“…Employees' information security awareness and behaviour, and their resulting (non)compliance with information security policies, which has attracted increased attention in research, are considered a key socio‐organizational resource (Boss, Galletta, Lowry, Moody, & Polak, ; Bulgurcu, Cavusoglu, & Benbasat, ; Dhillon & Backhouse, ; Guo, Yuan, Archer, & Connelly, ; Hu, Dinev, Hart, & Cooke, ; Siponen & Vance, ). While referring to employees as the weakest link in the information security chain, researchers have focused on employees' individual perspectives (Crossler et al, ; Hu et al, ; Kearney & Kruger, ; Öğütçü, Testik, & Chouseinoglou, ; Wall, Prashant, & Lowry, ; Wang, Xiao, & Rao, ; Warkentin & Willison, ). A major challenge for organizations is to find an effective way to promote information security policies to individual employees (Boss, Kirsch, Angermeier, Shingler, & Boss, ; Cram, Proudfoot, & D'Arcy, ; Lowry & Moody, ) because employees have considerable influence on the effectiveness of the information security efforts of the organization (Herath et al, ; Öğütçü et al, ; Posey, Roberts, Lowry, & Hightower, ).…”