Learning from cyberattacks: how problem-focused coping enables individual and organisational learning in a cybersecurity context

Purpose During a cyberattack, employees who resort to problem-focused coping are more likely to respond effectively and learn from that experience. However, little attention has been given to how organisations can promote problem coping and how organisations can learn from a real-life cyberattack. This paper aims to explore how to promote problem-focused coping, how this may lead to individual learning and how the organisation may learn from this in a cybersecurity context. Design/methodology/approach Data were collected through in-depth semi-structured interviews with employees who experienced a cyberattack in a large organisation. Using technology threat avoidance theory as the analytical framework, the authors analysed the interview data alongside physical observations and incident response documentation to validate emerging patterns. Findings This paper identifies three factors that may increase the likelihood of employees resorting to problem-focused coping, namely, knowledge of the cybersecurity incident response plan, cybersecurity peer communication and perceived self-efficacy. An empirical model is presented to explain how these factors trigger problem-focused coping, and how that enables both individual and organisational learning. Originality/value Factors that may promote problem-focused coping have been studied in other fields, but to the best of the authors’ knowledge, this is the first study to investigate this qualitatively in a real-life cyberattack context. The findings provide organisations with concrete strategies to enhance workforce resilience, maximise learning outcomes from security incidents and transform crisis experiences into improved cybersecurity capabilities.