Understanding employee cybersecurity behavior: The role of information security policies, organizational culture, and theory

This study investigates employee cybersecurity behavior by examining the influence of organizational information security policies (ISPs), behavioral determinants, and dominant theoretical frameworks to address persistent human-related vulnerabilities in organizations. A systematic literature review was conducted across IEEE Xplore, SpringerLink, Emerald Insight, ResearchGate, World Scientific, and ScienceDirect. From 244 non-duplicate records, 64 peer-reviewed studies met the inclusion criteria. To extend the review, secondary analysis of the BCCC–CIC–IDS2017 dataset (n = 579) was performed using structural equation modeling. The findings indicate that cybersecurity behavior is shaped by the interaction of psychological factors (perceived threat, vulnerability, self-efficacy, motivation), social influences (peer behavior, cues to action), and organizational conditions (security culture, policy clarity, training, enforcement). Protection Motivation Theory, Theory of Planned Behavior, Health Belief Model, and General Deterrence Theory are most frequently applied. Empirical analysis confirms that peer behavior and cues to action significantly enhance cybersecurity engagement, while prior experience increases perceived severity and vulnerability and reduces perceived barriers. The study concludes that human-centric and integrative behavioral models are essential for improving cybersecurity compliance. Practical implications suggest that organizations should prioritize awareness programs, managerial support, and culturally aligned ISPs to strengthen cybersecurity resilience beyond technical controls alone.