Title: submit_R3 Emotional Reactions Cyber.pdf
Author: Richard Delahaye (LLE - Staff)

Emotional Reactions and Coping Responses of employees to a
cyber-attack: a case study approach
Abstract
Cybersecurity is a serious threat to information technology (IT) systems, with most organisations now relying on their IT systems to function day-to-day. Therefore, it is crucial that organisations ensure they are protected. This research investigates the emotional and coping responses of employees towards a cyber-attack. Data was collected through an in-depth case study approach (24 semi-structured interviews) conducted at a global manufacturing company, along with primary observations and a corpus of secondary materials. Our data analysis applied a grounded approach which was then refined using an emotion theoretic lens with the application of Technology Threat Avoidance Theory (ΤΤΑΤ). Drawing on structural appraisal theory, our findings indicate the IT security team in the case study oscillated between positive problem- focused coping and negative emotion-focused coping. A key explanatory feature or turnaround mechanism that mediated this oscillation was senior management empathy and resource mobilization. Building on the analyses, a conceptual model is developed called the Transformation of Coping through Empathic Leadership (T-CEL). The research suggests the crucial role that senior management play in transforming the emotional and coping capabilities of employees through their intervention and support. The study extends the IS Security theoretical background through a ΤΤΑΤ- lens for the analysis of cyber-attack incidents.
Keywords: IS Security; cyber-attack; Emotional Reaction; Coping Response; ΤΤΑΤ; case study
1		Introduction
Cybersecurity has become more prominent in the news and increasingly important at individual and organizational levels. To explore the interest in cybersecurity and the effects of cyber-attacks to employees, the paper builds on the literature concerning human, emotional aspects of cybersecurity (e.g. Frey et al., 2019; Furnell and Clarke, 2018; Beris et al., 2015). Current research on IT security personnel prioritises discussions of their role, practices, solutions and network systems knowledge (e.g. Assante and Tobey, 2011; Benasher and Gonzalez, 2015). Research on the emotional challenges faced by staff remains scarce (Frey et al., 2019). Also, the majority of human emotional research in cybersecurity focuses on the user. As well as technical knowledge, this paper argues that there is a need to study the emotional episodes and challenges that employees face when a cyber-attack occurs. There is evidence in the cognate information systems (IS) literature that emotion can disrupt IT professionals' ability to carry out their duties (e.g. Argyris, 1971; Barki and Hartwick, 2001). This has been recognised in industry conferences such as Black Hat where IT security professionals' mental health is the latest debate. This is understandable given the putative pressure a professional will be under when a cyber-attack occurs; an organisation's, even a nation's wealth is at stake (HM Government, 2016, p6). Therefore, understanding and offering all the emotional, cognitive and holistic support possible to staff is crucial (Furnell and Clarke, 2018).

https://www.blackhat.com/us-18/speakers/Christian-Dameff.html

Therefore, the aim of the paper is to offer a timely scholarly investigation into the emotional episodes and challenges of employees of organizational members before, during and after an actual cyber-attack using a case study approach. In order to investigate the emotions of employees we conducted an empirical study at a global manufacturing organisation in the UK (24 semi-structured interviews in a period of 6 months). The case organization has faced a cyberattack in the recent year where a hack into their data centre was attempted.
The rest of this paper is organized as follows: (i) a review of the current cybersecurity literature that focuses on human, emotional aspects; (ii) a description of the research questions, design and methods; (iii) drawing on structural appraisal theory, an analysis of the qualitative data collected and a conceptualisation of it into a model of Transformation of Coping through Empathic Leadership (T-CEL); (iv) a discussion of the model in light of the literature and present implications for theory and practice.
2		Literature Review
The study extends the research of cybersecurity programmes within organizations and the emotional and coping effects of a cyber-attack to employees. Information Systems (IS) Security research analyses the behaviors, decisions, and motivations of individuals (employees) following security compliance, regulations or even ethical behavior around IS use (Spanaki et al., 2019) but also the implications of technology avoidance and discontinous use due to negative incidents (Zamani et al. 2020, Zamani and Pouloudi, 2020). The focus of IS security research on the emotional challenges and coping responses faced by employees remains scarce (e.g. Beaudry & Pinsonneault, 2001, 2005; Ortiz de Guinea & Webster, 2011; Frey et al., 2019).
In this section, a literature review is conducted of cybersecurity definition and overview and the effects of cyber-attacks concerning human, emotional aspects (e.g. Frey et al., 2019; Furnell and Clarke, 2018; Beris et al., 2015). Through the review of the literature of emotion we draw on Technology Threat Avoidance Theory (ΤΤΑΤ) to build the theoretical framework of our study. Based on the theoretical background of TTAT which framed the interview questions and the research design of the case study in the following sections.
2.1		Cybersecurity and Cyber-attacks
In this section, we review the literature on cybersecurity definitions and the effects of cyberattacks. Information security is a primary concern as breach, data compromise, theft and fraud can be fatal to businesses (Soomro et al., 2016). Major organisations have suffered grave damage from security issues. In the UK alone, 93% of major organisations have experienced a data breach in one way or another (Soomro et al. 2016). According to Ashford (2012), the average cost of data breaches in the UK is £1.4 million with a recovery period of approximately 10 months. Data breach is expensive, time and resource consuming. The average cost of a data breach in the USA in 2013 cost approximately $4.4 million (Soomro et al., 2016). More recently, the University of California paid $1 million following a cyber-attack on its school of Medicine (Forbes, 2020). The importance of a good information system management cannot be overemphasised. It is important adequate secure measures are designed when implementing IS technologies. Previously, information security was viewed from a computer science and technology lens. Developing information security systems and tools or technologies is not enough to prevent a breach or compromise (Chan and Janjarasjit, 2019). The advent of information systems literature has paved the way for information security to be viewed and addressed from a managerial perspective (Haqaf and Koyuncu, 2018). Hence, removing the assumption of IS security as the main and sole role of technical or security analyst.
2.1.1		Cybersecurity
Cybersecurity is "the collections of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance and technologies that can be used to protect the cyber environment and organization and user's assets" (Solms and Niekerk, 2013: p97).

Figure 1: Image adopted from Solms and Niekerk (2013)

Studies agree (e.g. Hall, 2016; Smith et al, 2002) that because the internet has become critical to organisations and their operations, cyber-securing them has become a critical issue. A common theme across the research was the idea that cyber threats are evolving quicker than security teams can keep up with (Spalevic, 2014). The United Kingdom has identified cybersecurity as one of its top priorities contributing over £650 million to transforming National Cybersecurity Programme. According to the ΗΜ Government (2016) strategy report cyber threats cannot be completely eradicated; solutions can always be superceded by new forms of attack. Instead organizations need to learn to minimize them and the amount of damage they cause. One way to do this is looking at Routine Activity Theory (RAT) - this is a cyber-prevention strategy that has three steps, all which help to prevent cyber-attacks. The first step is to increase the effort that is required to be able cause a threat. The second is to increase the risk of being caught, this would make cyber hackers more scared and less likely to attack. The third is to reduce the rewards an individual can gain from a successful attack. If the rewards are small and the effort is substantial it is thought the attacks would less likely (Choo, 2011).
2.1.2		Cyberattacks
Jenab and Moslehpour (2016, ρ16) define cyber-attacks as the "deliberate exploitation of computer systems, technology-dependent enterprises and networks." Some of the cyber-threats faced include viruses, trojans and worms. Other cyberthreats are ones that technology can be used to initiate such as Terrorism or Extortion. Another threat, an innate one, involves the individuals within an organisation, "people often prove to be the weakest link within IT Security" (Slay and Koronios, 2006, ρ19). This quote supports Hall (2016) whose research relates to how employees are a key part of cybersecurity; without their compliance, technical solutions will fail. Employees or insiders are people who work in organisations and have access to privileges and internal information processes that may often enable them to exploit weaknesses (Willison and Warkentin, 2013). This is because the IT department can have policies and procedures but if the employees choose not to follow these rules the organisation can still be at risk. According to Colwill (2009), cybersecurity control measures should not revolve around the technology alone. Organizations who disregard behavioural and human issues around cybersecurity are more susceptible to compromise or catastrophe (Safa et al., 2015). Various literature has identified user behaviour around cybersecurity and even applied these studies in detecting potential insider attacks. Harilal et al., (2018) carried out a simulation of malicious acts in an organization by employees. Liang and Xue (2009) carried out research describing how to avoid malicious IT in organisations and also how to motivate employees to avoid threats themselves. This latter research draws from technology acceptance theories to provide an understanding of employees avoidance behaviour towards Information technology threat. It formulates a technology threat avoidance theory (TTAT) which conceptualises the cognitive processes employees go through when faced with Information technology threats. These cognitions involve the appraisal of and coping with IT threats.
2.2		Human Aspects of Cybersecurity
Within the HM Government (2016) strategy the view is that cybersecurity should not only be an IT department or technical person's job; it should be down to the whole organisation to work together towards keeping the organisation safe from cyberthreats. However, this is typically not the case. Cybersecurity pressures are usually placed squarely on the IT team's shoulders. According to Colwill (2009), cybersecurity controls are often focused around technological measures with very little attention given to the human and behavioural aspect. According to International Telecomm Union (ITU), cybersecurity involves the collection of policies, tools, guidelines, trainings, approach, standards and frameworks used to protect a computer, cyber environments and its assets (ITU, 2009). Research by Benasher et al (2015) investigates how individuals within the technical roles at an organisation cope with detecting malicious events. The results found that knowledge of cyber terms helps in detection and how to make decisions on them. Also, the more individuals are aware and understand cybersecurity implications, the more likely they are to take proactive positive decisions. However, a major headache for technical and security operation centres is designing consistent security policies, compliance issues and knowledge gaps of cybersecurity amongst employees. It is one thing to have laid down policies in place to guide employees and it is another thing for employees to have adequate knowledge around cybersecurity measures which often emanate from consistent training and awareness. Spalevic (2016) agrees, pointing out that organisations can lack the skills to understand and monitor threats. Therefore, more training in cybersecurity is needed within the technical teams and general employees. It is not enough to just to train employees on what cybersecurity is, to have fully trained staff they need to have not only book knowledge and hands on training but also be assessed in a work environment. Employees should then become skilled enough to be able to think like attackers and provide proactive feedback to aid the organisation in what attackers could do next (Assante and Tobey, 2011). An effective tactic is to encourage users in maximizing the use of technologies around security. Ensure employees understand the awareness and importance of security policies and how a secure cloud environment improves their work. In addition to this training, Hall (2016) thinks that organisations also need to be able to create a culture around good cybersecurity practice without resentment. This is interpreted to mean an organisation has a workforce that is engaged and follows the rules set out in the policy and are also happy to be doing it because they understand the threat. This is echoed in studies by Evans et al (2019) and Loft et al (2019). Despite such cultural moves, some employees may still feel negative emotions such as resentment towards cybersecurity policies which influence their practices including not following cybersecurity procedures.
The wider literature considers a range of human aspects of cybersecurity, including: information security decisions (Frey et al., 2019; Snyman et al. 2018), risk understanding (Beris et al., 2015), resilience and job stress (McCormac et al., 2018), fear appeals concerning phishing (Jansen and van Schaik, 2018), motivation towards security programmes (Weir et al., 2019), rationality in decision making around security policies (Bulgurcu et al., 2010), fear, accountability, self-control (Willison and Warkentin, 2013) and, emotional stances towards security policy (Beris et al., 2015). Findings from these studies provide substantial understanding of employee's drive and motivation and all psychological processes involved in complying with organisational cybersecurity policies (Samonas et al., 2020). However, why motivational factors have been identified and considered, studies have yet to identify employees' emotional attitudes and responses towards cybersecurity technologies and policies. This research provides emphasis on understanding employee's emotions and perception around cybersecurity by developing a theoretical understanding of the human aspect of cybersecurity. Do employees have a full understanding of the implications around cybersecurity or are more concerned in adhering to the security policies in organizations (Samonas et al., 2020). Will employees remain intentional about cybersecurity even when surveillances or audit checks are not in place? This can only be determined when there is a clear understanding of emotional responses of employees to cybersecurity.
2.2.1		Protection Motivation and Fear Appeals
Subjecting users to fear appeals (concerning phishing) has been studied by drawing on protection motivation theory (ΡΜΤ) (Jansen and van Schaik, 2018: p264). ΡΜΤ measures individual's response when challenged with a threat. It is the most appropriate definitive theory that ascertains human emotion and behaviour when faced with complex situations (Floyd et al., 2000). According to Lee and Larsen (2009), PMT addresses the probability that individuals will adopt protective behaviours with expectations of consequences for their actions. The fundamental position of PMT is that protection stems from cognitive appraisals of the occurrence of a threatening event with the assumption that a coping behaviour will be adopted to either prevent or deal with the situation (Milne et al., 2000). A study by Ibid featured an online survey of 1,201 internet users who were presented with one of three fear appeals: strong, weak and control. The study found that raising the perceived threat through a fear appeal intervention was important because it stimulated user threat appraisal which in-turn initiated coping appraisal (p:273). Coping was not immediately or directly implemented by users however, since this depended on their self-efficacy, i.e. their self-belief in their ability. Threat appraisal is centred around responses and behaviour to danger or threatening events which is often more likely to increase when one perceives the event as very severe or endangering whereas coping appraisal is more concerned with adaptive responses and individual's ability to cope with the threat per se (Lee and Larsen, 2009). According to Pechmann et al., (2003), protective behaviour displayed by individuals depends on the perceived severity of the threat often described as response efficacy. As well as self-efficacy, another psychological challenge is resilience - employees in cybersecurity are often challenged with security related stress complexities, overload or uncertainties (D'Arcy et al., 2014). While coping theory has been identified as a method in which individuals adapt to psychological stress, McCormac et al. (2018) also found that resilience was a key mediator between job stress and information security awareness. Resilience is a process of adapting well in the face of adversity, trauma, tragedy, threats or even significant sources of stress (Ibid citing American Psychological Association, 2014: p.2). Job stress occurs when work demands and pressures do not match an individual's knowledge and abilities, i.e. their ability to cope (McCormac et al., 2018: p.279; Stich et al., 2019). While stress is not equivalent to emotion, there are interesting parallels to Jansen and van Schaik (2018) via the coping concept.
2.2.2		Security Behaviour, Strategies and Actions
One strategy that employees use to cope is to follow the actions of others. This bandwagon behaviour was evidenced in Snyman et al. (2018) who examined information security behaviour from the perspective of the lemming effect; this concerns the propensity of individuals to follow group behaviour even when dangerous. This was detected using behavioural threshold analysis which indicated that the lemming effect helps explain certain information security behaviour.
To change such behaviour requires educating and motivating employees (Weir et al., 2019), for example through games (Frey et al., 2019; Micallef and Arachchilageq, 2018) and interventions (e.g. Weir et al., 2019). A serious game was designed and implemented with a view to educating employees to provide stronger answers to online security settings and prompts (Micallef and Arachchilageq, 2018). Key findings and contributions of the study are that socially oriented prompts (e.g. a friend's name) were undesirable because users feared that friends and family could gain access to their secure accounts (Micallef and Arachchilageq, 2018: p.365). The study implies that the intrinsic motivation of the game created a better learning experience. In another study, a tabletop game was designed to test the decision-making of organizational employees (Frey et al., 2019). Three groups of employees were tested by Frey et al. (2019)- security experts, computer scientists and managers. Only the computer scientists took actions and policies in the game that favoured human factors, while security experts and managers were strongly attracted to high-tech solutions. The study concluded that better integration was needed between business, computer science and security decisions.
Another study also stratified the employees of 2 multinational organizations, drawing on the Johari window concept (Beris et al., 2015). The Johari window provides a more defined description of behavioural security within quadrants. Using the concept, they constructed a behavioural security grid which consisted of four combinations of affective or emotional security (AS) and risk understanding (RU) - blind, open, hidden and unknown. The 'open' employees were styled as security champions as they demonstrated strong positive AS and strong positive RU. The study suggested that organizations mostly comprising such champions would have a healthy security culture and a positive emotional stance towards cybersecurity. The blind quadrant describes individuals who behaved contrary with organisation security policies not out of intentional disobedience but simply because of the unawareness. The hidden behaviour also known as the shadow security describes individuals who are aware of the risk but show negative valence towards security policies in organisations. The unknown quadrant includes employees who perceive the security framework and guidelines of an organisation as inefficient and develop negligent attitude towards the different risks involved (Beris et al., 2015). What is evident is that employees within the open quadrant display more affective security behaviour within the behavioural security grid. This is often because these employees perceive security as their personal duty and responsibility and see organisational security policies as a part of them.
Im summary, our paper contributes to and addresses an under-researched area in the above human aspects of cybersecurity research, i.e. the dearth of work on the emotional responses of IT security personnel during a cyber-attack. There are few or no papers that have captured the emotional dynamics during evident attacks. However, some have studied them artificially or propositionally (e.g. Frey et al., 2019; Beris et al., 2015). We now discuss this emotional seam of the cybersecurity literature following a short discussion of the emotion concept.
2.2.3		The Emotion Concept, Security Actions and Response
In this age of emotion research (BBC, 2017), the emotion concept is being used to understand many facets or ordinary and organisational life. For example, emotion is used in studies of information systems use (e.g. Venkatesh, 2000), employee email use (Stich et al., 2017), not to mention cybersecurity (e.g. McCormac et al., 2018; Jansen and van Schaik, 2018). The concept of emotion has been applied in various IS literature. Emotion makes up a very fundamental part of our daily lives from work to personal security. Compared to mood and dispositional forms of affect, emotion has an identifiable stimulus or trigger, is shorter in duration, and is more intense or 'hot' (Scherer, 2009).

Figure 2: Distinguishing Emotion from other Affect types

Figure 2 communicates that not only is emotion shorter in duration (t) compared to other affect types (a) but it is more sensitive or reactive to stimuli (e.g., an event), hence it is depicted as being 'spikier' than both mood and dispositional affect. In this study, the focus is on emotional responses to security threats.
How people respond emotionally depends on their appraisals (c.f. Stacey and Tether, 2015). According to appraisal theory, emotion has a stimulus, appraisal and consequence. The stimulus can be caused by an event or an object. The appraisal part considers the importance of the stimulus in relation to the subject's life and this affects their ability to take consequent action. Stein et al.'s (2015) research looks at how emotion impacts employees' interaction with IT. Their research finds that various appraisals and emotions are prompted when IT-based change happens. They point to four different types of resultant emotions: The first is achievement, the second is challenge, which induces excitement and hope, the third is loss which induces anger and dissatisfaction, and the fourth is deterrence, brought on when a user feels anxiety and fear.
Emotion is a highly potent aspect of IT use and stewardship (e.g. Barki and Hartwick, 2001) which can even derail use (e.g. Ortiz de Guinea and Markus, 2009). And, cybersecurity is no exception; according to Hall (2016), resentment can mitigate cybersecurity culture formation. To 'nudge' people into positively adopting cybersecurity technologies, there are research efforts to improve the user experience (Avital et al., 2006; Beaudry and Pinnsoneault, 2010). In cybersecurity, one approach is gamification (Frey et al., 2019; Micallef and Arachchilage, 2018). This is in contrast to fear appeals (Jansen and van Schaik, 2018) or emotionally negative approaches, which can also be beneficial by reducing security threats. While inducing both negative and positive user emotions to cyber-secure organisational assets seems paradoxical, there is a purpose for each approach - gamified positivity (Micallef and Arachchilage, 2018) being helpful for user education on IT/cybersecurity (e.g. Snyman et al. (2018), while fear appeals (Jansen and van Schaik, 2018) help provoke users to take action against imminent IT security threats such as phishing - see Figure 3 below.

Positive emotion inducement:
Security Education

Negative emotion inducement: 	►	Call-for-action

(e.g. gamification; Micallef and | (e.g. Fear appeals; Jansen and van
Arachchilageq, 2018) | Schaik, 2018)

Figure 3: Role of Opposing Emotions in Preparing Users
These approaches could be said to promote compliance. On this point, Coupland (2008) studied emotion in the workplace i.e. how people will use their work rights, obligations and role-based resources to either able or constrain their emotional experiences. Managers tended to find it hard to detach their own emotions from the ones the general organisation feels. They found they feel responsible for other people's emotions, so they would then supress their own and think of the others first. The apporaches in Figure 3 play a role here, by attuning the personnel to the organisational 'feel'.
But even with such attunement, not all users take action and respond to security threats in the same way; while some have the self-efficacy and resilience to act on negative calls-for-action and cope with the security threat, others do not (Jansen and van Schaik, 2018; McCormac et al., 2018). While there is research into the emotional responses and coping of IT users with respect to security threats, there is little research concerning the emotional responses and emotional coping of staff to an actual and specific security event; our study contributes to cybersecurity research by addressing this gap.
2.3		Theoretical Framework
To analyse the emotional responses and coping of staff, an adaptation of an established emotion theory called structural appraisal theory is drawn on (e.g. Stacey and Tether, 2015). Structural appraisal theory has been employed in cybersecurity research (Jansen and van Schaik, 2018) as well as in cognate IS/IT studies concerning malicious IT (e.g. Liang and Xue, 2013). Structural appraisal theory is a cognitive theory with its roots in Hume's (1738) Reflections of Impressions. According to structural appraisal theory, an emotion is formed based on an appraisal of a stimulus, such as a cyber-attack event. The appraisal has two parts (Lazarus and Folkman, 1984) - primary and secondary. The primary appraisal involves a subject assessing the importance of the encountered stimulus in respect of their goals; the secondary appraisal involves the subject assessing their ability to cope with the stimulus, once they have accepted that the stimulus is relevant to their goals, i.e. has passed the primary appraisal stage. Coping includes the ability to draw on resources to enable (and constrain) their emotional experience (Coupland, 2008). Once these stages have been ascertained, action is taken in respect of the stimulus, i.e. the structured appraisal is acted upon.
One way of motivating employees is through technology threat avoidance theory (TTAT). TTAT involves two cognitive processes, the coping appraisal and the threat appraisal and it is based on these appraisals that a user will decide how to deal with an IT threat (Stacey and Tether, 2015), this position is also supported by previous studies in the field of coping mechanisms (Lazarus and Folkman, 1984). Threat appraisal is the idea that IT users develop of a perception of a threat, so to what extent the individual considers something as a threat. Individual's perception of threat is determined by the probability of the threat occuring and the extent of its consequences (Liang and Xue, 2009). An individual can think about a threat in terms of whether it will negatively impact them or if they think it could cause severe damage (Janz and Becker, 1984). The issue with this view is what the understanding of severe is. The researchers' example of this is that an individual might think a virus is much worse than spyware however the spyware can cause as much damage but that will only be identified if someone perceives the spyware as dangerously as they do a virus, and this is a difficult thing to measure. It then goes on to talking about the coping appraisal and this is the view of an individual being able to cope with an active threat if they think they can avoid it with a safe guarding measure. However, according to Bandura (1982) if an individual does not think the safeguarding tool will solve the problem or understand it then it may not be used. This was an important point as it shows that potentially if people cannot recognise something as a cyber-threat they then will not go into the coping part of the process or if they do recognise the threat it does not necessarily mean they understand the safe guarding tool to prevent that threat.
Within cybersecurity research, structural appraisal theory has been adapted into the Technology Threat Avoidance Theory (TTAT) (Liang and Xue, 2013). TTAT particularizes goals to be threat oriented, and, drawing on coping theory (Folkman & Lazarus, 1985; Lazarus, 1993; Lazarus & Folkman, 1984), also splits coping into two further parts - emotion-focused and problem-focused coping (e.g. Jansen and van Schaik, 2018). Figure 4 below depicts the constitution of this TTAT-based analytical lens.

Figure 4: TTAT-based Analytical Lens

We draw on the TTAT-based analytical lens to inform our data collection and analysis, which we delineate in the methodology section below. We summarize our research questions and contributions to literature in Table 1 below. In short: we examine the emotional and associated coping responses of staff, to a particular cybersecurity event and within a specific context. We also develop suggestions on how the staff and their organisations can be supported in order to emotionally (and otherwise) cope with IT security threats.
Research question concept | Supportive Literature

(i) Coping during emotional episodes

Frey et al., 2019; Jansen and van Schaik, 2018;
McCormac et al., 2018; Liang and Xue, 2013

(ii) Role of resources in (i) | Micallef and Arachchilage, 2018; Coupland, 2008; Beaudry and Pinnsoneault, 2010
Table 1: Research question concepts and supporting literature

3		Research Approach
Our research took place at a multinational corporation called CSC (a pseudonym -for anonymity purposes) - a global manufacturing company situated in the UK. The case company CSC suffered a cyber-attack in 2017 which was dealt with before any serious damage was done. We investigated the emotional and coping responses of employees in CSC before, during and after the attack, in order to observe its impact. An in-depth qualitative case study design was adopted (Walsham, 1993; Bryman and Bell, 2011; Yin, 2014) where the study immersed in the organisation for six months. An interpretivist epistemology (Orlikowski and Baroudi, 1991) informed the research design - interpretivism advocates focusing on the meanings that people create and attach to their social working lives (Walsham, 1993). Interpretivism fits with appraisal theory because it too is concerned with meaning and how this generates emotion. Our research approach was ethnographic (Atkinson and Hammersley, 1994) - one in which interviewees are conversational partners (Rubin and Rubin, 1995); their voices are prioritized. An ethnographer seeks to understand a social context or situation from their point of view (Rosen, 1991), particularly through face to face contact - going native (Malinowski, 1954). Ethnographic approaches are extensively used in Information Systems (IS) and cybersecurity research; for example, studies of userdesigner relations (Nandhakumar and Jones, 1997), implementations of IS development methodologies (Wastell, 1996), and interventions to improve software development security (Weir et al., 2018).
3.1		Case Description: an overview of the cyber-attack incident
In early 2017, CSC's global anti-virus framework picked up a 'combined' cyber-attack that included a password hack attempt and a secondary hack with the aim of obtaining company data. The IT Advisor in Japan identified the global attack and contacted the various country sites including the UK IT security team. The UK network manager was on holiday however, so this was dealt with by the assistant network manager and colleagues. These IT security staff subsequently communicated the attack to the entire UK branch. Their emails expressed the urgency of the attack using subjects such as 'Force and Warn'. The body of these emails included coercive instructions to all personnel concerning changing their passwords with immediate effect. They felt it necessary to take this tone in the emails because most non-IT employees were aloof to such security issues; some even said they did not care about security. The forced password change was deemed necessary because all accounts had been locked out by the attackers as they attempted to hack for sensitive data, i.e. staff accounts were disabled due to too many incorrect password attempts. Even so, these instructions were negatively interpreted by the (non-IT) personnel of the company, i.e. as being a nuisance.
The employees of CSC and specifically IT security staff charged with solving this threat met regularly each day with senior management to confirm progress with changing all account passwords. Eventually the IT security were successful and gained the support of the organisation. However, this was at great emotional cost to them.
3.2		Data Coiiection
The data collection process involved primary data from interviews and secondary data from further communication with the stakeholders (emails, minutes, reports) of the case organisation.The primary data collected included semi-structured interviews and observations at CSC; the UK site was the worst affected by the cyber-attack and so was an ideal site to conduct the investigation. The primary data collection followed a three-step process of interviews: a) primary, b) exploratory, c) confirmatory, in order to identify the most informed interviewees, explore their views and confirm the results of this study respectively. It was decided that semi-structured interviews would be the most relevant because it would give each participant a similar interview while adding the flexibility of having open questions in order to explore incidents and meanings (Bryman and Bell, 2011). A set of pre-interview questions were sent to CSC partly for familiarisation purposes as well as kick-start the investigation. Short, phonebased interviews were conducted with prospective interviewees in which basic 'priming' questions (primary interviews)
1.		What role/management level are you?
2.		How do you understand the term 'cybersecurity'?
This enabled the identification of high-quality interviewees who were then invited for in-depth, detailed interviews, and job shadowing. Twenty-four interviews were conducted in total and all of them were transcribed - please refer to Table 2 below for a summary.
Primary Data:
Participant No | Role | Interview length (appx in minutes)
| | Primary | Exploratory | Confirmatory
Participant 1 | IT Assistant Manager | 10 | 32 | 14
Participant 2 | HR Admin | 15 | 28 | 15
Participant 3 | Learning and Development Officer | 18 | 36 | 20
Participant 4 | Networks Assistant Manager | 8 | 20 | 10
Participant 5 | Senior Officer - Health and Safety Compliance | 15 | 37 | 12
Participant 6 | IMS Specialist | 10 | 22 | 14
Participant 7 | IT Japanese Advisor | 8 | 24 | 10
Participant 8 | HR Manager | 12 | 40 | 18
Secondary Data:
Emails, Meeting minutes and reports from IT and non-IT employees
Table 2: Details of Data Collection
The detailed semi-structured interviews involved prepared questions which each interviewee was asked, while leaving them the latitude to elaborate on any aspect or even divulge new information (Rubin and Rubin, 1995). The prepared questions were split into three event 'time zones' - before, during and after the cyber-attack. Table 3 below provides a sample of questions each interviewee was asked, particularly pertaining to the 'during' and 'after' periods (exploratory interviews).
Question | Supporting literature
What emotions did you feel when you found out you were being attacked? | Liang and Xue, 2013; Assante and Tobey, 2011
Was the attack a priority to you? | Liang and Xue, 2013
Did you feel prepared to deal with the attack? | Liang and Xue, 2013; Janz and Becker, 1984
Did you feel a sense of responsibility? | Beaudry and Pinsoneault, 2010
Did you feel supported by management? | Liang and Xue, 2013
How did you cope? | Liang and Xue, 2013
Table 3: Interview Question Concepts and Supporting Literature

The assistant IT security manager was shadowed afterwards for several days to put their interview into context, e.g. the facilities and setting described. Relatedly, a University research ethics form was duly completed and approved by both the University and the research participants before any of the data collection began. This covered all aspects of data collection i.e. both primary and secondary data collection.
Secondary data was also collected including copies of employee emails and minutes of meetings before, during and after the week the cyber-attack event occurred. The organisation provided these emails and minutes. The emails were the email chain that were circulating when from when the threat was identified through to its resolution. The minutes were for meetings within the few days that the attack occurred and the actions therein stated which each employee had to take to ensure the attack was curtailed.
3.3		Data Analysis
Once the data was transcribed, the textual data was analysed by coding phrases, sentences and passages. We drew on Miles and Huberman's (1994) three tier approach to guide this coding process. The first tier, descriptive coding, involved identifying activities, events, and incidents revealed by the interviewees. For example, cybersecurity attacks, reactions to policies and so forth. The second tier, interpretive coding, put these descriptions into context so as to clarify their meaning and significance. For example, the consequences of staff not following certain policies and what it meant for the IT security staff. The third tier, pattern coding, involved us looking for patterns, themes, and relationships between meanings across the transcripts and secondary sources too. As patterns and themes emerged during pattern coding, our interpretation suggested concepts of triggers, goals, emotional reponses and coping. To articulate and conceptualise these more coherently, we drew on structural appraisal theory (SAT) and TTAT (a specific implementation of structural appraisal theory) and mapped elements of this lens to the outcomes of the three tier coding process - see Table 4 below which draws on Figure 4.
TTAT Element | Analytical Category
Stimulus | Cybersecurity and Attack
Goals (primary appraisal) | Priority

Emotion-focused coping (secondary appraisal)

- Team's Overall Feeling Towards Attack
- Feelings of Interviewee Towards Attack
- Feelings Changed During the Attack?
How?

Problem-focused coping (secondary appraisal) | Problem-solving
Consequence | Outcomes
Table 4: Application of SAT / TTAT Lens

4		Analysis and Findings
Drawing on a grounded coding of the data and further fine-grained analysis using the components from the TTAT lens (c.f. Figure 4), an overview of the appraisal elements
is provided below (Table 5), followed by detailed findings pertaining to the enquiry into the emotional and coping responses of IT security staff at CSC.
IT Security Staff Appraisal Elements | Finding
Security Threat Stimulus | Password hack and company data theft attempt
Goal | Protect the company accounts and data while preventing further attack
Coping Approaches | Problem focused (technical & cognitive) and emotional
Consequence of Coping | No data, email account or system was compromised
Table 5: Overview of IT Security Staff Appraisal Elements

A detailed analysis of the coping component follows, i.e. how IT security staff and nonIT staffs' appraisal of the threat stimulus led to TTAT problem-focused and emotion- focused coping, as well as the resources implicated in this process. The analysis was organised eventfully, i.e. before, during and after the attack. Through this an understanding of how IT security staff cope per se is attempted and how they can be better supported to cope with cybersecurity threats. For each of the analytical tables below, +-M means positive or negative mitigation (i.e. an activity that either helped or did not help the team deal with the stimulus), and, +-Ε refers to the associated positive or negative emotion experienced.
Staff Group | Problem-focused coping | Emotion-focused coping

IT security staff

poor CS software patch updates routines (-M1)
CS policies (+Μ1) X

frustration and irritation (-E1)
N 1

Non-IT staff

ignorance over CS per se and its importance (-M_2)
; /
poor adherence to CS policies (e.g. password policy
guide) (-M_3)

frustration and irritation (-E2)

Table 6: Coping before the attack
Referring to Table 6, before the attack, the non-IT staff did not adhere to the cybersecurity (CS) policies laid out by the IT security team; for example, by not following the strong password policy guide they had laid out (-M3). For example, according to the Senior Officer for Health and Safety Compliance: "I found changing my password regularly was quite annoying because it means you have to keep remembering a new one, also not being able to open some attachment also was irritating. So eventually I gave up." This frustrated the IT team (-E1) who had put in place a variety of cybersecurity policies (+M1). A typical security policy email they sent out read: "It is now more important than ever to follow our simple guidelines and help keep us protected: NEVER open an email attachment from an unknown recipient; Be careful when opening your personal mailboxes on company computers, (live, hotmail, gmail ...). NEVER open or download a document (word, excel, pdf, ...) which has macros enabled, even if the message is from a known recipient. NEVER enable macros in Word or Excel when you open a document from the internet. DELETE anything in your inbox that looks remotely suspicious" (secondary source provided by Assistant Networks Manager). As well as lethargy, another reason for non-IT personnel not adhering to policies was because of workflow interuptions. The non-IT personnel were agitated and frustrated (-E2) every time a new policy came through. Furthermore, the non-IT personnel did not understand the seriousness of the consequences of not following the cybersecurity policies; the data revealed significant non-IT personnel ignorance over cybersecurity per se (-M2). The IT personnel also did not strictly follow their own protocols - e.g. by not regularly updating the security software patches (Mi). This was influenced by the lack of interest of non-IT personnel. Therefore, the organisation was rendered vulnerable by the interactions between policy stimuli initiated by the IT security team and negative emotional responses of non-IT personnel to them. These responses became stimuli themselves, thereafter, deterring problem- focused coping of IT personnel (-E1). The IT personnel had intended to protect the organisation by implementing these policies. But this intention was not realised because it collided with engrained work routines of non-IT personnel which produced negative emotional 'sparks. Therefore, attempts to protect the organisation from
attack were mitigated by the emotional responses of non-IT personnel to the breakdown of their established routines that this protection required; the trade-off was not seen by them as being worth it.
Next is an analysis of the coping dynamics during the attack which was described above:
Staff Group | Problem-focused coping | Emotion-focused coping

IT security staff

unique technical skills (+M1)
absent IT security manager (-M.)
having to report directly to senior management rather than usual manager (-M3)
negative self-talk (-M6)

pressure, nervous, sleepless nights (last man standing') (-E3)
staff felt senior management’s empathy (+E1)

Non-IT staff

senior management sense tension and offer support and resource provision
(+M2)

Table 7: Coping during the attack

Referring to Table 7 above, when the assistant IT security manager picked up the
Japanese IT Security Advisor's alert to an attempted attack on the UK site, the pressure became almost too much to handle (-E3); in the manager's absence (-Μ4) only he and the assistant networks manager had the requisite technical skillset to cope with it (+Μ1). The assistant networks manager admitted: "This event which lasted the best part of a week was personally very stressful for me, I would go as far as saying this was the most stressful week of my working life". While they had the skillset, they confessed that they lacked the ability to deal with the pressure of the situation; they felt their skillset was a curse (-E3). Yet more pressure and nervousness (-E3) resulted from having to report directly to senior management rather than their usual line manager (-M5); it overwhelmed them. The assistant IT security manager said: "I really felt the strain of the responsibility to update the Senior board members of events and actions being taken." The assistant IT security manager also confessed to indulging in negative self-talk (-M6), being unsure whether they could emotionally cope with the burden of resolving the threat.
Senior management sensed their tension and offered their support and reassurance, making available any resources required (+Μ2), e.g. communications and departmental managerial support, i.e. facilitating more channels to and availability of their (senior management's) time. This was an important turnaround mechanism in the security team's episode - i.e. negative emotion-focused coping of a junior employee was mitigated by senior management empathy, moral and resourceful support. This boosted their self-efficacy and confidence to take action and solve the problem, "I learned a great deal and I did get very positive feedback and thanks from our Top management. This did make my efforts worthwhile and also made me feel stronger somehow" (assistant IT security manager). Having attained this positive turnaround during the attack, in terms of problem-focused and emotion-focused coping, everything went smoothly for the IT security staff thereafter.
After the attack, referring to Table 8, senior management continued their positivity by providing positive feedback to the IT personnel (+M6). These yielded feelings of contentment while boosting self-efficacy and confidence (+E2) not to mention relief, satisfaction, alleviation and comfort, after the event (+E3). IT security staff introduced and communicated new rules about attachments and macros; for example, some attachments would be automatically blocked, and permission would have to be sought to 'unblock' them (+Μ5). These were welcomed by non-IT staff who now understood the seriousness of such policies and adhered to them without protest (+E4). It also helped that senior management actively supported these policies and the IT security team (+M7).

Staff Group | Problem-focused coping | Emotion-focused coping

IT security staff

strong password policy implemented and communicated to all employees (+M_3)
effectively trouble-shooting; no data or system seriously compromised (+M4)
new rules communicated about attachments and macros (some attachments automatically blocked) (+Μ5)

positive feelings, self-efficacy and confidence (+E2)
4
relief, satisfaction, alleviation and comfort (+Ε3)

Non-IT security staff

senior management positive feedback to IT personnel (+Mg)
senior management support for CS policies (+Μ7)

company-wide adherence to rules without resentment
*(+E4)

Table 8: Coping after the attack

The next section builds-on and develops the insights of the above analysis, reflects on them in light of the literature and offers a conceptual model.
5		Discussion
Arguably, the entire episode above could have been avoided if personnel had been mindful of and applied IT security's policies. This finding is hardly surprising - it is consistent with many studies such as Hall (2016). The non-IT personnel were evidently agitated and frustrated by the IT security team policy making (Table 4, -Ε2). What has not been observed before in the literature is how this user antipathy and lack of compliance in-turn de-motivated the IT security team - a feedback loop. As a result, the team did not strictly follow their own standards and failed to regularly update the security software patches (Table 4, -Μι). The team forwent problem-focused coping for emotion-focused coping (Liang and Xue, 2013). This was associated with a lack of resilience (McCormac et al., 2018) which was further evidenced during the attack reported; the assistant manager and colleagues admitted that the pressure became almost too much to handle (Table 5, -Ε3). This was particularly due to their manager's absence (Table 5, -Μ4) and therefore having to deal directly with senior management themselves (Table 5, -M5). The IT security team's efficacy and resilience were boosted when senior management supported them however (Table 5, +M2). This, along with the resources they provided, acted as a turnaround mechanism and also led to company wide support for the IT security team (Table 6, +E4). But this support was in itself a social, psychological resource for the team (e.g. Beaudry and Pinnsoneault, 2010). According to ΤΤΑΤ (Liang and Xue, 2013), users tend to enter either problem or emotion focused coping. However, the team experienced negative emotion-focused coping when the cyber-attack occurred, but this was transformed into problem- focused coping by an intervention from senior management. Furthermore, the emotions the team experienced turned positive (Table 6, +E2).
In Figure 5 below, an early conceptual diagram is provided which is a tool-for-thinking rather than a final conceptual model (presented in Figure 6). It displays the key activities and contextual features that contributed to the security team moving between two modes of coping - problem and emotion focused. Before the attack the team were problem-focused, but continuous user resistance, antipathy and noncompliance wore them down, and resulted in them changing their mode of coping to one that was negative emotion-focused. This mode was transformed back to a positive problem-focused one as a result of senior management empathy and intervention. Time and again the cognate literature reports the importance of managerial support in IS/IT stewardship (e.g. Humphrey et al., 1991; Hwang, 2014). As well as permitting a positive mode of coping for the IT security team, this intervention also enabled organisation-wide support for IT security policies.

Examining this from a higher level of abstraction, senior management empathy and resource mobilization mediates and transforms the emotion and problem-focused coping modes of the team - see Figure 5 above. According to the literature reviewed, and the research question concepts (Table 1), this matter of senior management empathy is unexpected and novel.

Figure 6: Transformation of Coping through Empathic Leadership (T-CEL)
Based on the T-CEL model above, we develop the following three propositions:
Proposition 1: senior management empathy is vital to the emotional health and coping capability of IT security teams:
The T-CEL model suggests the crucial role that senior management empathy and support is vital to the transformation of the emotional health and coping capability of IT security teams. In our case, it was beneficial that the IT security team were forced to directly interface with senior management, on account of their line manager being absent. As a result, senior management saw first-hand the problem for themselves and bore witness to the negative coping mode or frame of mind that the team were in. The senior managers exercised empathy and provided their full support, mobilizing a variety of social, political, psychological and technical resources. As a result, the IT security team were able to move away from the negative coping mindset to a productive problem-solving one which led to the cyber-attack being prevented, as well as garnering the support of the organization. Similar effects of management empathy are observed in studies of other domains such as defense (Humphrey et al., 1991) and cancer care (Stacey and Tether, 2015), as well as across domains in terms of systems implementation success (Hwang, 2014). Further, senior management should adopt a positive, proactive, collaborative posture with the 'lower ranks'.
Proposition 2: Senior management should proactively design their organisations to be empathic at every level:
In our case, empathy happened on-the-hoof. However, we propose that empathy should be in the fabric of any organisation and at any level of an organisation. One could say that empathy should be 'designed' into an organisation. This is particularly important when so much is at stake, i.e. the strategic digital assets in our case. An empathic organisation is one that is in-tune with its personnel. Such attunement (Ciborra, 2002) is a means by which rapid action and improvisation can occur (Stacey and Nandhakumar, 2006; Janssen and van der Voort, 2020), thereby marshalling resources before a threat turns into a catastrophe. This is akin to the heedful interrelating thesis of Weick and Roberts (1993).
Proposition 3: Effective cybersecurity requires a supportive organisational culture:
Building from the cue of the last proposation, empathy and indeed organisational culture need to be supportive of the cybersecurity function; Hall (2016) notes that resentment can mitigate cybersecurity culture formation. We witnessed how such negative user attitudes towards cybersecurity could inflame the situation, as in creating more pressure on the IT security team with the consequence of easing up on preventative policies and practices. We propose that senior management need to step up to design, lead and maintain an organisational culture which is positive about cybersecurity measures. This may require some change management, employing frameworks such as sense demanding, breaking and making (e.g. Vlaar et al., 2008) to shake-up attitudes to cybersecurity.
5.1		Contributions to Knowledge
A key gap in the cybersecurity literature has been the human, emotional aspect of running an IT security operation; the majority of human emotional research in cybersecurity focuses on the user (Frey et al., 2019). Our study addressed this gap by providing a study and theorisation of the emotional responses of IT security personnel in a manufacturing MNC. We therefore contribute to knowledge both in terms of a distinct under-researched population of organisational employees, as well as in terms of the concept of emotion therein. Emotions are bio-cognitive emanations of meaningful stimuli, such as a cybersecurity threat. Emotions serve as an 'information system' which lead to calls for action (Scherer, 2009). Our study reveals the usefulness of emotions in bringing an organisation together in the face of an extraordinary digital threat. However, there is an emotional process or cycle involved which is not immediately helpful (e.g. Pengnate, and Riggins, 2020). We found that IT security personnel had significant and detrimental emotional responses to cyber-attacks, which impeded problem-solving initially. This is unfortunate because a swift response to such attacks is critical so that they do not spiral out of control. However, as noted above, there was a turnaround mechanism which mitigated the attack as well as their inhibiting negative emotional phase. This finding agrees with and extends from Beris et al (2015) who also noted the crucial role of leaders in promoting cybersecurity policy and a culture of positivity (Moon et al., 2018). We further theorise and contribute to this research by observing the role of senior management empathy towards their junior IT security colleagues, as well as their ability to exercise agile resource mobilization. These resources were not material, but rather communication- oriented, facilitating more channels to and availability of senior management. These features of empathy mediated and transformed detrimental emotions into a problem- focused frame of coping. Senior management empathy is particularly interesting, given the more general work on empathy in management and design (e.g. Stacey and Tether, 2015); it also reminds us of the intrinsic motivation finding from Micallef and Arachchilage (2018).
5.2		Implications for practice
In terms of the practical implications of our in-depth study and propositions, we firstly strongly encourage senior managers to engage with, actively listen to, understand and encourage their junior security engineers, rather than relying on middle management. It cannot be overrestimated how important junior colleagues find the support of their senior leaders. This is not purely an intrinsic issue, but has important implications for the conduct and efficacy of any cybersecurity strategy. This could be realised by organising regular meet-ups between senior and junior ranks during which candid exchanges in an 'open' environment can take place. Active listening should be employed by senior management when listening to their junior counterparts (e.g. Cegarra- and Sanchez-Polo, 2010); this is a process of actively sensing, interpreting, evaluating and responding to the verbal and non-verbal cues (Castleberry and Shepherd, 1993, p. 36). Secondly, senior management can devise an empathic organisation which is in-tune with its personnel. Such attunement cultivates empathy. As well as active listening, closer working relationships are necessary. This is difficult in times when absenteism is rife as a result of a coronavirus pandemic for instance. Closer working relationships are difficult to achieve at the best of times in a fastmoving environment, however senior manager must strive to avoid a 'runaway organisation' in which the pace over-rides opportunities for closer relationships, attunement and empathy. The consequences of this are plain in our study. Senior managers can therefore prioritise inter-personal work environments through intensive, 'frank' interactions online or in the office. This is how all relationships develop. Thirdly, senior managers must break the stigma of cybersecurity in their organisational cultures, by leading the charge to 'spin' the operation as an entirely positive line of defence. An analogy from war is a battlefield with two opposing sides; if the lines of one defence break, so an entire country can fall. All organisational members need to be (emotionally) on-side when it comes to cybersecurity.
5.3		Limitations, Future Research Directions
The limitations of this study lie mostly around the data collection process, as the data represent a single-case approach. One organisation in the UK was interviewed and therefore will only be a representation of this industry and size in a contextual approach. Further investigation in various industries, countries and organizations of various types is required from future research to explore further the context of cyberattacks and the associated emotions.
Also, this study was limited in a specific period of time and a single cyber-attack incident which was explored. In a future investigation, we advocate a longitudinal study of cyber-attacks in similar organisations. Such an in-depth, ethnographic approach could elicit deeper meanings and emotions attached to a wider array of phenomena, as well as provide a 'test' comparison over emotional responses and turnaround mechanisms.
In terms of further research, one could also investigate whether organisations that implement training, patch management and so forth, lead to different emotional response pathways. Furthermore, given the novel finding that oscillations can occur between positive problem-focused coping and negative emotion-focused coping, further research into mediators of this process are required.
6		Conclusion
In this paper, a timely scholarly investigation into the emotional episodes and associated coping modes of IT security staff was presented. IT security professionals' mental health is the latest debate in industry, e.g. the Black Hat conference. This paper therefore addressed a gap in the cybersecurity literature which is primarily interested in end user emotional responses to security threats. The empirics of the investigation were based on a case study of an MNC called CSC (a pseudonym) which suffered a 'combined' cyber-attack that included a password hack attempt and a secondary hack with the aim of obtaining company data. The data was analysed using a refinement of secondary appraisal which focuses on emotion-focused and problem-focused coping.
A key finding was that the IT security team in the case study oscillated between positive problem-focused coping and negative emotion-focused coping and that a key explanatory feature or turnaround mechanism was senior management empathy and resource mobilization. This finding concerning senior management empathy is a novel contribution to the cybersecurity literature and we encourage further research into the relationship between management empathy and coping modes.
7		References
Aktinson, P. and Hammersley, M., 1998. Ethnography and participant observation. Strategies of Qualitative Inquiry. Thousand Oaks: Sage, pp.248-261.
Alohali, M., Clarke, N., Li, F. and Furnell, S., 2018. Identifying and predicting the factors affecting end-users' risk-taking behavior. Information & Computer Security. http://dx.doi.org/10.1108/ICS-03-2018-0037
Argyris, C., 1971. Management information systems: The challenge to rationality and emotionality. Management science, 17(6),	pp.B-275. https://doi.Org/10.1287/mnsc.17.6.B275
Assante, M.J. and Tobey, D.H., 2011. Enhancing the cybersecurity workforce. IT professional, 13(1), pp.12-15. https://doi.Org/10.1109/MITP.2011.6
Avital, M., Lyytinen, K.J., Boland Jr, R., Butler, B.S., Dougherty, D., Fineout, M., Jansen, W., Levina, N., Rifkin, W. and Venable, J., 2006. Design with a positive lens: An affirmative approach to designing information and organizations. Communications of the Association for Information Systems, 18(1),	p.25. https://doi.org/10.17705/lCAIS.01825
Barki, H. and Hartwick, J., 2001. Interpersonal conflict and its management in information system development. MIS quarterly, 25(2), pp.195-228. https://doi.org/10.2307/3250929
Beaudry, A. and Pinsonneault, A., 2010. The other side of acceptance: studying the direct and indirect effects of emotions on information technology use. MIS quarterly, pp.689-710, https://doi.org/10.2307/25750701
Bell, E., Bryman, A. and Harley, Β., 2018. Business research methods. Oxford university press.
Ben-Asher, N. and Gonzalez, C., 2015. Effects of cyber security knowledge on attack detection. Computers in Human Behavior, 48, pp.51-61. https://doi.Org/10.1016/i.chb.2015.01.039
Beris, O., Beautement, A. and Sasse, M.A., 2015, September. Employee rule breakers, excuse makers and security champions: mapping the risk perceptions and emotions that drive security behaviors. In Proceedings of the 2015 New Security Paradigms Workshop (pp. 73-84). https://doi.org/10.1145/2841113.2841119
Castleberry, S. and Shepherd, D. (1993). Effective Interpersonal Listening and Personal Selling, Journal of Personal Selling and Sales Management 13(l):35-49
Cegarra-Navarro, J.G. and Sanchez-Polo, M.T. (2010) Implementing telemedicine through eListening in hospital-in-the-home units, International Journal of Information Management, Volume 30, Issue 6,	2010. https://doi.Org/10.1016/i.iiinfomgt.2010.04.005
Chan, S.H. and Janjarasjit, S., 2019. Insight into hackers' reaction toward information security breach. International Journal of Information Management, 49, pp.388-396. https://doi.Org/10.1016/i.iiinfomgt.2019.07.010
Ciborra, C. U. (2002). The Labyrinths of Information: Challenging the Wisdom of Systems. Oxford, Oxford University Press.
Colwill, C., 2009. Human factors in information security: The insider threat-Who can you trust these days?. Information security technical report, 14(4), pp.186-196. https://doi.Org/10.1016/i.istr.2010.04.004
Corbin, J. and Strauss, A., 2014. Basics of qualitative research: Techniques and procedures for developing grounded theory. Sage publications.
Coupland, C., Brown, A.D., Daniels, K. and Humphreys, M., 2008. Saying it with feeling: Analysing speakable emotions. Human Relations, 61(3), pp.327-353. https://doi.org/10.1177%2F0018726708088997
D'Arcy, J., Herath, Τ. and Shoss, Μ.Κ., 2014. Understanding employee responses to stressful information security requirements: A coping perspective. Journal of management information systems, 31(2),	pp.285-318. https://doi.org/10.2753/MIS0742-1222310210
Davey Winder (2020) The University of California Pays $1 Million Ransom Following Cyber Attack, United States: Forbes.
https://www.forbes.com/sites/daveywinder/2020/06/29/the-university-of- california-pays-l-million-ransom-following-cyber-attack/ [Accessed on 03/12/2020]
De Guinea, Α.Ο. and Markus, M.L., 2009. Why break the habit of a lifetime? Rethinking the roles of intention, habit, and emotion in continuing information technology use. Mis Quarterly, pp.433-444. https://doi.org/10.2307/20650303
Floyd, D.L., Prentice-Dunn, S. and Rogers, R.W., 2000. A meta-analysis of research on protection motivation theory. Journal of applied social psychology, 30(2), pp.407429. https://doi.Org/10.llll/i.1559-1816.2000.tb02323.x
Frey, S., Rashid, A., Anthonysamy, P., Pinto-Albuquerque, M. and Naqvi, S.A., 2017. The good, the bad and the ugly: a study of security decisions in a cyber-physical systems game. IEEE Transactions on Software Engineering, 45(5), pp.521-536. https://doi.org/10.1109/TSE.2017.2782813
Furnell, S. and Clarke, Ν. 2018. "Guest editorial", Information and Computer Security, Vol. 26 No. 3, pp. 262-263. https://doi.org/10.1108/ICS-06-2018-0065
Hall, M., 2016. Why people are key to cyber-security. Network Security, 2016(6), pp.910. https://doi.org/10.1016/S1353-4858(16)30057-5
Haqaf, H. and Koyuncu, M., 2018. Understanding key skills for information security managers. International Journal of Information Management, 43, pp.165-172. https://doi.Org/10.1016/i.iiinfomgt.2018.07.013
Harilal, A., Toffalini, F., Homoliak, I., Castellanos, J.H., Guarnizo, J., Mondal, S. and Ochoa, M., 2018. The Wolf Of SUTD (TWOS): A Dataset of Malicious Insider Threat Behavior Based on a Gamified Competition. J. Wirel. Mob. Networks Ubiquitous Comput. Dependable Appl., 9(1), pp.54-85. https://doi.org/10.1145/3139923.3139929
HM Government (2016) NATIONAL CYBERSECURITY STRATEGY 2016-2021. Available at:
https://www.gov.uk/government/uploads/system/uploads/attachment data/file /567242/national cyber security strategy 2016.pdf [Accessed on 03/12/2020]
Hume, D., 1739. (1978). A treatise of human nature (LA Selby-Bigge, Ed.). Oxford: Clarendon Press.
Humphrey, W.S., Snyder, T.R. and Willis, R.R., 1991. Software process improvement at Hughes Aircraft. IEEE software, 8(4), pp.11-23. https://doi.org/10.1109/52.300031
Hwang, M.I., 2014. Disentangling the effect of top management support and training on systems implementation success: A meta-analysis. Communications of the Association for Information Systems, 35(1),	p.2. https://doi.org/10.17705/lCAIS.03502
Insiders, C.,	2019. Cloud security report. https://www.cybersecurity- insiders.com/portfolio/2019-cloud-security-report-isc2/ [Accessed on 03/12/2020]
ITU. 2009 . Overview of Cybersecurity. Recommendation ITU-T Χ.1205. Geneva: International Telecommunication Union (ITU) http://www.itu.int/rec/T-REC- X.1205-200804-l/en [Accessed on 03/12/2020]
Jansen, J. and Van Schaik, Ρ., 2018. Persuading end users to act cautiously online: A fear appeals study on phishing. Information & Computer Security. https://doi.org/10.1108/ICS-03-2018-0038
Janssen, M., and van der Voort, H.(2020) Agile and adaptive governance in crisis response: Lessons from the COVID-19 pandemic. International Journal of Information Management, Volume 55, 2020, https://doi.Org/10.1016/i.ijinfomgt.2020.102180
Lazarus, R.S. and Folkman, S., 1984. Stress, appraisal, and coping. Springer publishing company.
Lee, Y. and Larsen, K.R., 2009. Threat or coping appraisal: determinants of SMB executives' decision to adopt anti-malware software. European Journal of Information Systems, 18(2), pp.177-187, https://doi.org/10.1057/ejis.2009.ll
Liang, H. and Xue, Y., 2009. Avoidance of information technology threats: A theoretical perspective. MIS quarterly, pp.71-90. https://doi.org/10.2307/20650279
Malinowski, B. (1954). Argonauts of the Western Pacific. London, Routledge & Kegan Paul.
McCormac, A., Calie, D., Parsons, K., Butavicius, M., Pattinson, M. and Lillie, M., 2018. The effect of resilience and job stress on information security awareness. Information & Computer Security. https://doi.org/10.1108/ICS-03-2018-0032
Micallef, N. and Arachchilage, N.A.G., 2018. Security questions education: exploring gamified features and functionalities. Information & Computer Security. https://doi.org/10.1108/ICS-03-2018-0033
Milne, S., Sheeran, Ρ. and Orbell, S., 2000. Prediction and intervention in health- related behavior: A meta-analytic review of protection motivation theory. Journal of applied social psychology, 30(1), pp.106-143. https://doi.Org/10.llll/j.1559- 1816.2000.tb02308.x
Moon, Y.J., Choi, M. and Armstrong, D.J., 2018. The impact of relational leadership and social alignment on information security system effectiveness in Korean governmental organizations. International Journal of Information Management, 40, pp.54-66. https://doi.Org/10.1016/j.ijinfomgt.2018.01.001
Nandhakumar, J. and Jones, M., 1997. Designing in the dark: the changing userdeveloper relationship in information systems development. ICIS 1997 Proceedings, p.5. https://aisel.aisnet.0rg/icisl997/5
Orlikowski, W.J. and Baroudi, J.J., 1991. Studying information technology in organizations: Research approaches and assumptions. Information systems research, 2(1), pp.1-28, https://doi.0rg/10.1287/isre.2.l.l
Pechmann, C., Zhao, G., Goldberg, M.E. and Reibling, Ε.Τ., 2003. What to convey in antismoking advertisements for adolescents: The use of protection motivation theory to identify effective message themes. Journal of marketing, 67(2), pp.1-18. https://doi.Org/10.1509%2Fjmkg.67.2.l.18607
Pengnate, S. and Riggins, F.J. (2020). The role of emotion in Ρ2Ρ microfinance funding: A sentiment analysis approach, International Journal of Information Management, Volume 54, 2020. https://doi.Org/10.1016/j.ijinfomgt.2020.102138
Rosen, M., 1991. Coming to terms with the field: Understanding and doing organizational ethnography. Journal of management studies, 28(1), pp.1-24. https://doi.Org/10.llll/j.1467-6486.1991.tb00268.x
Rubin, H. J. and S. I. Rubin 1995. Qualitative Interviewing: the art of hearing data. Thousand Oaks, Sage Publications Inc.
Safa, N.S., Sookhak, M., Von Solms, R., Furnell, S., Ghani, N.A. and Herawan, T., 2015. Information security conscious care behaviour formation in organizations. Computers & Security, 53, pp.65-78. https://doi.Org/10.1016/j.cose.2015.05.012
Samonas, S., Dhillon, G. and Almusharraf, A., 2020. Stakeholder perceptions of information security policy: Analyzing personal constructs. International Journal of Information	Management,	50,	pp.144-154. https://doi.Org/10.1016/j.ijinfomgt.2019.04.011
Scherer, K.R., 2009. The dynamic architecture of emotion: Evidence for the component process model. Cognition and emotion, 23(7), pp.1307-1351. https://doi.org/10.1080/02699930902928969
Snyman, D.P., Kruger, H. and Kearney, W.D., 2018. I shall, we shall, and all others will: paradoxical information security behaviour. Information & Computer Security. https://doi.org/10.1108/ICS-03-2018-0034
Soomro, Z.A., Shah, M.H. and Ahmed, J., 2016. Information security management needs more holistic approach: A literature review. International Journal of Information	Management,	36(2),	pp.215-225. https://doi.Org/10.1016/j.ijinfomgt.2015.ll.009
Spanaki, K., GOrgug, Z., Mulligan, C. and Lupu, Ε., 2019. Organizational cloud security and control: a proactive approach. Information Technology & People. https://doi.org/10.1108/ITP-04-2017-0131
Stacey P, Nandhakumar J. (2006) Responding to games development challenges through mood-mediated improvisation. Proceedings of the 14th European Conference on Information Systems (ECIS 2006), Goteborg, Sweden, June 2006.
Stacey, Ρ.Κ. and Tether, B.S., 2015. Designing emotion-centred product service systems: the case of a cancer care facility. Design Studies, 40, pp.85-118. https://doi.Org/10.1016/j.destud.2015.06.001
Venkatesh, V., 2000. Determinants of perceived ease of use: Integrating control, intrinsic motivation, and emotion into the technology acceptance model. Information systems research, 11(4),	pp.342-365. https://doi.0rg/10.1287/isre.ll.4.342.11872
Vlaar, P.W., van Fenema, P.C., and Tiwari, V., (2008). Cocreating Understanding and Value in Distributed Work: How Members of Onsite and Offshore Vendor Teams Give, Make, Demand, and Break Sense. MIS Quarterly, Vol. 32 No. 2, pp. 227- 255/June 2008. https://doi.org/10.2307/25148839
Walsham, G., 1993. Interpreting Information Systems in Organizations', John-Wiley, Chichester.
Warwick Ashford, (2012). Many UK firms underestimate cost of data breaches, study finds. http://www.computerweekly.com/news/2240171040/Many-UK-firms- underestimate-cost-of-data-breaches-studyfinds [Accessed on 03/12/2020]
Wastell, D.G., 1996. The fetish of technique: methodology as a social defence. Information systems journal, 6(1), pp.25-40. https://doi.Org/10.1046/j.1365- 2575.1996.00104.x
Weick, K. E., and Roberts, K. H. (1993). Collective mind in organizations: Heedful interrelating on flight decks. Administrative Science Quarterly. 38 357-381. https://doi.org/10.2307/2393372
Weir, C., Becker, I., Noble, J., Blair, L., Sasse, A. and Rashid, A., 2019. Interventions for software security: creating a lightweight program of assurance techniques for developers. In 2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) (pp. 41-50). IEEE. https://doi.org/10.1109/ICSE-SEIP.2019.00013
Willison, R. and Warkentin, M., 2013. Beyond deterrence: An expanded view of employee computer abuse. MIS quarterly, pp.1-20. https://doi.Org/10.25300/MISQ/2013/37.l.01
Yin, R.K., 2014. Case study research: Design and methods Los Angeles: Sage.
Zamani, E.D. and Pouloudi, Ν., 2020. Generative mechanisms of workarounds, discontinuance and reframing: a study of negative disconfirmation with consumerised IT. Information Systems Journal, https://doi.org/10.llll/isj.12315
Zamani, E.D., Pouloudi, N., Giaglis, G.M. and Wareham, J., 2020. Appropriating information technology artefacts through trial and error: The case of the tablet. Information Systems Frontiers, pp.1-23, https://doi.org/10.1007/sl0796-020- 10067-8