Assessing the Role of Security Education, Training, and Awareness on Insiders' Security-Related Behavior: An Expectancy Theory Approach

Organizational success in the digital age is largely dependent upon the ability to collect, manage, and transfer proprietary information. Given this knowledge economy, it is no exaggeration to say that the protection of sensitive information is a top priority for most firms. However, achieving information security is complicated by the increased access to organizationally relevant information afforded to employees -- putting organizational information security largely at the mercy of insiders. Despite wide-spread agreement across industry and academia on the importance of security education, training, and awareness (SETA) programs, relatively little scholarship has been devoted to understanding the effectiveness of SETA on motivating security-related behaviors. Employing expectancy theory, we make a multi-dimensional assessment of the motivational influence of SETA on two disparate security-related behaviors (a proactive and an omissive behavior). We find that SETA's motivational influence on proactive and omissive behaviors works through distinct expectancy dimensions.