The impact of a cause–effect elaboration procedure on information security risk perceptions: a construal fit perspective

Abstract

Cybersecurity breaches are on the rise. Extant literature in the development of strategies to enhance IT users’ online protective behaviours has neglected users’ cognitive processing of cybersecurity risk information. This study demonstrates a cause–effect elaboration procedure based on the concept of construal fit to influence online users’ cybersecurity risk perceptions. Using online experiments (N = 534), the construal fit between elaboration of causes vs effects of cybersecurity risks and perceived temporal distance (distant vs near) was manipulated. The results revealed that a construal fit between the elaboration of ‘effects’ (vs ‘causes’) and temporally ‘near’ (vs ‘distant’) cybersecurity risks enhanced users’ risk perceptions, which in turn predicted protective behavioural intentions. Ensuring construal fit is a novel, cognition-based approach to safeguard IT users against online threats. Our findings enrich existing staged theories used to investigate cybersecurity risk perceptions and suggest to practitioners that heightened cyber risk perception can effectively be induced by simultaneously enhancing the concreteness of IT users’ construal of cybersecurity incidents and emphasizing on its negative consequences (vs causes).

Stakeholder Perception’s of Cybersecurity for Welfare Technology and Remote Care Devices

“…Risk perception can be seen in light of decision making and the cognitive limitations, the structure of the environment and the uncertainty affiliated with expressing risk numerically (Gigerenzer & Todd, 1999). The individual's ability to have accessible information, and which information is available also influence risk perception (Kahneman, 2011), associated with fear or benefit (Finucane et al, 2000;Starr, 1969) and variability of different hazards (Fischhoff et al, 1978;Goh et al, 2022). The psychometric perspective views human activity and behavior and potential effects on this behavior such as context (Slovic, 1987).…”

“…When applying the risk perception understanding in the cybersecurity field, Huang et al (2010) conceptualized risk perception through hazards occurring in the digital domain, and the predictors were affiliated with the severity of consequences, impact and possibility of exposure to mention a few. Another study viewed the cause-effect of the construal fit perspective to demonstrate the impact on information security risk perception (Goh et al, 2022). Cybersecurity risk perception (referred to as risk perception in the following) can be understood as the risk associated with cyber threats and the potential impact on information and communication technology (ICT) and data.…”