# Towards a Framework for the Personalization of
# Cybersecurity Awareness

S. Alotaibi, Steven Furnell, Y. He

► To cite this version:

S. Alotaibi, Steven Furnell, Y. He. Towards a Framework for the Personalization of Cybersecurity Awareness. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.143-153, 10.1007/978-3-031-38530-8_12. hal-05462089

HAL Id: hal-05462089

https://inria.hal.science/hal-05462089v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_3.png" /></figure>

# Towards a Framework for the Personalization of Cybersecurity Awareness

S. Alotaibi<fnref n="1" />,<fnref n="2" />✉, Steven Furnell<fnref n="1" />,<fnref n="3" />, and Y. He<fnref n="1" />

**Abstract.** Significant evidence indicates that insecure employee behavior can be a major threat, undermining cybersecurity in organizations. Although cybersecurity awareness programs aim to enhance behavior and mitigate security risk, much of the current provision is essentially designed to offer a one-size-fits-all and does not pay attention to the differences in security behavior and other important traits that distinguish users. Similarly, while many guidelines exist to promote good practice, this in itself does not account for how people internalize security- related knowledge and make security-related decision. This research explores the impact of human-centric variables, organization culture and security awareness communication approaches on cybersecurity, leading towards the proposal of an initial concept for a Personalized Security Awareness Program (PSAP) framework, the intention of which is to recognize the relevant differences in the profile of the users that require awareness-related support, and then take account of this in how security messaging is delivered and how the resulting performance is evaluated. This work-in-progress paper presents the background justification for the approach and outlines the key elements to be considered in its further realization.

**Keywords:** Cybersecurity Awareness · Cybersecurity Education · Personalization

## 1 Introduction

Cybersecurity threats are not a new challenge but are an ever-increasing problem that continue to challenge organizations. Unfortunately, many end-users are not well versed in cybersecurity issues and lack adequate knowledge of the methods and approaches used to mitigate threats [1, 2]. This in turn can have negative impacts on individuals and organizations. According to Furnell and Thomson [3], lack of security awareness and practices creates a poor security culture. As a result, these individuals may not understand the recommendations to uphold tight security, resulting in financial loss and damaged reputation.

<footnote n="1">¹ School of Computer Science, University of Nottingham, Nottingham, UK
{Salwa.Alotaibi,Steven.Furnell,Ying.He}@nottingham.ac.uk</footnote>

<footnote n="2">² Computer Science Department, Taif University, Taif, Kingdom of Saudi Arabia</footnote>

<footnote n="3">³ Center for Research in Information and Cyber Security, Nelson Mandela University, Gqeberha, South Africa</footnote>
Many businesses claim to implement awareness and training to provide their employees with cybersecurity knowledge. However, according to the UK Department for Science, Innovation & Technology, 18% of businesses and 17% of charities have conducted training or awareness raising sessions on cybersecurity in the last 12 months [4]. Meanwhile, Bada et al. [5] state that most corporations employ cybersecurity awareness, but they are ineffective in changing the behavior of employees. The rationale is that these individuals know the answers to the questions presented in these programs but cannot relate it to their practices in real life. Therefore, they require more effective approaches to instill cyber awareness among their workforce.

This paper examines how the above challenges can potentially be addressed via a more personalized approach to cybersecurity awareness, in which the message and manner of delivery to recipients can be tailored based upon the profile of the user concerned. Section 2 provides further background context by looking at the nature of cybersecurity awareness and how it fits into the wider context of education and training, before proceeding to consider the nature of the communication processes that may be involved. Section 3 then reflects upon the limitations of current approaches, leading to the main focus of the discussion in Sect. 4, which is the proposal of a Personalized Security Awareness Program (PSAP). The nature of this is explored further in Sect. 5, which presents a functional outline of how the approach is intended to operate. The discussion then concludes in Sect. 6, which highlights the intended future development to realize the PSAP in practice.

## 2 Cybersecurity Awareness and Communication

A recent report from CybSafe [6] suggested that 90% of data breaches in the UK are caused by human error. Indeed, by default, employees are often unaware of the many threats and how to safeguard themselves from or handle the threats appropriately. However, good cybersecurity awareness makes employees mindful of best practices. These employees will have a better understanding of cybersecurity principles and become more skillful in dealing with incidents, thus offering less opportunity for breaches to occur.

Although companies employ different security policies and procedures to limit users' insecurity behaviors, sometimes they are unsuccessful due to the issue of employees' lack of compliance with security policies [7]. Employee's behavior has been considered as a serious problem that many are struggling to solve [8]. Various researchers have argued that non-compliance relates to lack of awareness of the organizations policies [9, 10] and hence further attention is relevant in this area.

Before considering the requirements more specifically, it is useful to situate the notion of awareness in the context of the wider concept of SETA (security education, training and awareness) that is often referred to in this context [11]. While the terms *awareness*, *training* and *education* are often used in an informal manner and treated as synonyms, they have a distinct meaning and role to play:

* Awareness involves focusing attention on security protocols to allow people to recognize IT security concerns and respond accordingly. The learner is the recipient of the information in the awareness component, unlike training programs where learners
have a more active role. Therefore, awareness is the effort by an organization to communicate their security procedures and protocols to their employees and encourage them to adopt them.

* Training seeks to teach skills to help individuals to perform a specific function, and build skills based on the knowledge acquired during the awareness phase of the learning continuum. Unlike awareness, which seeks to inform, training is a prolonged process that involves building and using the basic knowledge about security information in daily activities.

* Education integrates security competencies and skills of various specialties into a broader body of knowledge, and equips learners with the deeper capacity to respond actively and mitigate cyber-attacks.

Cybersecurity awareness aims to enable people to identify IT security issues and act accordingly. The learner is the receiver of information during awareness-creation activities, and realizing effective results relies on reaching diverse audiences through efficient tactics and packaging the product attractively [12]. There are two approaches in which cybersecurity awareness is communicated to employees as a message, as discussed in the sub-sections that follow.

## 2.1 Pre-emptive Communication Channels

Sharif and Ameen [13] classify the pre-emptive security awareness communication methods into two groups, which are conventional and non-conventional methods. Text-based, communication-based, participation-based, and instructor-led are examples of conventional training methodologies, whereas non-conventional ones include simulation-based, game-based, web-based, and non-web-based delivery mechanisms.

Regardless of the approach, the training and education program should promote development by providing knowledge to the learners and enhancing their required security skills depending on the security topics [14]. For example, when phishing attacks are addressed, the education should explain the way it occurs, and the training should emphasize the technical and physical activities to avoid it.

## 2.2 Responsive Communication Channels

The concept that is essential to introduce here is 'nudging', which refers to shaping behavior by rearranging the options offered to employee. The concept is also referred to as "choice architecture" [15]. Although such a mechanism is designed to eventually push users towards the preferred choice, it maintains the illusion of choice. The process does not lead to a 100% compliance rate, but it has led to productive results in terms of altering behavioral choices [16]. Consequently, nudging has become a popular term in relation to behavioral modifications related to security practices adoption, and some of the common forms of achieving it are as follows:

* **Defaulting:** This is a common technique used to boost security-related behavior. The approach relies on making the preferred choice as the default option and providing various other choices. The tactic is aimed at the target group that does not wish to take
the extra effort of searching additional options. In such a way, a significant proportion of the population is expected to choose the default option, while maintaining free will.

* **Opt-in versus opt-out:** These are two additional tactics that software developers can utilize to conform behavior with preferred courses of actions. Opt-in normally refers to the target group agreeing with an assertion [15]. For instance, accepting cookies on a website, which most users agree with, is a typical opt-in example. In a similar way, developers may employ the opt-out alternative, where users are required to disagree with an assertion. Asking individuals whether they would not like their organs to be donated after death is a classic example of the opt-out option [15]. It is up to the designers to construct the two choices in a fashion that makes it likely for the target group to choose the preferred option.

* **Social norms:** Using social norms to reform behavioral choices is a widely used option as most individuals are likely to choose a popular course of action. In cases where users are confused, following the “most often” selected option becomes an easy choice [17].

* **Number of choices and presentation:** These factors are important in convincing users to choose an option. For instance, an unattractive choice can negatively affect users and then push them towards the preferred choice [15]. Moreover, individuals have been found more likely to choose options that are listed towards the right end of a line that lists entities from left to right [15]. Such nudge techniques are useful for developers so that they can make appropriate use of them when implementing systems, as these techniques can be employed to align and conform security-related behavior [18].

One method to improve this communication and overall security levels is the concept of responsive communication. Using this technique, the security system can be built to push its users to the preferred choice of the creator to enhance security. Examples of responsive communication are defaulting, opt-in and opt-out options, social norms, the number and the presentation of these choices. These methods rely on the psychological response patterns of the user. While the first two primarily rely more on the mechanics of the user's relative default agreeableness degree, the last two depend more on the user choosing more socially appropriate and less negative options.

## 3 Limitations of Current Provision

Although Cybersecurity Awareness (CSA) has become a widely recognized concept, the high incidence of breaches questions its implementation. Many approaches have been criticized for their inability to engage employees, for a lack of hands-on practices, and incapacity to impact human behavior [5]. According to Siponen [10], many companies deliver education or awareness in some form, but the nature of these approaches is not well understood. As a result, the security guidelines and programs become ineffective. In their analysis of the current information security practices, Alshaikh et al. [19] stated that an effective cybersecurity intervention comprises three components: motivation, attitude, and knowledge. Hence, looking to which aspects of CSA have been adopted in reality, most coverage only focuses on creating awareness and providing knowledge about the threats of data breaches. Since CSA's aim is to alter employee's behavior to
improve data security, the program's lack of attitude and motivational aspects hinders the effective and uniform implementation of the plan. It focuses on foster knowledge while overlooking how to improve employees' motivation and alter their attitudes to achieve the expected behavioral change. Besides the lack of including attitude and motivational elements, the provision of today's CSA does not address the unique needs in every organization.

The “one-size-fit-all” nature of the CSA does not consider the diverse context of the organizations in cyberspace. According to Siponen and Willison [20], the CSA standards and guidelines are conceptual and generic and do not consider the organizational context or employees’ characteristics. According to Alshaikh et al. [21], it is necessary to consider the users’ current skills and knowledge and the required skills and expertise to bridge the gap between the present and required levels. Since organizations have different settings and workforce requirements, the uniform nature of the CSA standards and guidelines fails to address the unique cybersecurity needs of specific entities. For example, it did not analyze the current and the required knowledge and skills to alter team members’ behavior and facilitate the program implementation.

While the varying means of communicating CSA could support the employees’ ability to be knowledgeable in the area, as has been discussed, a different point that needs to be considered is the human willing to follow security practices. Human factors such as ignorance and carelessness toward security policies could be catastrophic to an organization’s security [22]. Hence, we discuss the antecedents of human behavior in the next section.

# 4 A Personalized Security Awareness Program

Some organizations are still coping with the reality that security breaches are more than simply a technological issue. Where the problem is primarily a people issue it requires a multi-tiered strategy or solution that incorporates a mix of technical, behavioral, and organizational evaluations to improve the organization's security posture. In light of the range of compliance behaviors, the current CSA falls short in analyzing how people construct their security perceptions and beliefs, as well as taking into account the role of beliefs and biases in determining users' security behavior [16]. As a result, this gap has been highlighted in various studies, underlining the need to change the way CSA is designed. Karjalainen et al. [23] indicate that security awareness programs that build upon one-size-fits-all are not adequate in altering security behavior.

The concept of a Personalized Security Awareness Program (PSAP) represents an innovative approach in training individuals, in most cases employees of corporations, according to their acquired skills, knowledge level, motivations and their work environment nature. Ideally, as Haney and Lutters [24] indicate, a CSA should be tailored to the local culture of the company or institution and incorporates motivational and engagement elements. Where the lack of interest that is seen in employees in general was found as one of the aspects that provides a problem for traditional training and awareness programs against security breaches. Individuals often lack the personal desire necessary to engage in consistent training to safeguard both themselves and the organization for which they work [25].
Employees in organizations are not homogeneous and their training needs to be aligned with their individual potentials. Carpenter [26] highlights that such a framework will involve a combination of behavioral and personality science. From the delivery method perspective, both online and face-to-face methods have drawbacks and advantages [27].

Vasileiou and Furnell [28] elaborated about what personalizing security factors could do to help shape the employees' awareness and compliance behavior. The authors specify that security education and awareness tend to remain frequently overlooked in both workplace and personal contexts, or only an extremely limited level is provided. Even more rarely the manner in which training is provided is adjusted to the personal potential and needs. Nonetheless, personalizing and adjusting the messaging aimed for the individuals who receive them gives a significant chance for accomplishing goals of an upgraded comprehension and higher compliance.

From reviewing the literature, it is clear that two elements need to be incorporated into the PSAP design: the target audience and the security message. The audience is seen by Neigel et al. [29] as the basic element, encompassing the individual's prior knowledge on the subject, their attitude and perception toward security and training, their role in the process and the result, and their self-efficacy in how the subject is mastered.

Meanwhile, regarding the message, the first factor is its content, which in turn is expected to address three basic questions: *what* (a task, main message, effect on the knowledge), *how* (manner of competing, ability), and *why* (motivation to upgrade awareness) [30]. The parts of why and how explain the need for security training and education next to security awareness. Meanwhile, according to Ghafir et al. [31] and Tschakert et al. [32], one of the most vital parts of the message is how to deliver it. According to McLuhan and Fiore [33] the *medium is the message*, clearly emphasizing the important role that the media plays and its potential to alter people' views and perceptions. As a result, security awareness initiatives must be linked with the media that influence the internalization of conveyed security goals [16], and it is natural to suppose that individuals may favor different delivery methods among the variety of e-learning tools, gamification, workshop, led-instructing, and others [24]. Additionally, it is understandable that the more versatile the methods, the richer the knowledge: with e-learning it might be more theoretical, while gamification makes it practical.

The organizational factors include awareness and training program, resource accessibility and status of their availability, well-established rules, procedures, and experience-based policies. The same is with the structural mechanism shaping the communication delivery. Zwilling et al. [2] and Aldawood and Skinner [25] provide evidence on features and ongoing matters hinting that support from the organization could positively modify the employee's perception and their basic attitudes toward compliance with security policies. It inevitably raises their awareness. Furthermore, organizational support such as security training, well-established security procedures that has been built upon previous experience and available guidance resources can be recognized as an essential environmental aspect that might enhance positive employee performance [34].
# 5 PSAP Functional Outline

The proposed approach incorporates a communication framework that considers both the target audience and organizational factors. It is outlined in Fig. 1 and described in the sub-sections that follow.

<figure><img src="image_4.png" /><figcaption>Fig. 1. The proposed PSAP framework</figcaption></figure>

## 5.1 User Profile

In the context of designing a personalized security awareness program, the first and initial stage is user profile identification. Here, three human characteristics will be investigated. These characteristics are employee role in the organization, prior security knowledge, and employee's security perception.

* **Employee Role in an organization:** Organizational position of employees differ in size and shape and requires a broad range of competencies to enable the effectiveness of different roles in different positions. The competencies range from essential awareness like organizational security practice compliance to decision-making practices about security policies like technological security risk mitigation skills.

* **Prior Knowledge:** A significant human factor impacting individuals' engagement with security awareness is their general knowledge about IS. Empirical evidence shows that the "higher the user's knowledge of fundamental IS applications, the more likely they are aware of security-related issues" [35]. On the contrary, those who lack knowledge in IS are reluctant to engage in cybersecurity awareness training. Hence, users' prior knowledge in security awareness-related issues can substantially impact their awareness level and learning.

* **Perception of Security:** One of the significant human factors that influences CSA is the individuals' perception of security. Bada et al. [5] have found that employees often treated awareness programs as "tick-box exercises" without engaging in genuine concern. Even though cybersecurity goals were identified, from a cultural perspective, individuals did not perceive security threats as credible and hence, "did not feel a need to browse internal security guidance" [36]. In addition, recognition and appreciation of those who engage in cybersecurity are essential since it encourages positive behavior towards cybersecurity. Meanwhile, Bauer and Bernroider [37] emphasized that social norms, which is defined as "employee's perception of an acceptable or
permissible ISP-compliant behavior within their organization,” had a positive effect on the employee compliance with information security rules. Hence, individuals’ perceptions of information leakage and security awareness play a significant role in the success of CSA programs.

## 5.2 Security Message

It is considered that various strategies may be useful in altering security-related behavior in employees via messaging:

* **Framing the message:** Haney & Lutters [38], have highlighted the importance of framing the message. The wordings and imagery of a message can have a strong effect on the user; hence, it is imperative to use a familiar tone. Using metaphors and imagery that an user is familiar with will paint the message in appositive tone and empower the user as well [39].

* **Awareness context:** Being aware of the context is critical for effective security advocacy [38]. It is not advised to use difficult language as it can intimidate employees so emphasis should be on simplicity. Moreover, message senders need to be aware of the culture, nature, operational environment, and policies of the organization at hand, which shape its security protocols [40]. Although using standard and practical security recommendations is accepted, particular rules must be suited to each corporation.

* **Engagement Techniques:** These are equally important when it comes to strengthening cybersecurity communication. Employing rhetorical devices has been recognized as a valid option for improving actions [41]. In this regard, written as well as oral communication play an important role. Managers can utilize anecdotes, analogies, and metaphors to raise employees’ comfort level. Advocates of the approach assert that employees work better in familiar conditions, so it is advisable to use language that they are used to. Messages must mention security situations that staff-members are familiar with as much as possible [42]. The same holds true for employing relatable visual images. Providing rewards and incentivizing following security protocol is another useful engagement tactic. Overall, the administration of each firm needs to decide upon the best mix of strategies based on the prevailing climate to employ to raise the standards of cybersecurity risk communication.

## 5.3 Assessment and Evaluation

The final phase is assessing and evaluating the outcomes. This phase will be conducted using three constructs: self-report, feedback, and Post-test:

* **Self-report:** This will reveal the attitude and feelings of the participants towards the PSAP (e.g. showing the type of intervention that motivated them to increase participation frequency in awareness activities and their preferred delivery methods and materials).

* **Feedback:** This will evaluate and reflect participants’ attitudes and perceptions toward cybersecurity and how they change after providing them with the PSAP material about secure behavior. Shultz [43] contends that research has shown that feedback can be a valuable tool in behavior change research.
*   **Post-test:** This will assess participants' knowledge after completing the PSAP. In this phase, the use of post-test is a valuable tool to measure the participants' knowledge levels after the introduction of the new PSAP approach. The improvement of participants' knowledge will be reflected by increased awareness of cybersecurity issues.

# 6 Conclusion

The use of personalization is considered key to constructing a cybersecurity awareness program that has the potential to appeal more directly to the user. In other words, once the user/employee profile is gathered, the awareness program can be customized, and security gaps can be filled, thereby upgrading the overall effectiveness of this program.

In future research, we aim to investigate how security compliance behavior is affected by employees' attitudes and perceptions, where such an understanding can help design a more targeted security awareness program. However, the immediate next steps for the research involve the establishment of the core knowledge that the PSAP should seek to promote to the users. This is required as a foundation for the later stages of the work and represents the focus of any personalization that would then be occurring. However, despite frequent reference to terms such as supporting cyber-literacy and practicing cyber hygiene, there is currently no pre-existing and generally recognized body of knowledge that is seen to encapsulate what end users should know about. This activity therefore forms a prerequisite for pursuing the PSAP more widely, on the basis that it is impossible to personalize the message if we are not clear on what the message should be.

# References

1. Alzubaidi, A.: Measuring the level of cybersecurity awareness for cybercrime in Saudi Arabia. Heliyon **7**(1), 1–13 (2021). https://doi.org/10.1016/j.heliyon.2021.e06016

2. Zwilling, M., Klien, G., Lesjak, D., Łukasz Wiechetek, F.C., Basim, H.N. Cyber security awareness, knowledge and behavior: a comparative study. J. Comput. Inf. Syst. **62**, 1–16 (2020). https://doi.org/10.1080/08874417.2020.1712269

3. Furnell, S., Thomson, K.L.: From culture to disobedience: recognising the varying user acceptance of IT security. Comput. Fraud Secur. **2009**(2), 5 (2009). https://doi.org/10.1016/S1361-3723(09)70019-3

4. DSIT. Cyber security breaches survey 2023, Official Statistics, Department for Science, Innovation & Technology (2023). https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2023/cyber-security-breaches-survey-2023#chapter-2-awareness-and-attitudes

5. Bada, M., Sasse, A.M., Nurse, J.R. Cyber security awareness campaigns: why do they fail to change behaviour? In: International Conference on Cyber Security for Sustainable Society, pp. 118–131. Sustainable Society Network (2015)

6. CybSafe. Phishing dominates UK cyber threat landscape, shows analysis of latest ICO figures (2020). https://www.cybsafe.com/press-releases/phishing-dominates-uk-cyber-threat-landscape-shows-analysis-of-latest-ico-figures/

7. Boss, S.R., Kirsch, L.J., Angermeier, I., Shingler, R.A., Boss, R.W.: If someone is watching, I'll do what I'm asked: mandatoriness, control, and information security. Eur. J. Inf. Syst. **18**(2), 151–164 (2009)
8. Donalds, C., Osei-Bryson, K.M.: Cybersecurity compliance behavior: exploring the influences of individual decision style and other antecedents. Int. J. Inf. Manage. **51**, 102056 (2020)

9. Thomson, M.E., von Solms, R.: Information security awareness: educating your users effectively. Inf. Manage. Comput. Secur. **6**, 167–173 (1998)

10. Siponen, M.T.: A conceptual foundation for organizational information security awareness. Inf. Manag. Comput. Secur. **8**(1), 31–41 (2000)

11. Wilson, M., Hash, J. Building an information technology security awareness and training program. Nat. Inst. Stan. Technol. 800, 1–39 (2003). https://csrc.nist.gov/publications/detail/sp/800-50/final

12. Ahmadi, R., Shybt, S.A.H.: Study of artificial neural networks in information security risk assessment. J. Manage. Acc. Stud. **8**(2), 1–10 (2020)

13. Sharif, K.H., Ameen, S.Y. A review on gamification for information security training. In: 2021 International Conference of Modern Trends in Information and Communication Technology Industry (MTICTI), pp. 1–8. IEEE (2021)

14. Furnell, S., Vasileiou, I.: Security education and awareness: just let them burn? Netw. Secur. **2017**(12), 5–9 (2017)

15. van Steen, T., de Busser, E.: Security by behavioural design: a rapid review. The Hague: NCSC (202). https://hdl.handle.net/1887/3247918

16. Tsohou, A., Karyda, M., Kokolakis, S.: Analysing the role of cognitive and cultural biases in the internalization of information security policies: recommendations for information security awareness programs. Comput. Secur. **52**, 128–141 (2015)

17. Furnell, S., Alotaibi, F., Esmael, R. Aligning security practice with policy: guiding and nudging towards better behavior. In: Proceedings of the 52nd Hawaii International Conference on System Sciences (HICSS 2019), Maui, Hawaii, January 2019, pp. 5618–5627 (2019)

18. Furnell, S., Esmael, R., Yang, W., Li, N.: Enhancing security behaviour by supporting the user. Comput. Secur. **75**, 1–9 (2018)

19. Alshaikh, M., Maynard, S., Chang, S., Ahmad, A. An exploratory study of current information security training and awareness practices in organization. In: Proceedings of the 51st Hawaii International Conference on System Sciences (2018)

20. Siponen, M., Willison, R.: Information security management standards: problems and solutions. Inf. Manage. **46**(5), 267–270 (2009)

21. Alshaikh, M., Humza, N., Ahmad, A., Maynard, S.B.: Toward sustainable behaviour change: an approach for cyber security education training and awareness”. In: Proceedings of the 27th European Conference on Information Systems (ECIS), Stockholm & Uppsala, Sweden, June 8–14 (2019)

22. Alotaibi, M., Alfehaid, W. Information security awareness: a review of methods, challenges and solutions. In: Proceedings of the ICITST-WorldCIS-WCST-WCICSS-2018, Cambridge, UK, pp. 10–13 (2018)

23. Karjalainen, M., Siponen, M., Puhakainen, P., Sarker, S..: one size does not fit all: different cultures require different information systems security interventions. In: PACIS 2013 Proceedings, vol. 98 (2013) http://aisel.aisnet.org/pacis2013/98

24. Haney, J., Lutters, W.: Security awareness training for the workforce: moving beyond “check-the-box” compliance. Computer **53**(10), 1–7 (2020)

25. Aldawood, H., Skinner, G.: Reviewing cyber security social engineering training and awareness programs - Pitfalls and ongoing issues. Future Internet, **11**(3) (2019). Art.73

26. Carpenter, P. Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers can Teach us about Driving Secure Behaviors, (pp.117–132, pp.109–116, pp.40–75). Wiley, Hoboken (2019)
27. Goode, J., Levy, Y., Hovav, A., Smith, J.: Expert assessment of organizational cybersecurity programs and development of vignettes to measure cybersecurity countermeasures awareness. Online J. Appl. Knowl. Manage. (OJAKM) **6**(1), 54–66 (2018)

28. Vasileiou, I., Furnell, S.: Enhancing security education: recognising threshold concepts and other influencing factors. In: Proceedings of ICISSP 2018 - 4th International Conference on Information Systems Security and Privacy, Funchal, Madeira, Portugal, 22–24 January 2018, pp. 398–403 (2018)

29. Neigel, A.R., Claypoole, V.L., Waldfogle, G.E., Acharya, S., Hancock, G.M.: Holistic cyber hygiene education: accounting for the human factors. Comput. Secur. **92** (2020). Art.101731

30. Solomon, A., et al.: Contextual security awareness: a context-based approach for assessing the security awareness of users. Knowl.-Based Syst. **246**, 108709 (2022)

31. Ghafir, I., et al.: Security threats to critical infrastructure: the human factor. J. Supercomput. **74**(10), 4986–5002 (2018). https://doi.org/10.1007/s11227-018-2337-2

32. Tschakert, K.F., Ngamsuriyaroj, S.: Effectiveness of and user preferences for security awareness training methodologies. Heliyon **5**(6), e02010 (2019)

33. McLuhan, M., Fiore, Q.: The medium is the message. Newyork **123**(1), 126–128 (1967)

34. Hong, Y., Furnell, S.: Understanding cybersecurity behavioral habits: insights from situational support. J. Inf. Secur. Appl. **57**, 102710 (2021)

35. Jaeger, L. Information security awareness: Literature review and integrative framework. In: Proceedings of the 51st Hawaii International Conference on System Sciences, pp. 4703–4712 (2018). https://doi.org/10.24251/hicss.2018.593

36. Maqousi, A., Balikhina, T., Mackay, M.: An effective method for information security awareness raising initiatives. Int. J. Comput. Sci. Inf. Technol. **5**(2), 63 (2013)

37. Bauer, S., Bernroider, E.W.N.: From information security awareness to reasoned compliant action. ACM SIGMIS Database: DATABASE for Adv. Inf. Syst. **48**(3), 44–68 (2017). https://doi.org/10.1145/3130515.3130519

38. Haney, J.M., Lutters, W.G.: “It’s {Scary… It’s}{Confusing… It’s} Dull”: How Cybersecurity Advocates Overcome Negative Perceptions of Security. In Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018), pp.411–425 (2018)

39. McCormac, A., Zwaans, T., Parsons, K., Calic, D., Butavicius, M., Pattinson, M.: Individual differences and information security awareness. Comput. Hum. Behav. **69**, 151–156 (2017)

40. Shameli-Sendi, A., Aghababaei-Barzegar, R., Cheriet, M.: Taxonomy of information security risk assessment (ISRA). Comput. Secur. **57**, 14–30 (2016)

41. Hariyanti, E., Djunaidy, A., Siahaan, D.O.: A conceptual model for information security risk considering business process perspective. In: 4th International Conference on Science and Technology (ICST) (2018)

42. Aurigemma, S., Mattson, T.: Exploring the effect of uncertainty avoidance on taking voluntary protective security actions. Comput. Secur. **73**, 219–234 (2018)

43. Schultz, P.: Changing behavior with normative feedback interventions: a field experiment on curbside recycling. Basic Appl. Soc. Psychol. **21**, 25–36 (1999). https://doi.org/10.1207/s15324834basp2101_3