Behaviours Through Security Heroes

Background: The rapid growth in modern society has led to an increased use of advanced

technology amongst organisations, resulting in an escalation of cybercrimes. In response,

organisations tend to frame humans as the “weakest link” and therefore turn to Artificial

Intelligence (AI) to combat cybersecurity challenges. However, this shift instigates

further complexities, as human capabilities appear more important than assumed.

Purpose: The purpose of this study is to explore why employees rely on certain

individuals in cybersecurity-related situations, and how such individuals may influence

cybersecurity behaviours within organisations through the concept of security heroes.

Methodology: This study uses a qualitative inductive research approach. This entailed

conducting a semi-systematic literature review, supported by semi-structured interviews.

The collected data was subsequently approached and analysed through the utilisation of

the Gioia-methodology.

Conclusion: This study has found that employees’ reliance on individuals depends on

both structural and relational factors that in turn determine the chosen source of guidance.

Reliance upon informal authorities, shaped by relational variables, evidently contrasts

reliance towards formal authorities as it is based on competence and experience.

Additionally, the role of security heroes has been established to be significant in shaping

employees’ cybersecurity behaviour through continuous encouragement, advocacy, and

support. Thus, security heroes should be accounted for within new awareness initiatives,

opening for a new understanding of how employees’ cybersecurity behaviours are shaped

in practice.