The Impact of Security Incidents on Employee Behaviour

While literature suggests that prior security incident experience can improve overall security practices, there is limited insight into how these experiences impact different psychological and behavioural factors. This study explores how security incident experience affects employees’ behaviour regarding portable device security through their threat perceptions, sanction perceptions, and neutralisation tendencies. Using data from an online survey of 124 UK employees, this study analyses how these experiences influence these factors and, subsequently, security intentions and behaviour. The results indicate that while security incident experience significantly influences threat and sanction perceptions, sanctions alone do not notably alter behaviour. Furthermore, although neutralisation is not directly affected by the incident experience, it impacts security behavioural intentions, which, along with threat perceptions, shape actual security behaviour. These findings suggest that practitioners could leverage security incidents to heighten employees' threat perceptions and develop complementary strategies to address neutralisation tendencies, rather than relying solely on sanctions.