Time pressure, a common phenomenon in everyday workplace environments, is an important driver for non-secure cybersecurity behaviour in organisations. Under time pressure, users are more likely to rely upon fast, affect-driven decision making, increasing their susceptibility to make mistakes and justify non-secure workarounds. This contributes to the role of human error in cybersecurity and counteracts cybersecurity measures (CSMs) designed to protect organisations from threats and vulnerabilities. In this study, we report results from an online survey (N = 207), investigating how users perceive the effectiveness of CSMs for facilitating secure behaviour under time pressure. Understanding how users perceive the effectiveness of CSMs is important to inform the design and implementation of such measures in practice. We find that perceived CSM effectiveness differs greatly across measures. Thereby, users’ appreciation of incident severity and the general level of time pressure in their daily lives emerge as important antecedents. We discuss theoretical and practical implications for the design and implementation of CSMs.

Purpose A growing body of research has identified time pressure as a key driver of cybersecurity (CS) risks and vulnerabilities. To strengthen CS, organizations use CS documents (e.g. best practices, guidelines and policies) intended to strengthen CS. The purpose of this paper is to provide an overview of how specifically time pressure is addressed by CS documents. Design/methodology/approach The authors conducted a systematic search for CS documents followed by a content analysis of the identified documents. First, the authors carried out a systematic Web search and identified 92 formal and informal CS documents (e.g. security policies, procedures, guidelines, manuals and best practices). Second, they systematically analyzed the resulting documents (n = 92), using a structured approach of data familiarization and low-/high-level coding for the identification and interpretation of themes. Based on this analysis, the authors formulated a conceptual framework that captures the sources and effects of time pressure along the themes of industry, operations and users. Findings The authors developed a conceptual framework that outlines the role of time pressure for the CS industry, threats and operations. This provides a shared frame of reference for researchers and practitioners to understand the antecedents and consequences of time pressure in the organizational CS context. Research limitations/implications While the analyzed documents acknowledge time pressure as an important factor for CS, the documents provide limited information on how to respond to these concerns. Future research could, hence, consult with CS experts and policymakers to inform the development of effective guidelines and policies on how to address time pressure in the identified areas. A dedicated analysis within each area will allow to investigate the corresponding aspects of time pressure in-depth along with a consideration for targeted guidelines and policies. Last, note that a differentiation between CS document types (e.g. formal vs informal and global vs regional) was beyond the scope of this paper and may be investigated by future work. Originality/value This study makes three main contributions to the CS literature. First, this study broadens the understanding of the role of time pressure in CS to consider the organizational perspective along the themes of industry, threats and operations. Second, this study provides the first comprehensive assessment of how organizations address time pressure through CS documents, and how this compares to existing research in academic literature. Third, by developing a conceptual framework, this study provides a shared frame of reference for researchers and practitioners to further develop CS documents that consider time pressure’s role in secure behavior.

In today's fast-paced society, users of information technology increasingly operate under high time pressure. Loaded with multiple tasks and racing against deadlines, users experience considerable cognitive load and stress which can detrimentally impact their behaviour. As a result, scholars have shown that the human firewall in cybersecurity is often compromised, with potentially catastrophic consequences for users, the organisations they represent, and their clients. However, despite concerns about the impact of time pressure on human cybersecurity (HCS) behaviour, research on this matter is scant and there is no literature review available that may inform researchers and practitioners about the current body of knowledge. To address this gap, we conducted a systematic literature review of 21 studies in leading outlets. Synthesising the findings of the extant literature, we present an integrative theoretical framework that conceptualises the impact of time pressure on HCS behaviour along the contexts, psychological constructs, consequences, and moderating factors of the phenomenon. For researchers, this framework can serve as a ‘route map’ to conceptualise the role of time pressure in the HCS context and to identify directions for further research. Practitioners can use the framework as a guide for devising effective countermeasures and for designing and provisioning systems.