A Meta-Analytic Review of Sanctions in Organizational Cybersecurity

Sanctions are central to regulatory strategies designed to deter violations of organizational cybersecurity policies. Yet, their effectiveness in shaping cybersecurity behaviour, particularly among non-malicious insiders, remains unclear, with empirical findings showing considerable inconsistency. This meta-analysis synthesizes evidence from 51 studies to examine the differential impact of sanctions on two key outcomes: compliance intentions and violation intentions. The results reveal that sanction certainty significantly increases compliance intentions but has no significant effect on violation intentions, challenging the assumption of symmetrical deterrence. Additionally, sanction celerity moderates the effects of both detection certainty and sanction severity on compliance, while sample size and geographic factors moderate the relationship between sanction severity and violation intentions. These findings offer important refinements to sanctions-based deterrence models and suggest directions for future research.