Cybersecurity breaches are often attributed to human behaviour, where individuals fail to integrate ethical principles in their decision-making. This empirical study investigates the effectiveness of the Ripple Down Rules (RDR) method, a knowledge acquisition and representation method, in enhancing ethical awareness and reasoning in cybersecurity contexts. The proposed approach combines rule-based reasoning, case-based learning, reflection, and situated cognition to bridge the gap between ethical knowledge and action by systematically connecting scenario elements to ethical principles. Participants, recruited from a cohort of first-year psychology students, were exposed to training incorporating five ethical principles—Beneficence, Non-Maleficence, Justice, Autonomy, and Explicability—applied to realistic cybersecurity scenarios. The study employed a randomised controlled design with two treatment and one control groups, using pre- and post-study assessments to evaluate improvements in ethical principle identification and reasoning. Participants rated RDR as a clear and helpful tool for understanding ethical reasoning, with sensibility and helpfulness scores ranging from moderate to high. Results demonstrate that RDR training significantly improved participants' ability to identify ethical principles compared to learning without RDR, particularly for principles like autonomy and explicability. However, challenges persisted in distinguishing overlapping principles, such as beneficence and non-maleficence. Implications and guidance for use of RDR for ethics training are discussed.

The Gamer’s Dilemma challenges us to justify the moral difference between enacting virtual murder and virtual child molestation in video games. The Dilemma relies for its argumentative force on the claim that there is an intuitive moral difference between these acts, with the former intuited as morally acceptable and the latter as morally unacceptable. However, there has been no empirical investigation of these claims. To explore these issues, we developed an experimental survey study in which participants were asked to reflect on imaginary video game scenarios as part of a 2 (undertake virtual murder or molestation) X 2 (against an adult or child) X 2 (in a high or low realism virtual environment) factorial design. We found that there was a significant difference between people’s views about virtual murder and virtual molestation. Whether the virtual act was performed against an adult or child was non-significant in most conditions, whereas whether it was performed in a high or low realism virtual environment was significant in most conditions. Gender did not impact these results, whereas perceived gaming experience, hours of video game play per week, and integrity did. These results provide an empirical grounding for future discussions of the Gamer's Dilemma.

The human factor in information systems is a large vulnerability when implementing cybersecurity, and many approaches, including technical and policy driven solutions, seek to mitigate this vulnerability. Decisions to apply technical or policy solutions must consider how an individual's values and moral stance influence their responses to these implementations. Our research aims to evaluate how individuals prioritise different ethical principles when making cybersecurity sensitive decisions and how much perceived choice they have when doing so. Further, we sought to use participants’ responses to cybersecurity scenarios to create profiles that describe their values and individual factors including personality. Participants (n = 193) in our study responded to five different ethically sensitive cybersecurity scenarios in random order, selecting their action in that scenario and rating and ranking of the ethical principles (i.e., Beneficence, Non-Maleficence, Justice, Autonomy, Explicability) behind that action. Using participants’ demographics, personality, values, and cyber hygiene practices, we created profiles using machine learning to predict participants’ choices and the principle of most importance to them across scenarios. Further, we found that, generalising, for our participants Autonomy was the most important ethical principle in our scenarios, followed by Justice. Our study also suggests that participants felt they had some agency in their decision making and they were able to weigh up different ethical principles.

There is a lack of training for those designing and implementing cybersecurity policies and technologies concerning the ethical ramifications of their choices on users. Using a principlist approach as our ethical framework, we propose a serious game to assist the player to learn about ethical decision making by providing training about five ethical principles (Autonomy, Justice, Beneficence, Non-maleficence, and Explicability) in the context of cybersecurity decision making. There are many factors that impact human decision making, with personality identified as the most influential factor. A novel feature of our work is that it identifies the relationship between specific personality traits (Openness, Extraversion, Emotional Stability, Conscientiousness, and Agreeableness) and the priority given to each of these five ethical principles. We use personality-principle combinations to design the dialogues of multiple embodied conversational agents, or non-player characters (NPCs), to provide alternative ethical perspectives to the player. To improve the player's learning and engagement, they take on the role of a new employee in a cybersecurity firm and they interact with the NPCs in video meetups to discuss ethical dilemmas currently being faced by the cybersecurity team. Our results from a study conducted online with 219 cybersecurity students show that after playing the game, students were more aware of the ethical principles and their application to cybersecurity decisions. Moreover, players were able to recognize the agents' personalities, which could be helpful in achieving future tailored training.