As AI supercharges cyber threats, John D’Arcy, professor of management information systems at Temple University’s Fox School of Business, is examining the human behavior behind them.
John D’Arcy, professor of management information systems at Temple University’s Fox School of Business, studies how employees’ perceptions of cyber threats can influence their behavior.
Photo by Ryan Brandenberg
New research suggests an organization’s greatest vulnerability may not be its firewalls or software, but the people behind them.
“Research consistently shows that a root cause of cyberattacks often involves a human element,” said John D'Arcy, FOX ’05, professor of management information systems at Temple University’s Fox School of Business, and co-author of the study.
The study, “The Only Thing We Have to Fear Is Fear Itself: The Influence of Instability in the Cybersecurity Fear Control Process,” will be published in MIS Quarterly. D'Arcy's co-authors include W. Alec Cram of the University of Waterloo and Alexander Benlian of the Technical University of Darmstadt.
“Employees may be an organization’s weakest link when it comes to cybersecurity. That may involve employees inadvertently falling for a phishing email or even more purposely trying to damage the organization’s information technology architecture,” said D’Arcy, who has spent his career studying the human side of information security. “So the more organizations can do to educate their employees in the workforce, the more secure their companies will be.”
In compiling the study, D'Arcy and his colleagues followed 553 full-time employees across the United States and Canada for eight weeks (it initially started with 750 participants before accounting for typical attrition in this kind of research). Rather than surveying employees once, which is standard in these types of studies, the researchers developed a more data-driven approach that followed employees over time.
“We had employees complete surveys twice a week over an eight-week period that basically asked questions about their perceptions of cybersecurity in their organizations and what incidents they may have dealt with during that time frame,” D’Arcy said. “That allows us to explore whether relationships between certain perceptions and behaviors involving cybersecurity are stable.”
According to the study, they're not.
The findings challenge the assumption that fear simply leads to better or worse behavior. Instead, researchers found that employees’ fear can fluctuate from week to week and is shaped by the specific experiences they encounter.
“A lot of the literature prior to my study was saying, okay, more fearful employees are perhaps more or less secure. We wanted to unpack that,” D’Arcy explained.
For instance, the study found that consistent, on-going cybersecurity training led to more positive outcomes when dealing with threats.
“Training employees to be careful about cybersecurity shouldn’t be a one-time lesson. It has to be continuous to be effective,” he said.
The study also found that cybersecurity warnings that caused employees to have higher levels of concern or even fear caused them to make poorer decisions.
“When employees became too fearful of cybersecurity, they seemed to react emotionally and become less rational. So when this happens, they may not necessarily engage in secure behavior,” he said.
The study found that emotional overload caused employees to react with two specific behaviors: avoidance and workarounds. A workaround might mean uploading corporate files to an unapproved cloud service or choosing a weak password because it’s easier to remember.
Avoidance, or simply tuning cybersecurity out, may be more dangerous to a company.
“Basically taking cybersecurity out of their mind, which is obviously not what the intent is of these stimuli that the organizations are giving to employees,” D’Arcy said.
D’Arcy sees the findings as increasingly urgent in the age of artificial intelligence. Phishing emails, he noted, are growing more convincing due to generative AI, and deepfake videos can now impersonate a boss or colleague.
“There’s all different types of AI-based threats in the cybersecurity world, and they’re coming faster because AI tools are helping to produce them faster,” he said.
However, the study’s most hopeful finding centers on workplace culture: When employees perceived that leadership genuinely valued cybersecurity, their fears de-escalated.
“The broader climate of the organization was found to statistically moderate these things and basically help mitigate some of these fear-based reactions,” D’Arcy said.
