Towards a Usability-Focused Security Culture Framework

Organizations are facing a wide range of cyber threats. While technological advancements have resulted in sophisticated cybersecurity solutions, the effectiveness of these solutions is hindered when users do not properly engage with security measures. Usable security is critical to encourage people to incorporate proactive practices into their daily routine, which strengthens the wider security culture. Conversely, cumbersome and intrusive measures can lead to workarounds, errors, or neglect, compromising security efforts. This study addresses the limited research on how the usability of security measures influences security culture. A mixed-method approach was employed to characterize this relationship by investigating whether usable security can positively influence security culture. Data were gathered through a survey study with over 200 participants, followed by interviews with a smaller subset. The study then proposes a usability-focused framework that leverages the influence in addition to other essential elements to foster a robust security culture. The findings suggest that addressing common usability barriers can help organizations improve compliance, reduce security risks, and enhance the overall security culture.