Reflective interventions for cybersecurity: insights from a sociotechnical framework application and assessment

Abstract Managing unintentional insider threat (UIT)—inadvertent mistakes and errors that cause cyber breaches—remains a serious challenge to organisations and businesses. In previous work (Khan et al. in Cognit Technol Work 24:1–29, 2021) we developed a sociotechnical framework for UIT consisting of 45 elements arranged in six categories called ‘pillars’ (for e.g. technical cyber defences, user vulnerabilities, processes, knowledge sharing etc.). In the present paper we report the use of a web-based assessment tool that embodied this model and conducted a mixed methods study to examine its effectiveness as a tool for reflecting on these challenges and the consideration of future organisational responses. Senior leaders were invited to engage with the web-based assessment tool (hosted via a website) for a three-hour session to explore the application of the previously developed sociotechnical framework to identify where participants believed their organisation lay in terms of maturity. Attitudes were assessed through semantic scales and semi-structured interviews pre- and post-session that used the lens of Ajzen’s Theory of Planned Behaviour to explore attitudes, subjective norms and perceived control around the cybersecurity issues identified. It was found that organisations view informal peer structures as beneficial and invest in individual development if it is relevant to the job function already being performed by individuals. Organisations also showed aspirations to continuously improve the state of their technical and sociotechnical defences through investing in people and better technologies. Potential areas for improvement of the assessment tool’s inputs were also identified. We conclude that the web-based tool that was developed from the framework is an effective intervention to change planned behaviour for safeguarding against UIT. More broadly, the work demonstrates how an empirically derived framework for understanding human behaviour can be extended as a tool for reflection and determining future actions to improve organisational safety and security measures.