as valuable and effective tools for raising cyber security awareness among senior leadership, managers and IT professionals (Ulmanová, 2020).Originality/valueThis paper underlines the importance of practical, scenario-based cyber-IR training and reports on the experience of conducting a virtual IR/DR tabletop exercise within a large organisation.

PurposeThis paper aims to propose a conceptual model of policy components for software that supports modularizing and tailoring of information security policies (ISPs).Design/methodology/approachThis study used a design science research approach, drawing on design knowledge from the field of situational method engineering. The conceptual model was developed as a unified modeling language class diagram using existing ISPs from public agencies in Sweden.FindingsThis study’s demonstration as proof of concept indicates that the conceptual model can be used to create free-standing modules that provide guidance about information security in relation to a specific work task and that these modules can be used across multiple tailored ISPs. Thus, the model can be considered as a step toward developing software to tailor ISPs.Research limitations/implicationsThe proposed conceptual model bears several short- and long-term implications for research. In the short term, the model can act as a foundation for developing software to design tailored ISPs. In the long term, having software that enables tailorable ISPs will allow researchers to do new types of studies, such as evaluating the software's effectiveness in the ISP development process.Practical implicationsPractitioners can use the model to develop software that assist information security managers in designing tailored ISPs. Such a tool can offer the opportunity for information security managers to design more purposeful ISPs.Originality/valueThe proposed model offers a detailed and well-elaborated starting point for developing software that supports modularizing and tailoring of ISPs.

PurposeCyber terrorism poses a serious technology risk to businesses and the economies they operate in. Cyber terrorism is a digital attack on computers, networks or digital information systems, carried out to coerce people or governments to further the social or political objectives of the attacker. Cyber terrorism is costly in terms of impaired operations and damaged assets. Cyber terrorism harms a firm’s reputation, thereby negatively affecting a firm’s stock market valuation. This poses grave worries to company management, financial analysts, creditors and investors. This study aims to evaluate the effect of cyber terrorism on the market value of publicly traded firms.Design/methodology/approachFinancial information was obtained on business firms that were featured in news stories as targets of cyber terrorism. The firm’s stock price was recorded for 1, 3 and 7 days before and after the news article. Percentage changes in the firm’s stock price were compared to percentage changes in the Dow Jones Index to ascertain whether the firm’s stock price went up or down matching the market overall.FindingsResults indicate that stock prices are significantly negatively affected by news of cyber terrorist attacks on companies. In all three time periods after the cyber terrorist attack, there was a significant negative decline in the stock value relative to the Dow Jones Index. Thus, the market valuation of the firm is damaged. As a result, the shareholders and institutions are financially damaged. Furthermore, exposed system vulnerability may lead to loss of business from consumers who have reduced confidence in the firm’s operations.Practical implicationsThis paper examines the risks posed by cyber terrorism, including its impact on individual business firms, which in turn affect entire national economic systems. This makes clear the high value of cybersecurity in safeguarding computer systems. Taking steps to avoid being a victim of cyber terrorism is an important aspect of cybersecurity. Preventative steps are normally far less costly than rebuilding an information system after a cyber terrorist attack.Originality/valueThis study is original in examining the effect of cyber terrorism on the stock value of a company.

PurposeAs mobile payment systems have been in constant demand and are increasing in recent years, the various stakeholders involved in the process need to be identified. The study mainly includes ease of use, perceived usefulness, facilitating conditions, social influences, adoption readiness and intention to use financial technology (FinTech) in India. This paper aims to discuss FinTech and its dynamic changes in the banking sector. This study tests the mediation influence of perceived trust on adoption readiness and intention to use FinTech in India. The proposed impact of mediation of perceived trust was significant but small on adoption readiness and intention to use FinTech.Design/methodology/approachA questionnaire survey was administered to mobile payment users, and 349 responses were collected. Structural equations are analyzed to determine the proposed variables’ direct effects on adopting them. Additionally, to examine indirect effects, the mediation test is used.FindingsThe analysis results support the proposed model and thus help explain the impact of adoption readiness, trust and intention to use digital payment. The study’s significant findings will enable mobile payment institutions to understand the variables related to the growing use of technology in customers’ contexts. The study reveals the significance of ease of use, perceived usefulness and facilitating the service condition, which means that vendors prefer to use compatible devices that are easy to use with other devices. The analysis also explores the critical influence of perceived usefulness on customer behavior, enabling software designers to encourage accessible processes and device advantages for customers.Practical implicationsMobile payment systems offered by financial institutions until currently become a variety of mobile payment services due to rapidly evolving information technology. This work is a groundbreaking attempt to apply technology acceptance in recent years to the emerging framework of mobile banking systems. This study examines the adoption of mobile payment technologies by proposing an extended technology acceptance model (TAM) to capture the issues associated with adoption in India through banking users. Now customers are aware that cyberattacks on banking networks and data breaches quickly through media and social networks. Also, they know that the industry has done little to avoid or mitigate these attacks.Originality/valueThis study examines the adoption of mobile payment technologies by proposing an extended TAM to capture the issues associated with adoption in India through banking users.

PurposeThis paper aims to address the user perspective about usability, security and use of five authentication schemes (text and graphical passwords, biometrics and hardware tokens) from a population not covered previously in the literature. Additionally, this paper explores the criteria users apply in creating their text passwords.Design/methodology/approachAn online survey study was performed in spring 2019 with university students in Mexico and Bosnia and Herzegovina. A total of 197 responses were collected.FindingsFingerprint-based authentication was most frequently perceived as usable and secure. However, text passwords were the predominantly used method for unlocking computer devices. The participants preferred to apply personal criteria for creating text passwords, which, interestingly, coincided with the general password guidelines, e.g. length, combining letters and special characters.Originality/valueResearch on young adults’ perceptions of different authentication methods is driven by the increasing frequency and sophistication of security breaches, as well as their significant consequences. This study provided insight into the commonly used authentication methods among youth from two geographic locations, which have not been accounted for previously.

PurposeWith the rapid deployment of internet of things (IoT) technologies, it has been essential to address the security and privacy issues through maintaining transparency in data practices. The prior research focused on identifying people's privacy preferences in different contexts of IoT usage and their mental models of security threats. However, there is a dearth in existing literature to understand the mismatch between user's perceptions and the actual data practices of IoT devices. Such mismatches could lead users unknowingly sharing their private information, exposing themselves to unanticipated privacy risks. The paper aims to identify these mismatched privacy perceptions in this work.Design/methodology/approachThe authors conducted a lab study with 42 participants, where they compared participants’ perceptions with the data practices stated in the privacy policy of 28 IoT devices from different categories, including health and exercise, entertainment, smart homes, toys and games and pets.FindingsThe authors identified the mismatched privacy perceptions of users in terms of data collection, sharing, protection and storage period. The findings revealed the mismatches between user's perceptions and the data practices of IoT devices for various types of information, including personal, contact, financial, heath, location, media, connected device, online social media and IoT device usage.Originality/valueThe findings from this study lead to the recommendations on designing simplified privacy notice by highlighting the unexpected data practices, which in turn, would contribute to the secure and privacy-preserving use of IoT devices.