“Not all bad”: Determinants and impacts of emotion-focused and problem-focused coping in information security behavior

Users may respond to threats with a wide range of coping strategies in addition to protective information security behavior. However, relatively little is known about emotion-focused coping (EFC) responses, and prior work has often considered any non-security behavior to be “maladaptive." We examine EFC in the context of phishing and demonstrate that it can, in fact, have a positive influence on security behavior. Our research model builds on the established foundation of protection motivation theory and incorporates threat devaluation and positive reappraisal as forms of EFC. We collected quantitative data from 518 respondents and tested our model with PLS structural equation modeling to provide empirical insights into how threat and coping appraisals can lead to both emotion-focused and problem-focused responses. We find that EFC responses are nuanced and thus classify them according to whether the individual response is to either approach or avoid the threat. As these coping responses may be shaped by user perceptions, our findings provide opportunities to both protect users and develop a more comprehensive understanding of information security behavior.