Insider threats remain a significant problem within organisations, especially as industries’ reliance on technology continues to grow (Dupuis 2016). Insiders pose a great threat to organisation security infrastructure because they have the knowledge on the organisation’s security protocols and authorised access to the organisation resources (Al & Happa 2018). Insider threats can be posed either intentionally (malicious) or unintentionally (nonmalicious). An intentional or malicious insider is an employee with privileged access who intentionally seeks to perform a malicious act against the organisation which entrusted them with their valuable information assets, for example, revealing organisational secrets or deliberately causing sabotage to an organisation (Nurse et al. 2014). An unintentional or nonmalicious insider is described as an employee with access to an organisation’s network, system or data without any malicious intent associated with their action that causes harm or significantly increases the probability of serious damage to the organisation’s information systems or infrastructure, for example, an employee misplacing their work device (Homoliak et al. 2017).

Motivation and opportunity are key factors when exploring insider threats. Situational crime prevention theory explains how to decrease motivation and opportunity to reduce criminal activities or delinquent behaviour (Levan & Mackey 2015). The SCP theory therefore argues that motivation and opportunity may trigger an individual to commit a misconduct or delinquent behaviour (Padayachee 2016). The SCP theory focus is therefore different from that of other criminological theories because it seeks to reduce lawbreaking motivation and opportunities rather than punish or rehabilitate offenders. According to Clarke (2018), the SCP theory approaches crime reduction by making it impossible or difficult to commit the misconduct irrespective of the offender’s motivation or intent, deterring the offender from committing the offence or by minimising stimuli that aggravate a person’s motivation to commit a crime at any given time or event. Furthermore, a growing number of empirical studies and scientific evaluations have demonstrated that the SCP theory is an effective theory in reducing misconduct (Padayachee 2016).

On the other hand, the SBT states that everyone is capable of misbehaviour and that a ‘bonding’ or social bond to conventional society can prevent most people from getting involved in delinquency (Choi, Martins & Bernik 2018). According to Maalem et al. (2020), when an individual social bond is weak, the likelihood of that person to engage in criminal activities is increased. Furthermore, the SBT can be applied to establish the rationale of individuals engaging in criminal activities. The SBT is based on the premise that even when offenders are considering or leaning towards engaging in criminal activities, their strong social bonds can deter them away from committing the crime (Dupuis 2016). Furthermore, the author alluded that an insider may not engage in criminal activity for fear of losing social surroundings, reputation and involvement in conventional activities. However, if an insider has a weak belief system and maintains an antisocial background, the chances of an insider crime occurring increase exponentially.

A survey conducted indicated that about 44% of all organisations experienced abuse of computer systems in 2008; 42% reported loss of laptops both in 2008 and 2009; and 17% reported theft of customer data (Richardson 2018). Homoliak et al. (2017) also conducted a survey which revealed that 25% of the respondents felt that 60% of the organisation financial losses was caused by insiders; unauthorised access or privileged access by insiders is 15%; and internet access and e-mail abuse by insiders are the fourth most widespread incident. Both the surveys indicate that insider threats are real and nearly rising to the level of an external threat (Homoliak et al. 2017).

A study was conducted to analyse or review the findings of a research study which was undertaken with a goal of evaluating South Africa’s cyberthreat landscape (Pieterse 2021). The study reviewed 74 cybersecurity incidents which were confirmed to have occurred between 2010 and 2020 in South Africa, affecting both government and private sectors. A few examples of organisations which were mentioned from the evaluating study include one of the government departments responsible for unemployment insurance payouts, where changes were implemented on their website to cater for temporary relief scheme during the coronavirus disease 2019 (COVID-19) pandemic; these changes unintentionally exposed confidential information of beneficiaries’ employers. One of the private hospital service providers was a victim of a cyberattack in June 2020 whereby their admissions, business processing systems and e-mail servers were encrypted. Moreover, a data breach of great magnitude occurred in one of South Africa’s credit bureau organisations, where one of their employers unintentionally exposed customers’ personal information to a suspicious fraudster; this unfortunate incident is said to have affected 24 million South Africans and 800 000 business entities.

The results indicated that out of 95 respondents, 38.9% (n = 37) were male respondents and 61.1% (n = 58) were female respondents. Most of the participants were between 36 and 45 years at 56.8% (n = 54), followed by 26–35 years at 30.5% (n = 29). One respondent was above 55 years. Younger people (below 30 years) are more familiar with cybersecurity threats, while the older people are more cautious about cybersecurity issues (Fatokun et al. 2019). The study further showed a distribution of participants with various educational levels, including matric (n = 2), certificates (n = 3), diploma (n = 17), bachelor’s degrees (n = 30), honours (n = 19), Master’s (n = 22) and PhD (n = 1). Only one participant did not disclose his or her level of education. According to Bostan and Akaman (2017), highly educated people are aware of various technologies, and they become early adopters of new technologies. As noted by Bostan and Akman (2017), people with higher levels of education are more aware of cybersecurity issues. In relation to this study, it can be noted that most of the participants had higher levels of education, implying that they are highly aware of cybersecurity insider threats.

According to Isaac and Chikweru (2018), before evaluating the relationship between the model and constructs, the two variables must be measured at the interval or ratio scale, ensuring that there is a linear relationship between the two variables, significant outliers do not exist and the data should be approximately normally distributed. For this study, these checks were conducted to ensure that Pearson correlation is the suitable statistic. To evaluate the constructs’ relationships, the results were therefore analysed by using the bivariate Pearson correlation. The constructs’ correlation was tested at 0.01 and 0.05 confidence level. Likewise, cases were also excluded from the analysis to allow only cases with no missing data to be analysed. Therefore, from the total population of 95, five cases were identified to have missing data; as a result, these cases were therefore eliminated from the analysis. Figure 2 shows the correlation analysis results.

The results in Figure 2 show a positive significant correlation among various model constructs. The results imply that there is a strong relationship among the model constructs. However, the results showed no relation between the involvement (IN) construct and the remove excuses (RE) construct. Most importantly, the results show a strong correlation significance between RIM and all the measuring constructs, that is, increase the effort (IE), increase the risk (IR), reduce the rewards (RR), reduce provocations (RP), RE, attachment (AT), commitment (CO), IN and personal norms (PN). A strong correlation significance was also noted between RIT and all the measuring constructs, including the RIT construct.

This study applied structural equation modelling (SEM) to validate or check the measurement model, and the correlations of the independent and dependent variables were also explored using SEM. The measurement model executes the relationship between the measured to the latent variables. The ovals represented the latent variables when drawing the measurement model in AMOS v. 26.0 (IBM Corporation, Armonk, New York, United States), that is, IE, IR, RR, RP, RE, AT, CO, IN, PN, RIM and RIT. The indicators or attributes for each construct are represented by the rectangles. Construct indicators were coded based on the abbreviation of each construct. Arbitrary names with a term ‘e’ and a numerical value were the error terms. Nonidentification of the model is one of the known common errors of SEM. However, this was minimised by assigning a fixed value of one to at least one construct indicator. Figure 3 characterises the measurement model for this study.

The reliability and validity of this study’s model was tested using SEM, as it has the capability of simultaneously testing the model and its validity (Drigo et al. 2020). Furthermore, SEM is a confirmatory factor analysis which can be applied to test and estimate the casual or fundamental relationships using both underlying qualitative assumptions and statistical data. Based on the analysis of the structural measurement model results, the new values obtained for all the model fit indices were within the acceptable threshold. Therefore, it can be concluded that the structural model is fit to measure the reduction of cybersecurity insider threats in South African telecommunication organisation. Based on the structural model results, this study’s theoretical hypotheses were also evaluated.

After the completion of the construct’s validity and reliability tests, the reduction of constructs to their composite scores was performed in order to allow for the correlation and regression analysis, which was crucial to test the strength of the relationship between the constructs, which are the dependent, independent, moderator and mediating variables. Bivariate correlation coefficient analysis was used to test the strength of the relationship that exists between constructs of this study. Table 1 illustrates the results of the hypothesis testing as extracted from the statistical data analysis. The table shows motivation and opportunities that influence employees’ attitudes towards reducing their intention to participate in cybersecurity misbehaviour.

The outcome of testing H1 to H8 shows that these hypotheses were proven to not have any significance towards the employees’ reduction of their intention to engage in misbehaviour. Therefore, H1 to H8 are not supported. On the contrary, the results show that H9 and H10 are supported. This implies that employees who hold personal values and beliefs that are against misbehaviour in an organisation are most likely to reduce their intention to engage in misbehaviour, consequently reducing cybersecurity insider threats.

In the context of this study, PN refer to individual positive or negative beliefs, values and views towards engaging in specific behaviour in the domain of cybersecurity (Padayachee 2016). According to Schoenherr and Thomson (2021), cybersecurity behaviours are determined by individual PN, and their personality traits are likely to be associated with behaviours that both prevent and promote cybersecurity insider threats. Despite a person’s natural feeling towards misbehaviour, their strong will to avoid misbehaviour deters them from committing criminal acts. On the contrary, the possibility of an employee being involved in cybersecurity insider threats increases when they have negative views towards complying with organisation cybersecurity policies (Bell, Rodgers & Pearce 2019). Furthermore, the authors alluded that individuals who possess commendable PN and values have an attitude which is of a good outcome concerning adhering to cybersecurity policies, consequently reducing insider threats in their respective organisations.

When employees in an organisation decide against the violation of cybersecurity policies, they are likely to comply or follow the prescribed policies and intend to reduce misbehaviour in the domain of cybersecurity, thereby reducing insider threats (Chattopadhyay, Wang & Tan 2018). In this study, review of the literature revealed that PN affect individuals’ attitudes towards engaging in organisational cybersecurity misbehaviour, and this has a significant relationship with their RIM (Rodbert 2020). According to the empirical evidence gathered in this study, PN were found to have a positive relationship with the reduction of intention to misbehave. This means that employees’ PN influence their reduction of intention to misbehave, thus reducing insider threats in their organisation.

The findings of this study substantiate the main goal of this study, which was to develop and conceptualise a model to reduce cybersecurity insider threats in a South African telecommunication organisation. The model can be utilised as a mitigation strategy to reduce insider threats and attacks. From the suggested research model, the hypothesised relationships were tested. Some hypotheses were accepted, whereas others were rejected. From the accepted hypotheses, a new validated model was obtained; the model only shows those constructs where the hypothesised relationships were supported during the structural modelling. Figure 4 demonstrates the model developed from the findings of this study.