Can I Help Prevent Data Breaches in the Workplace? From Routine Activities to Extra-Role Security Behaviors

Employees’ extra-role security behaviors can help organizations reduce safety and security threats in their operational environment and protect organizational assets. What antecedents can foster employees’ engagement in such behaviors is an important question. In this study, we consider such extra-role security behaviors as protective behaviors that are driven by employees’ motivation to protect organizational digital assets. This study draws upon Protection Motivation Theory (PMT) and suggests that employees’ threat appraisal and security self-efficacy are key to such extra-role security behaviors. Also, the study opens the black box of threat appraisal using Routine Activity Theory (RAT), proposing that employees’ appraisal of the threat of data breach is from an understanding of routine activities within their organization. The research model is developed based on the above and test the model with employees working in financial organizations. The analyses show that both perceived threat of data breaches and perceived security efficacy increase employees’ engagement in extra-role behaviors. Further, security efficacy reinforces the effect of the threat of data breaches on extra-role behavior. Finally, the suitability of data as well as, interestingly, the presence of guardianship, increases the perceived threat of data breach.