Abstract

Despite increasing investments in technical security infrastructure, human error remains a leading cause of cybersecurity breaches. To mitigate this risk, organizations have widely implemented Cybersecurity Awareness Training (CAT) programs—particularly phishing simulations—to promote secure behavior. However, emerging evidence suggests that these interventions may not always achieve their intended goals and can even backfire, producing psychological and behavioral consequences that undermine training effectiveness. While prior research has primarily highlighted the benefits of CAT, its potential negative effects remain underexplored. This study investigates why CAT programs—especially phishing email training—may sometimes fail leading to counterproductive outcomes. This study focuses on two salient unintended consequences: backfire, whereby employees become more vulnerable (e.g., clicking on more phishing emails), and false progress, whereby employees perceive improvement without actual behavioral change. Both outcomes are harmful, as they increase exposure to cyberattacks and can incur substantial losses for individuals and organizations. To address this gap, this study adopts the Extended Parallel Processing Model (EPPM) III model, which explains not only protective behaviors but also maladaptive responses such as denial, resistance, and backfire, offering a comprehensive framework for understanding the dark side of cybersecurity training. Methodologically, this study employs an explanatory sequential mixed-methods design. In the first stage, semi-structured interviews will explore how perceptions of threat, efficacy, response costs, and maladaptive rewards shape training outcomes. In the second stage, structural equation modeling (SEM) will test these relationships using survey data collected from employees and students with repeated exposure to CAT. This research contributes theoretically by exploring the heterogeneous mechanisms underlying unintended consequences of CAT and offers actionable insights for designing training programs that minimize resistance and reduce complacency.

Download

Abstract Only

Share

COinS