Extrinsic and intrinsic motives to boost employee cybersecurity behavior and organisational cyber-resilience in hotels: mediation and moderation analysis

Purpose This study aims to examine the direct and indirect effects of two extrinsic organizational motives, namely, perceived cybersecurity climate and perceived punishment severity (PPS), and two intrinsic personal motives, namely, perceived cyberattack vulnerability (PCV) and perceived behavioral control (PBC), on employees’ cybersecurity behavior and organizational cyber-resilience (OCR). This study also examines cybersecurity compliance and ethical idealism (EI) as mediators and moderators. Design/methodology/approach The study used a cross-sectional design and partial least structural equation modeling (PLS-SEM). This study surveyed 700 five-star hotels’ IT and non-IT employees. Findings Perceived cybersecurity climate, PCV and PBC improved cybersecurity compliance. Cybersecurity compliance is scarcely affected by PPS. Cybersecurity compliance mediated the positive connection between perceived cybersecurity climate, PCV, PBC and employees’ cybersecurity behavior. Finally, EI moderated the positive association between cybersecurity compliance, employees’ cybersecurity behavior and OCR. Practical implications The study guides hotel managers toward reinforcing employees’ cybersecurity and OCR by demonstrating how employees translate their perceptions of extrinsic and intrinsic motives into their cybersecurity behaviors and OCR based on their compliance behavior and unique ethical ideology. Originality/value By integrating organizational resilience with cybersecurity behavior into a single framework, this research reveals a notable gap in the literature and explores employees’ cyber-policy compliance, including its antecedents and consequences at both employee and organizational levels within the Egyptian hospitality industry.