Management Information Systems Quarterly
Abstract
This paper investigates how individuals cope with IT security threats by taking into account both problem-focused and emotion-focused coping. While problem-focused coping (PFC) has been extensively studied in the IT security literature, little is known about emotion-focused coping (EFC). We propose that individuals employ both PFC and EFC to volitionally cope with IT security threats, and conceptually classify EFC into two categories: inward and outward. Our research model is tested by two studies: an experiment with 140 individuals and a survey of 934 respondents. Our results indicate that both inward EFC and outward EFC are stimulated by perceived threat, but that only inward EFC is reduced by perceived avoidability. Interestingly, inward EFC and outward EFC are found to have opposite effects on PFC. While inward EFC impedes PFC, outward EFC facilitates PFC. By integrating both EFC and PFC in a single model, we provide a more complete understanding of individual behavior under IT security threats. Moreover, by theorizing two categories of EFC and showing their opposing effects on users’ security behaviors, we further examine the paradoxical relationship between EFC and PFC, thus making an important contribution to IT security research and practice.