“…Most of these organizational studies have indicated benefits from preventative measures on information security preservation outcomes. Nevertheless, these investigations have tended to either impose a particular system of situational ethics (Harrington, 1996; Hsu & Kuo, 2003; Kurland, 1995) or to utilize theory for predictive models of security effectiveness in which there is a “dominance of technical and functionalist preconceptions, essentially because most methods have been grounded in a particular well‐defined reality, i.e. that of the military” (Dhillon & Blackhouse, 2001, p. 148), leaving us with a gap in our understanding about the behavior related to information security, particularly in relation to their underlying behavioral causes (Phelps, 2005; Workman & Gathegi, 2005).…”