This vignette study examines employees’ cyber incident reporting intentions by manipulating key constructs of the Theory of Planned Behaviour (TPB), specifically subjective norms and perceived behavioural control. In addition, it investigates the influence of organisational citizenship behaviour (OCB) and psychological safety, while adopting a broader definition of reporting that includes both formal and informal channels. The study employed three vignette scenarios with experimentally varied conditions and collected survey data from 818 Dutch employees in governmental and semi-governmental organisations. Results show that positive subjective norms consistently increased reporting intentions, whereas perceived behavioural control demonstrated partial effects. Both OCB and psychological safety emerged as strong independent predictors of reporting intention, with psychological safety providing the greatest explanatory value beyond the TPB constructs. With regard to reporting channels, higher perceived severity increased preferences for formal reporting channels, while lower perceived severity was associated with greater uncertainty and reduced reporting intentions across both formal and informal channels. These findings suggest that fostering psychological safety and OCB may enhance cyber incident reporting. Further research is needed to better understand how contextual factors, particularly in ambiguous situations, influence reporting preferences. • Feeling supported by others increased intention to report perceived cyber incidents. • Feeling safe at work strongly increased intention to report perceived incidents. • Workers who saw themselves as proactive showed stronger intention to report. • Incidents seen as serious increased intention to use formal reporting channels. • Incidents seen as minor reduced intention to report through any channel.

Purpose The purpose of this paper is to test the protection motivation theory (PMT) in the context of fear appeal interventions to reduce the threat of phishing attacks. In addition, it was tested to what extent the model relations are equivalent across fear appeal conditions and across time. Design/methodology/approach A pre-test post-test design was used. In the pre-test, 1,201 internet users filled out an online survey and were presented with one of three fear appeal conditions: strong fear appeal, weak fear appeal and control condition. Arguments regarding vulnerability of phishing attacks and response efficacy of vigilant online information-sharing behaviour were manipulated in the fear appeals. In the post-test, data were collected from 786 internet users and analysed with partial least squares path modelling. Findings The study found that PMT model relations hold in the domain of phishing. Self-efficacy and fear were the most important predictors of protection motivation. In general, the model results were equivalent across conditions and across time. Practical Implications It is important to consider online information-sharing behaviour because it facilitates the occurrence and success of phishing attacks. The results give practitioners more insight into important factors to address in the design of preventative measures to reduce the success of phishing attacks. Future research is needed to test how fear appeals work in real-world settings and over longer periods. Originality/value This paper is a substantial adaptation of a previous conference paper (Jansen and Van Schaik, 2017a, b).

Purpose The purpose of this paper is to compare three social cognitive models in their ability to explain intentions of precautionary online behaviour. The models are: protection motivation theory (PMT), the reasoned action approach (RAA) and an integrated model comprising variables of these models. Design/methodology/approach Data were collected from 1,200 Dutch users of online banking by means of an online survey and analysed using partial least squares path modelling method. Findings The two models equally explain about much of the variance in precautionary online behaviour; in the integrated model, the significant predictors of the two models remained significant. Precautionary online behaviour is largely driven by response efficacy, attitude towards behaviour and self-efficacy. Research limitations/implications One limitation is that the predictor variables – “self-efficacy” and “attitude” – are represented by one item only in the path-analysis because of high cross-loadings of the other items with the dependent variable. Practical implications The results give practitioners a potentially wider range of options to design preventative measures. Originality/value The three models are successfully applied to online banking. This paper concludes that both PMT and RAA make a unique contribution in explaining variance for precautionary online behaviour. This paper is a re-publication of a previous conference paper (Jansen and van Schaik, 2016).

Information technology is becoming increasingly important for entrepreneurs. Protecting their technical infrastructure and stored data is, therefore, also becoming more vital. Nevertheless, research into the safety and security of entrepreneurs in general, and online threats targeted at entrepreneurs in particular, is still limited. This study investigates to what extent self-employed entrepreneurs protect themselves against online threats, and what motivates them to do so. Based on secondary analyses on data collected from 1622 Dutch entrepreneurs, we observe that the majority implement technical and personal coping measures. By adopting protection motivation theory as a theoretical basis for our study, we found that coping appraisal explains the adoption of protective measures. Entrepreneurs are likely to implement protective measures when they believe a measure is effective, when they are capable of using internet technology, when their attitude towards online protection is positive and when they believe they are responsible for their own online security. Although the secondary analysis provides some limitations, this study offers new insights into the usage of protective measures and the motivation for taking them. These insights can help to improve information security campaigns.