‘Ctrl, alt, report’: the influence of policy, cyber security job relevance, rank and gender on cyber security incident reporting

Purpose Cyber security incidents present a growing risk to organisations due to their increasing sophistication and prevalence. It is crucial for employees, often viewed as an organisation’s “first line of defence”, to report these incidents promptly. Doing so minimises damage and enables cyber security teams to detect and mitigate threats effectively. This study aims to examine the key factors influencing cyber security incident reporting. Design/methodology/approach In total, 549 working Australian adults completed the cyber security incident reporting inventory (CSIRI; pronounced, “Siri”) and demographic items via an online survey. Findings Participants were significantly more likely to report incidents if their organisation had a cyber security policy (formal or informal), if they perceived cyber security as relevant to their role or if they held higher-ranking hierarchical positions. Employees identifying with diverse gender identities exhibited significantly more negative attitudes and lower perceived behavioural control in reporting cyber security incidents compared to the male, female and non-binary groups. Therefore, organisations should introduce or refine cyber security policies and training to support the needs of their diverse employees. Organisations that leverage such insights can reinforce their “first line of defence” and improve cyber hygiene. Originality/value The study extends previous analyses by incorporating employees’ hierarchical position level as an additional factor in cyber security incident reporting, offering new insights into how organisational rank influences reporting behaviour.