# An Exploratory Factor Analysis of Personality Factors: An Insider Threat Perspective

Keshnee Padayachee

► To cite this version:

Keshnee Padayachee. An Exploratory Factor Analysis of Personality Factors: An Insider Threat Perspective. 16th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2022, Mytilene, Lesbos, Greece. pp.253-264, 10.1007/978-3-031-12172-2_20. hal-05324935

HAL Id: hal-05324935

https://inria.hal.science/hal-05324935v1

Submitted on 21 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# An Exploratory Factor Analysis of Personality Factors: An Insider Threat Perspective

Keshnee Padayachee✉️ ID

College of Science, Engineering and Technology, University of South Africa,
Pretoria, South Africa

padayk@unisa.ac.za

**Abstract.** This study used an exploratory factor analysis to examine the factors underlying personality traits that influence the constructs of information security compliance. Studies of this nature could be germane to organisations grappling with the insider threat problem. The current study, which is situated within the socio-technical realm and considers the human element within the information security domain, concludes by providing a conceptual model that could be useful to both researchers and practitioners.

**Keywords:** Insider threat · Personality traits · HEXACO

## 1 Introduction

The study in hand focuses on malicious insiders who misuse their legitimate access to an organisation's Information Technology (IT) infrastructure to intentionally thwart the confidentiality, integrity, and availability of the organisation's IT assets [1]. This type of crime is termed the insider threat problem as it is challenging to contain a threat that occurs within an organisation's security perimeter [2]. The insider threat problem ostensibly extends beyond the technological domain and considering its behavioural and psychological characteristics may also be valuable in the detection and prevention of cybercrime [3]. Detecting whether an event emanated from an insider threat is ranked as one of the most challenging issues in recent times [4]. It is purported that current anomalies in insider threat detection systems have propelled the exploration of psychological profiling and the understanding of attack motivations [5]. This study aims to delve deeper into the underlying factors that may regulate these aspects, such as personality.

Although personality mediates our compliance and our assessment of risk in information security, personality research in information security is scarce [6] and personality profiles constitute an under-examined area in the IT domain [7]. Therefore, researchers should continue to investigate various personality traits in order to understand the precursors to maleficence within the information security domain [8].

The current study involves understanding the influence of insider personality traits within the domain of information security compliance intention. The study culminates in the framing of a conceptual model that may support cybersecurity practitioners in accounting for personality factors in order to contain insider threats.
## 2 Related Work

Researchers consider both OCEAN (i.e. openness, conscientiousness, extraversion, agreeableness, and neuroticism) traits and the Dark Triad of personality traits (i.e. narcissism, Machiavellianism, and psychopathy) as being relevant to insider threat research.

Some researchers propose the Dark Triad of personality traits as being most relevant to the insider threat problem, given its association with socially aversive behaviour (see [9, 10]). However, Ong and Chong [11] considered the OCEAN traits as being most pertinent for security studies as the traits pervade over cultures and are generalisable across disciplines. Several studies considered the relationship between an insider's personality in terms of the OCEAN personality traits [3, 7, 12], while in some spheres researchers considered both types of traits simultaneously. Nurse et al. [13] developed a framework for characterising insider threats based on real-world cases, where they argued that personality characteristics are 'central' to understanding the insider threat. They found that the Dark Triad of traits and the OCEAN traits such as agreeableness and openness relate to an insider's susceptibility to scams. Simola et al. [6] found that low openness and high neuroticism and Machiavellianism were related to the need for insiders to rationalise their security misbehaviour.

Several studies are linked to general deterrence. Johnston et al. [14] found that insiders with a strong stability meta-trait (i.e., conscientiousness, agreeableness, and emotional stability (the reverse of neuroticism)) were more risk-averse and avoided risks and sanctions – in contrast to individuals with a strong plasticity meta-trait (i.e., dominant openness and extraversion traits). McBride et al. [15] found that 'extroverted' individuals with a low sense of 'sanction severity' are less likely to be non-compliant, while 'agreeable' individuals with a low sense of 'sanction certainty' are more likely to be non-compliant. They concluded that there may be other situational factors in combination with sanctions that will be valuable in controlling insider threats. This is an important caveat to consider in respect of personality-related studies.

## 3 Theoretical Framing

The Theory of Planned Behaviour (TPB) developed by Ajzen [16], considers the constructs of attitude, subjective norms and perceived behavioural control, which shape an individual's behavioural intentions and the resultant (actual) behaviour, has been previously leveraged in security-related studies [17, 18]. Studies show that there may be "stable individual differences that influence the relative weights of the different predictors in the TPB" [19] and that the TPB is thus amenable to the inclusion of other variables [16]. Therefore, this study includes personality constructs in addition to the existing theoretical TPB constructs. It is furthermore argued that the HEXACO model is suitable to crime research as it can be used in the "operationalisation of the trait component of the trait-state model of criminal decision making" [20]. The HEXACO model captures greater variance than the other five-dimensional models such as the OCEAN model [21]. The dimensions of the scale are the following: Honesty-Humility (H), Emotionality (E), Extraversion (X), Agreeableness (A), Conscientiousness (C) and Openness to experience (O) [22]. The research model conceptualised in this paper considered positive
compliance attributes with respect to the components of the TPB, while the personality dimensions of the HEXACO model acted as antecedents to the TPB components.

# 4 Research Methodology

The data described in this paper was collected via an online quantitative survey conducted in 2021. The preliminary study involved considering the relationship between personality and situational prevention factors that affect insider compliance. The paper in hand focuses on the personality factors only, since the scarcity of research with respect to personality factors in information security justifies the relevance of this secondary data analysis.

The primary study involved non-probability purposive sampling. The sample was drawn from the researcher's LinkedIn connections which had been accumulated over several years. It was a representative sample of working professionals, which was the first criterion for inclusion. The insider threat is a crime of occupation as it is committed during the course of the insider's typical duties at work [1]. The second criterion was that the participants must have a basic understanding of working within a framework of organisational information security policies, as the insider is an element of an “organisation's security perimeter” [2]. Compliance with this criterion was determined within the survey, and those individuals who indicated that they did not have the required experience were requested to exit the survey. Using this process to recruit research participants does admittedly have limitations, since individuals with similar backgrounds and interests usually connect on social media platforms. Furthermore, it is possible that individuals who join a professional network may be imbued with traits of conscientiousness and agreeableness.

A large cohort of potential respondents (N = 2193) who had contactable email addresses and were not affiliated with the researcher were invited to participate. This sample was mostly unknown to the researcher and no incentives were provided. Initially, 196 individuals responded, but some respondents who were deemed unsuitable for the study were eliminated and consequently 186 responses were analysed. The sample consisted of professionals from several levels of engagement in security. The job profiles with respect to cybersecurity were as follows - High Level Engagement (n = 71), Mid-Level Engagement (n = 53), Entry Level Engagement (n = 8), End User Engagement (n = 39) and Other (n = 15). Most of the participants were South Africans (92.94%).

The personality scale and the constructs for compliant insider behaviour couched within the TPB were replicated and adapted from Ashton and Lee [23] and Safa et al. [24] respectively. The instrument had been validated by these previous studies. The individual constructs of the personality scale all showed Cronbach alpha coefficients above a tolerable level of 0.6. The preliminary results revealed that there was a moderate relationship with the traits of honesty-humility and conscientiousness and compliance intention. The remainder of the personality constructs appeared to be inconsequential, which led the researcher to speculate on whether the personality scale was indeed suitable to the context. Therefore, the researcher conducted an exploratory factor analysis to further refine the scale and explore its underlying facets with respect to information security compliance.
# 5 Data Analysis

An exploratory factor analysis with principal axis factoring extraction and quartimin rotation was executed. Initially, 21 factors were suggested by the eigen values greater than 1, which accounted for 67.882% of the variance. However, this resulted in a highly dispersed scale. Next, 11 factors were considered, but the resultant scale was not interpretable. Several options were attempted, and the analysis established that seven factors were found to be interpretable, which accounted for 35.947% of the overall variance in evaluation of personality. The results of the Bartlett Test of sphericity were ($\chi^2 = 440.676$, df = 1770.000, $p < .001$) and the value for the Kaiser-Meyer-Oklin was determined at 0.584, which is acceptable for exploratory factor analysis. An inspection of the items that loaded on each factor (factor loadings > .32) was considered without cross loadings. (The factor loadings are depicted in Appendix A.)

Factor 1 mostly reflected facets of *Honesty-Humility*\* (items 6, 12R, 24R, 30R, 48R, 54, 60R). This trait is characterised by facets of ‘modesty’, ‘sincerity’, and ‘fairness’. Factor 2 mostly reflected the facets of *Agreeableness*.\* The items were loaded on two distinct traits – agreeableness (items 9R, 15R, 21R, 57R) and extraversion (items 4, 22, 52R). Considering the items related to ‘extraversion’ suggested an optimistic outlook. The trait of agreeableness suggests a person who is considerate, friendly and generous, with an optimistic view of human nature [25]. Therefore, this factor mostly describes an agreeable persona with facets of flexibility, patience, and optimism. Factor 3 mostly reflected facets of *Extraversion*\* (items 10R, 16, 34, 40, 58), a trait characterised by facets of ‘social boldness’ and ‘sociability’. Factor 4 mostly reflected the facets of *Openness to Experience*\* (items 1R, 13, 25, 49R, 55R) and is indicative of facets of ‘creativity’ and ‘aesthetic appreciation’. Item 55R was related to the facet of ‘unconventionality’; however, it is more befitting to relabel this facet as ‘contemplative’. Factor 5, which mostly reflected the facets of *Emotionality*\* (items 11, 17, 23, 29, 35R, 41R, 47, 59R), is representative of the facets of ‘anxiety’, ‘sentimentality’, ‘dependence’ and ‘fearfulness’. Factor 6 mostly reflected the facets of *Conscientiousness*\* (items 2, 8, 14R). Item 19R suggests an attribute of tolerance of unconventional viewpoints. A persona with conscientiousness is deemed thoughtful during decision making and not inclined to avoid ‘challenging goals’ [23]. Therefore, it is possible that people who are conscientious may also accept views that are challenging in order to function better at their jobs. Descriptors such as ‘organisation’, ‘diligence’, ‘perfectionism’, and ‘tolerance’ describe this factor. Factor 7 loaded on only two traits –and was eliminated from further analysis.

The Cronbach alpha coefficients per newly defined factors were as follows: *Honesty-Humility*\* - 0.6447, *Agreeableness*\* - 0.6538, *Extraversion*\* - 0.703, *Openness to Experience*\* - 0.7270, *Emotionality*\* - 0.6752 and *Conscientiousness*\* - 0.3881. (The coefficients may be interpreted as follows with respect to the scale [26] – 0.00–0.20: less reliable; >0.20–0.40: rather reliable; >0.40–0.60: quite reliable; >0.60–0.80: reliable; >0.80–1.00: very reliable). The result of Spearman’s rho that was performed to compare the rankings of the factors on the components of the TPB is demonstrated in Table 1. The coefficients were interpreted as follows: $> = \pm 0.4$, “strong relationship”; $\pm 0.2-\pm 0.4$, “moderate relationship”; $< = 0.2$, “weak relationship” [27]. For the sake of brevity, we identified the most pertinent results to report here. There was a moderate positive relationship between:
* *Honesty-Humility* and attitude (rs = 0.253, p < 0.01), perceived behavioural control (rs = 0.262, p < 0.01) and social norms (rs = 0.270, p < 0.01);

* Agreeableness* and perceived behavioural control (rs = 0.215, p < 0.1) and social norms (rs = 0.221, p < 0.1), as well as

* Conscientiousness* and perceived behavioural control (rs = 0.222, p < 0.1) and social norms (rs = 0.286, p < 0.01).

<table><caption>**Table 1. Correlation matrix**</caption><thead><tr><th>VAR</th><th>AT</th><th>PBC</th><th>SN</th><th>HH</th><th>AG</th><th>EX</th><th>OP</th><th>EM</th><th>CO</th></tr></thead><tbody><tr><td>1. AT</td><td>—</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>2. PBC</td><td>0.453</td><td>***</td><td>—</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>3. SN</td><td>0.547</td><td>***</td><td>0.652</td><td>***</td><td>—</td><td></td><td></td><td></td><td></td></tr><tr><td>4. HH</td><td>0.253</td><td>***</td><td>0.262</td><td>***</td><td>0.270</td><td>***</td><td>—</td><td></td><td></td></tr><tr><td>5.AG</td><td>0.192</td><td>**</td><td>0.215</td><td>**</td><td>0.221</td><td>**</td><td>0.229</td><td>**</td><td>—</td></tr><tr><td>6. EX</td><td>0.071</td><td></td><td>0.056</td><td>0.148</td><td>*</td><td>0.123</td><td>0.029</td><td>—</td><td></td></tr><tr><td>7. OP</td><td>0.166</td><td>*</td><td>0.192</td><td>**</td><td>0.155</td><td>*</td><td>0.139</td><td>0.035</td><td>0.094</td><td>—</td></tr><tr><td>8. EM</td><td>-0.028</td><td></td><td>0.038</td><td>0.050</td><td></td><td>-0.212</td><td>**</td><td>-0.154</td><td>*</td><td>-0.065</td><td>-0.086</td><td>—</td></tr><tr><td>9. CO</td><td>0.158</td><td>*</td><td>0.222</td><td>**</td><td>0.286</td><td>***</td><td>0.050</td><td>0.052</td><td>0.095</td><td>0.045</td><td>0.058</td><td>—</td></tr></tbody></table>

# 6 Discussion of Findings

This exploratory factor analysis should support researchers in identifying the personality constructs that should be considered for security-related research. We found that the *Honesty-Humility* trait has a moderate influence on all three constructs related to insider compliance intention. It has been argued that the Dark Triad of traits is negatively correlated with the honesty-humility trait [21] and thus this construct can be used to covertly identify high-risk insiders with dark traits. The *Agreeableness* and *Conscientiousness* traits had a moderate influence on perceived behavioural control and social norms. van Winsen [28] found that individuals with dominant agreeableness and conscientiousness traits are more likely to behave safely online and therefore less likely to be victims of cybercrime. This suggests that these are important traits to minimise reputational damage to organisations.

Shropshire et al. [29] argue that the traits of extraversion, neuroticism and openness have no impact on security-related studies. However Gratian et al. [30] purport that extraversion is a good predictor for good cybersecurity behaviour and the study in hand found that *Extraversion* has a weak effect on social norms. van der Schyff and Flowerday [31] found that the trait of openness is related to information security awareness of privacy within the context of Facebook use, but not with regard to the intention to review

<footnote>*p < .05, **p < .01, ***p < .001 (Abbreviations: Attitude (AT), Perceived Behavioural Control (PBC), Social Norms (SN), Honesty-Humility* (HH), Agreeableness* (AG), Extraversion* (EX), Openness to Experience* (OP), Emotionality* (EM), Conscientiousness* (CO))</footnote>
Facebook’s privacy settings. They argue that such an individual could be persuaded to secure their personal information. The current study found that *Openness to Experience* has weak correlations with intention constructs.

It is important to note that traits in the HEXACO model do overlap with the OCEAN traits. Whereas the traits of extraversion, openness and conscientiousness are mostly similar, the traits of honesty-humility, agreeableness and emotionality do not correspond directly [21]. Van Gelder and De Vries [20] found that honesty-humility, conscientiousness and agreeableness correlate with criminal choice and there was an indirect negative effect of ‘emotionality’ on criminal choice. Similarly, the current study found that the revised Emotionality* factor has no bearing on compliance. Emotionality contains desirable and undesirable traits such as sensitivity and cowardice [32] respectively. It is possible that participants did not want to be associated with undesirable traits. van Wiesen [28] found emotionality was unconnected to cybercrime victims’ online behaviour, while Smith [33] found that high emotionality might describe the victims, but not the perpetrators of cyberbullying. The applicability of emotionality to an understanding of the perpetrators of cybercrime is inconclusive, and it may not be effective for uncovering high-risk insiders. However, the remaining traits may be more applicable, which has clear implications for theory and practice, as is discussed next.

# 7 Implications for Theory and Practice

We now present a conceptual model (see Fig. 1) based on the significant correlations that emerged from Table 1. The categories of cybercrime for which this conceptual framework would have implications include insider sabotage, insider theft of intellectual property (IP) and insider fraud [1]. Our conceptualisation will be valuable to cybersecurity practitioners and researchers who attempt to minimise the insider threat problem. For practitioners, it may underscore the importance of applying psychological scales in recruitment, particularly for jobs that involve interaction with highly sensitive information. For researchers, the conceptual model subsumes the refined personality scale with the relevant facets for security-related studies.

Hypothetically, Emotionality* appears to have no bearing on the components of information security compliance intention, while Extraversion* has a bearing on social

<figure><img src="image_3.png" /><figcaption>**Fig. 1.** A personality-ensconced conceptual model for insider compliance</figcaption></figure>
norms only. Appropriating from De Vries et al. [34], we proffer situations that may activate specific personality traits within organisations. The *Honesty-Humility* persona gravitates towards situations that are ethical, due to their inherent facets of modesty, sincerity and fairness. The *Agreeability* persona is less likely to engage in retaliation or to seek revenge due to their inherent facets of flexibility, patience, and optimism. The *Conscientiousness* persona gravitates towards being dutybound, owing to their inherent facets of organisation, diligence, perfectionism, and tolerance. The aforenoted traits are indicative of individuals who would in theory comply with an information security policy.

It is presumed that the empirical results from Johnston et al. [14], who found that individuals with the meta-traits of stability (i.e. ‘conscientiousness’, ‘agreeableness’, and ‘emotional stability’) were more risk-averse and avoided risks and sanctions (i.e. a positive association with compliance), would also apply here. The *Openness to experience* persona is creative, aesthetically appreciative and contemplative, and gravitates towards ingenuity and discovery situations. Perhaps such a persona may be utilised as an early adopter of new information security policies. People with traits of high *Extraversion* – displaying facets such as social boldness and sociability – will seek out social activities and therefore respond to social norms (i.e., subjective norms). Thus, it is important for organisations to ensure that a culture of information security compliance prevails. This is evidenced by the research conducted by Gratian et al. [30] who suggest that extraverted individuals will be more responsive if there is messaging that shows that “good device securement practices” are benefitting others in their social group.

## 8 Conclusions

This research undertaking had several limitations. First, the respondents were mostly South African and future research will need to consider the involvement of other culture groups (European, Asian, American, etc.). Second, the purposeful sampling method that was used here had inherent biases. Thus, future research would have to consider alternative data collection sources. Forthcoming research should also involve regression analysis to understand the variation of each construct in terms of compliance. It is hoped that the present study will be useful in enriching the general understanding of personality traits with regard to information security compliance and security-related studies.
Appendix A: Rotated Factor Loading

<table><thead><tr><th>Item</th><th>F1</th><th>F2</th><th>F3</th><th>F4</th><th>F5</th><th>F6</th><th>F7</th><th>Facet</th></tr></thead><tbody><tr><td>48.“I want people to know that I am an important person of high status” [R]</td><td>0.57</td><td>0.01</td><td>0.11</td><td>0.06</td><td>-0.16</td><td>-0.19</td><td>-0.22</td><td>HH<sup>Modesty</sup></td></tr><tr><td>24.“I think that I am entitled to more respect than the average person is” [R]</td><td>0.54</td><td>-0.06</td><td>0.04</td><td>0.12</td><td>-0.04</td><td>-0.04</td><td>-0.04</td><td>HH<sup>Modesty</sup></td></tr><tr><td>30.“If I want something from someone, I will laugh at that person's worst jokes” [R]</td><td>0.52</td><td>0.10</td><td>0.02</td><td>0.00</td><td>-0.19</td><td>0.06</td><td>0.01</td><td>HH<sup>Sincerity</sup></td></tr><tr><td>60.“I would be tempted to use counterfeit money, if I were sure I could get away with it” [R]</td><td>0.47</td><td>0.14</td><td>0.08</td><td>0.03</td><td>0.05</td><td>0.19</td><td>0.07</td><td>HH<sup>Fairness</sup></td></tr><tr><td>54.“I would not pretend to like someone just to get that person to do favours for me”</td><td>0.46</td><td>-0.16</td><td>-0.05</td><td>0.10</td><td>-0.04</td><td>0.10</td><td>-0.02</td><td>HH<sup>Sincerity</sup></td></tr><tr><td>12.“If I knew that I would never get caught, I would be willing to steal a million dollars (or rands)” [R]</td><td>0.40</td><td>0.09</td><td>0.12</td><td>0.01</td><td>0.01</td><td>0.03</td><td>0.17</td><td>HH<sup>Fairness</sup></td></tr><tr><td>20.“I make decisions based on the feeling of the moment rather than on careful thought” [R]</td><td>0.36</td><td>0.28</td><td>-0.20</td><td>-0.00</td><td>-0.08</td><td>0.33</td><td>0.35</td><td>CO<sup>Prudence</sup></td></tr><tr><td>6.“I would not use flattery to get a raise or promotion at work, even if I thought it would succeed”</td><td>0.34</td><td>0.04</td><td>0.05</td><td>0.01</td><td>-0.02</td><td>0.10</td><td>0.10</td><td>HH<sup>Sincerity</sup></td></tr><tr><td>42.“I would get a lot of pleasure from owning expensive luxury goods” [R]</td><td>0.31</td><td>0.18</td><td>0.01</td><td>0.01</td><td>-0.04</td><td>-0.15</td><td>0.07</td><td>HH<sup>Greed-Avoidance</sup></td></tr><tr><td>27.“My attitude toward people who have treated me badly is ‘forgive and forget’”</td><td>0.30</td><td>0.26</td><td>0.27</td><td>-0.05</td><td>0.10</td><td>0.05</td><td>0.03</td><td>AG<sup>Forgiveness</sup></td></tr><tr><td>33.“I tend to be lenient in judging other people”</td><td>0.26</td><td>0.08</td><td>-0.14</td><td>-0.11</td><td>0.07</td><td>-0.15</td><td>-0.08</td><td>AG<sup>Gentleness</sup></td></tr><tr><td>3.“I rarely hold a grudge, even against people who have horribly wronged me”</td><td>0.25</td><td>0.09</td><td>0.18</td><td>0.01</td><td>-0.05</td><td>-0.01</td><td>0.01</td><td>AG<sup>Forgiveness</sup></td></tr><tr><td>18.“Having a lot of money is not especially important to me”</td><td>0.24</td><td>0.09</td><td>0.06</td><td>-0.00</td><td>-0.17</td><td>-0.01</td><td>-0.01</td><td>HH<sup>Greed-Avoidance</sup></td></tr><tr><td>15.“People sometimes tell me that I am too stubborn”[R]</td><td>-0.03</td><td>0.54</td><td>-0.11</td><td>-0.06</td><td>0.09</td><td>-0.07</td><td>-0.08</td><td>AG<sup>Flexibility</sup></td></tr><tr><td>21.“People think of me as someone who has a quick temper” [R]</td><td>0.10</td><td>0.52</td><td>-0.06</td><td>0.11</td><td>-0.03</td><td>-0.02</td><td>0.11</td><td>AG<sup>Patience</sup></td></tr><tr><td>57.“When people tell me that I am wrong, my first reaction is to argue with them” [R]</td><td>0.31</td><td>0.45</td><td>0.03</td><td>0.01</td><td>-0.16</td><td>0.16</td><td>0.01</td><td>AG<sup>Flexibility</sup></td></tr><tr><td>52.“I sometimes feel that I am a worthless person”[R]</td><td>0.04</td><td>0.44</td><td>0.08</td><td>0.07</td><td>-0.21</td><td>-0.01</td><td>0.11</td><td>EX<sup>Social Esteem</sup></td></tr><tr><td>9.“People sometimes tell me that I am too critical of others” [R]</td><td>0.12</td><td>0.40</td><td>-0.02</td><td>-0.11</td><td>0.08</td><td>-0.27</td><td>-0.07</td><td>AG<sup>Gentleness</sup></td></tr><tr><td>22.“On most days, I feel cheerful and optimistic”</td><td>0.27</td><td>0.38</td><td>0.31</td><td>0.04</td><td>-0.12</td><td>0.06</td><td>-0.03</td><td>EX<sup>Liveliness</sup></td></tr></tbody></table>
<table><thead><tr><th>Item</th><th>F1</th><th>F2</th><th>F3</th><th>F4</th><th>F5</th><th>F6</th><th>F7</th><th>Facet</th></tr></thead><tbody><tr><td>4.“I feel reasonably satisfied with myself overall”</td><td>0.03</td><td>0.37</td><td>0.16</td><td>0.05</td><td>-0.11</td><td>0.12</td><td>-0.07</td><td>EX<sup>Social Esteem</sup></td></tr><tr><td>56.“I prefer to do whatever comes to mind, rather than stick to a plan” [R]</td><td>0.04</td><td>0.32</td><td>-0.07</td><td>-0.02</td><td>-0.14</td><td>0.27</td><td>0.32</td><td>CO<sup>Prudence</sup></td></tr><tr><td>39.“I am usually quite flexible in my opinions when people disagree with me”</td><td>0.11</td><td>0.27</td><td>0.18</td><td>0.01</td><td>0.02</td><td>0.13</td><td>-0.21</td><td>AG<sup>Flexibility</sup></td></tr><tr><td>45.“Most people tend to get angry more quickly than I do”</td><td>-0.02</td><td>0.24</td><td>-0.03</td><td>0.16</td><td>-0.05</td><td>0.01</td><td>-0.00</td><td>AG<sup>Patience</sup></td></tr><tr><td>51.“Even when people make a lot of mistakes, I rarely say anything negative”</td><td>0.13</td><td>0.20</td><td>0.01</td><td>-0.05</td><td>0.03</td><td>0.02</td><td>-0.28</td><td>AG<sup>Gentleness</sup></td></tr><tr><td>34.“In social situations, I am usually the one who makes the first move”</td><td>0.04</td><td>0.01</td><td>0.67</td><td>0.08</td><td>-0.08</td><td>0.06</td><td>0.04</td><td>EX<sup>Social Boldness</sup></td></tr><tr><td>40.“The first thing that I always do in a new place is to make friends”</td><td>0.02</td><td>0.01</td><td>0.58</td><td>-0.02</td><td>0.06</td><td>0.10</td><td>0.08</td><td>EX<sup>Sociability</sup></td></tr><tr><td>58.“When I am in a group of people, I’m often the one who speaks on behalf of the group”</td><td>0.08</td><td>-0.20</td><td>0.54</td><td>0.08</td><td>-0.11</td><td>0.04</td><td>0.09</td><td>EX<sup>Social Boldness</sup></td></tr><tr><td>16.“I prefer jobs that involve active social interaction to those that involve working alone”</td><td>0.02</td><td>0.15</td><td>0.52</td><td>0.00</td><td>0.08</td><td>0.08</td><td>-0.04</td><td>EX<sup>Sociability</sup></td></tr><tr><td>10.“I rarely express my opinions in group meetings”[R]</td><td>0.12</td><td>-0.04</td><td>0.45</td><td>0.08</td><td>-0.03</td><td>-0.09</td><td>0.07</td><td>EX<sup>Social Boldness</sup></td></tr><tr><td>36.“I would never accept a bribe, even if it were exceptionally large”</td><td>0.11</td><td>-0.00</td><td>0.16</td><td>0.00</td><td>-0.05</td><td>0.15</td><td>-0.02</td><td>HH<sup>Fairness</sup></td></tr><tr><td>13.“I would enjoy creating a work of art, such as a novel, a song, or a painting”</td><td>0.03</td><td>0.05</td><td>0.01</td><td>0.71</td><td>0.14</td><td>-0.06</td><td>0.10</td><td>OP<sup>Creativity</sup></td></tr><tr><td>25.“If I had the opportunity, I would like to attend a classical music concert”</td><td>0.02</td><td>-0.09</td><td>0.02</td><td>0.66</td><td>-0.05</td><td>0.08</td><td>0.05</td><td>OP<sup>Aesthetic Appreciation</sup></td></tr><tr><td>1.“I would be quite bored by a visit to an art gallery” [R]</td><td>0.00</td><td>0.04</td><td>0.08</td><td>0.57</td><td>0.01</td><td>0.01</td><td>0.00</td><td>OP<sup>Aesthetic Appreciation</sup></td></tr><tr><td>55.“I find it boring to discuss philosophy” [R]</td><td>0.04</td><td>0.05</td><td>0.00</td><td>0.50</td><td>-0.08</td><td>0.05</td><td>0.18</td><td>OP<sup>Unconventionality</sup></td></tr><tr><td>49.“I do not think of myself as the artistic or creative type” [R]</td><td>0.03</td><td>0.13</td><td>-0.04</td><td>0.48</td><td>-0.05</td><td>-0.00</td><td>-0.08</td><td>OP<sup>Creativity</sup></td></tr><tr><td>31.“I have never really enjoyed looking through an encyclopedia” [R]</td><td>0.13</td><td>-0.12</td><td>0.05</td><td>0.40</td><td>-0.07</td><td>-0.13</td><td>0.33</td><td>OP<sup>Inquisitiveness</sup></td></tr><tr><td>43.“I like people who have unconventional views”</td><td>0.07</td><td>-0.06</td><td>0.17</td><td>0.34</td><td>-0.10</td><td>0.32</td><td>0.17</td><td>OP<sup>Unconventionality</sup></td></tr><tr><td>37.“People have often told me that I have a good imagination”</td><td>0.13</td><td>0.05</td><td>0.18</td><td>0.29</td><td>0.06</td><td>0.29</td><td>-0.09</td><td>OP<sup>Creativity</sup></td></tr><tr><td>47.“I feel strong emotions when someone close to me is going away for a long time”</td><td>-0.03</td><td>-0.09</td><td>0.10</td><td>0.02</td><td>0.57</td><td>0.16</td><td>0.16</td><td>EM<sup>Sentimentality</sup></td></tr><tr><td>17.“When suffering from a painful experience, I need someone to make me feel comfortable”</td><td>-0.02</td><td>0.09</td><td>0.14</td><td>-0.15</td><td>0.56</td><td>0.08</td><td>-0.22</td><td>EM<sup>Dependence</sup></td></tr><tr><td>59.“I remain unemotional even in situations where most people get very sentimental” [R]</td><td>-0.02</td><td>-0.08</td><td>-0.11</td><td>0.05</td><td>0.49</td><td>-0.20</td><td>0.04</td><td>EM<sup>Sentimentality</sup></td></tr><tr><td>35.“I worry a lot less than most people do” [R]</td><td>-0.18</td><td>-0.14</td><td>-0.20</td><td>0.07</td><td>0.44</td><td>0.04</td><td>0.04</td><td>EM<sup>Anxiety</sup></td></tr></tbody></table>
<table><thead><tr><th>Item</th><th>F1</th><th>F2</th><th>F3</th><th>F4</th><th>F5</th><th>F6</th><th>F7</th><th>Facet</th></tr></thead><tbody><tr><td>23. "I feel like crying when I see other people crying"</td><td>-0.04</td><td>-0.04</td><td>0.12</td><td>0.12</td><td>0.44</td><td>-0.08</td><td>-0.12</td><td>EM<sup>Sentimentality</sup></td></tr><tr><td>41. "I can handle demanding situations without needing emotional support from anyone else" [R]</td><td>-0.13</td><td>-0.06</td><td>-0.15</td><td>-0.20</td><td>0.40</td><td>-0.31</td><td>-0.04</td><td>EM<sup>Dependence</sup></td></tr><tr><td>29. "When it comes to physical danger, I am very fearful"</td><td>-0.13</td><td>0.18</td><td>-0.05</td><td>-0.13</td><td>0.39</td><td>0.11</td><td>-0.21</td><td>EM<sup>Fearfulness</sup></td></tr><tr><td>11. "I sometimes cannot help worrying about trivial things"</td><td>-0.11</td><td>-0.26</td><td>-0.11</td><td>-0.03</td><td>0.36</td><td>0.06</td><td>0.04</td><td>EM<sup>Anxiety</sup></td></tr><tr><td>53. "Even in an emergency I would not easily panic"</td><td>-0.16</td><td>-0.08</td><td>-0.11</td><td>-0.13</td><td>0.27</td><td>-0.05</td><td>-0.18</td><td>EM<sup>Fearfulness</sup></td></tr><tr><td>5. "I would feel afraid if I had to travel in severe weather conditions"</td><td>0.06</td><td>0.04</td><td>-0.02</td><td>-0.07</td><td>0.26</td><td>-0.02</td><td>-0.23</td><td>EM<sup>Fearfulness</sup></td></tr><tr><td>2. "I plan ahead and organise things, to avoid scrambling at the last minute"</td><td>-0.05</td><td>0.14</td><td>-0.06</td><td>-0.11</td><td>0.09</td><td>0.55</td><td>-0.08</td><td>CO<sup>Organisation</sup></td></tr><tr><td>50. "People often call me a perfectionist"</td><td>0.00</td><td>-0.32</td><td>0.01</td><td>0.06</td><td>-0.02</td><td>0.40</td><td>-0.05</td><td>CO<sup>Perfectionism</sup></td></tr><tr><td>8. "I often push myself extremely hard when trying to achieve a goal"</td><td>0.00</td><td>0.03</td><td>0.20</td><td>-0.02</td><td>-0.19</td><td>0.37</td><td>0.07</td><td>CO<sup>Diligence</sup></td></tr><tr><td>14. "When working on something, I do not pay much attention to small details" [R]</td><td>0.18</td><td>0.00</td><td>-0.13</td><td>0.08</td><td>0.20</td><td>0.35</td><td>0.16</td><td>CO<sup>Perfectionism</sup></td></tr><tr><td>19. "I think that paying attention to radical ideas is a waste of time" [R]</td><td>-0.06</td><td>0.03</td><td>0.11</td><td>0.15</td><td>0.02</td><td>0.34</td><td>0.02</td><td>OP<sup>Unconventionality</sup></td></tr><tr><td>26. "When working, I sometimes have difficulties due to being disorganised" [R]</td><td>0.10</td><td>0.28</td><td>-0.15</td><td>-0.14</td><td>-0.17</td><td>0.31</td><td>0.06</td><td>CO<sup>Organisation</sup></td></tr><tr><td>38. "I always try to be accurate in my work, even at the expense of time"</td><td>0.12</td><td>-0.11</td><td>0.09</td><td>-0.06</td><td>0.15</td><td>0.25</td><td>-0.18</td><td>CO<sup>Perfectionism</sup></td></tr><tr><td>7. "I am interested in learning about the history and politics of other countries"</td><td>-0.03</td><td>0.02</td><td>0.19</td><td>0.32</td><td>0.08</td><td>0.07</td><td>0.53</td><td>OP<sup>Inquisitiveness</sup></td></tr><tr><td>28. "I feel that I am an unpopular person" [R]</td><td>0.14</td><td>0.13</td><td>0.23</td><td>0.05</td><td>-0.26</td><td>-0.21</td><td>0.48</td><td>EX<sup>Social Self-Esteem</sup></td></tr><tr><td>44. "I make a lot of mistakes because I do not think before I act" [R]</td><td>0.18</td><td>0.35</td><td>0.00</td><td>0.06</td><td>0.02</td><td>0.15</td><td>0.39</td><td>CO<sup>Prudence</sup></td></tr><tr><td>46. "Most people are more upbeat and dynamic than I generally am" [R]</td><td>0.12</td><td>0.01</td><td>0.35</td><td>0.01</td><td>-0.19</td><td>-0.10</td><td>0.36</td><td>EX<sup>Liveliness</sup></td></tr><tr><td>32. "I do only the minimum amount of work needed to get by" [R]</td><td>0.28</td><td>0.00</td><td>0.14</td><td>-0.01</td><td>0.02</td><td>0.23</td><td>0.36</td><td>CO<sup>Diligence</sup></td></tr></tbody></table>

Abbreviation: Factor (F), Honesty-Humility (HH), Agreeableness (AG), Extraversion (EX), Openness to Experience* (OP), Emotionality (EM), Conscientiousness (CO) (Scale adapted from [23])

## References

1. Cappelli, D.M., Moore, A.P., Trzeciak, R.F.: The CERT Guide to Insider Threats: How to Prevent, Detect, and Respond to Information Technology Crimes (Theft, Sabotage, Fraud). Addison-Wesley, Upper Saddle River, New Jersey (2012)

2. Hunker, J., Probst, C.W.: Insiders and insider threats-an overview of definitions and mitigation techniques. J. Wirel. Mob. Netw. Ubiquitous Comput. Dependable Appl. 2(1), 4-27 (2011)

3. Legg, P.A., et al.: Towards a conceptual model and reasoning structure for insider threat detection. J. Wirel. Mob. Netw. Ubiquitous Comput. Dependable Appl. cations 4(4), 20-37 (2013)
4. Ponemon Institute: Privileged user abuse & the insider threat. http://www.trustedcs.com/resources/whitepapers/Ponemon-RaytheonPrivilegedUserAbuseResearchReport.pdf (2014). Accessed 06 Jan 2015

5. Jiang, J., et al.: Prediction and detection of malicious insiders' motivation based on sentiment profile on webpages and emails. In: IEEE Military Communications Conference, pp. 1-6. IEEE, Los Angeles, CA, USA (2018)

6. Simola, P., Virtanen, T., Sartonen, M.: Information security is more than just policy; it is in your personality. In: ECCWS 2019 18th European Conference on Cyber Warfare and Security, pp. 459-65. Academic Conferences and publishing limited, Coimbra, Portugal (2019)

7. Shropshire, J., Gowan, A.: Identifying traits and values of top-performing information security personnel. J. Comput. Inf. Syst. 57(3), 258-268 (2017)

8. Whitty, M.T.: Developing a conceptual model for insider threat. J. Manag. Organ. 1-19 (2018)

9. Maasberg, M., Warren, J., Beebe, N.L.: The dark side of the insider: detecting the insider threat through examination of dark triad personality Traits. In: 48th Hawaii International Conference on System Sciences (HICSS), pp. 3518-26. IEEE, Kauai, Hawaii, USA (2015)

10. Radhakrishnan, M., et al.: Proposed insider threat detection model for malaysian government agencies. Open Int. J. Inform. (OIFI) 54-67 (2018)

11. Ong, L., Chong, C.: Information security awareness: an application of psychological factors- a study in Malaysia. In: Proceedings of the 2014 International Conference on Computer, Communications and Information Technology, pp. 98-101. Atlantis Press, Beijing, China (2014)

12. Alahmadi, B.A., Legg, P.A., Nurse, J.R.: Using internet activity profiling for insider-threat detection. In: International Conference on Enterprise Information Systems, vol. 2, pp. 709-20. SCITEPRESS, Barcelona, Spain (2015)

13. Nurse, J.R., et al.: Understanding insider threat: a framework for characterising attacks. In: IEEE Security and Privacy Workshops, pp. 214-28. IEEE, San Jose, California, USA (2014)

14. Johnston, A.C., Warkentin, M., McBride, M., Carter, L.: Dispositional and situational factors: influences on information security policy violations. Eur. J. Inf. Syst. 25(3), 231-251 (2016)

15. McBride, M., Carter, L., Warkentin, M.: Exploring the role of individual employee characteristics and personality on employee compliance with cybersecurity policies. RTI International-Institute for Homeland Security Solutions 5(1), (2012)

16. Ajzen, I.: The theory of planned behavior. Organ. Behav. Hum. Decis. Process. 50(2), 179-211 (1991)

17. Bulgurcu, B., Cavusoglu, H., Benbasat, I.: Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness. MIS Q. 34(3), 523-548 (2010)

18. Ifinedo, P.: Understanding information systems security policy compliance: an integration of the theory of planned behavior and the protection motivation theory. Comput. Secur. 31(1), 83-95 (2012)

19. Ajzen, I.: The theory of planned behaviour: reactions and reflections. Psychol. Health 29(6), 1113-1127 (2011)

20. Van Gelder, J.-L., De Vries, R.E.: Traits and states: integrating personality and affect into a model of criminal decision making. Criminology 50(3), 637-671 (2012)

21. Ashton, M.C., Lee, K., De Vries, R.E.: The HEXACO Honesty-humility, agreeableness, and emotionality factors: a review of research and theory. Pers. Soc. Psychol. Rev. 18(2), 139-152 (2014)

22. Lee, K., Ashton, M.C.: Psychometric properties of the HEXACO personality inventory. Multivar. Behav. Res. 39(2), 329-358 (2004)

23. Ashton, M.C., Lee, K.: The HEXACO-60: a short measure of the major dimensions of personality. J. Pers. Assess. 91(4), 340-345 (2009)
24. Safa, N.S., et al.: Deterrence and prevention-based model to mitigate information security insider threats in organisations. Futur. Gener. Comput. Syst. **97**, 587–597 (2019)

25. Singh, A.K., Singh, S., Singh, A.: Does trait predict psychological well-being among students of professional courses? J. Indian Acad. Appl. Psychol. **38**(2), 234–241 (2012)

26. Hair, J.F., Black, W.C., Babin, B.J., Anderson, R.E.: Multivariate Data Analysis, 7th edn. Prentice Hall, Upper Saddle River, New Jersey (2010)

27. Mcleod, S.: Simply Psychology. https://www.simplypsychology.org/correlation.html (2020). Accessed 28 Sep 2021

28. van Winsen, B.: Determining secure digital behavior of individuals using hexaco personality traits. Erasmus School of Economics, MSc Thesis. Erasmus University Rotterdam, Netherlands (2020)

29. Shropshire, J., Warkentin, M., Sharma, S.: Personality, attitudes, and intentions: predicting initial adoption of information security behavior. Comput. Secur. **49**, 177–191 (2015)

30. Gratian, M., Bandi, S., Cukier, M., Dykstra, J., Ginther, A.: Correlating human traits and cyber security behavior intentions. Comput. Secur. **73**, 345–58 (2018)

31. van der Schyff, K., Flowerday, S.: Mediating effects of information security awareness. Comput. Secur. **106**, 1–12 (2021)

32. Ashton, M.C., Lee, K.: Empirical, theoretical, and practical advantages of the HEXACO model of personality structure. Pers. Soc. Psychol. Rev. **11**(2), 150–166 (2007)

33. Smith, R.D.: The Relationship between HEXACO Personality Traits and Cyberbullying Perpetrators and Victims. Doctor of Education. Liberty University, Lynchburg, Virginia (2016)

34. De Vries, R.E., Tybur, J.M., Pollet, T.V., van Vugt, M.: Evolution, situational affordances, and the HEXACO model of personality. Evol. Hum. Behav. **37**(5), 407–421 (2016)