Identification of factors influencing the cyber hygiene behavioral intentions of information technology employees: A model proposal and empirical testing

Organizations must protect their digitally critical assets from cyber attacks, which can cause serious damage to business performance and corporate reputation. The purpose of cyber attacks has not changed over time, but with the increasing use of artificial intelligence techniques, there is a serious change in attack methods. Protection against cyber attacks occurs not only through investment in technological methods but also through investment in human capital. Without taking human-focused measures, relying solely on technical/technological measures will be insufficient in dealing with cyber attacks. This is because the weakest link in any system network is the human element. The most important human element within organizations is their employees. Employees pose a major threat to information security, either intentionally or through negligence. Poor information security behavior of employees is the main problem in this field. IT employees, unlike other employees, have the authority to access sensitive information of the institution. Remote workers are a better target for cyber attackers because they are away from the workplace network. Nowadays, remote and hybrid working, which are new working patterns that are advantageous both in terms of economy and comfort, are implemented in many institutions. It is frequently preferred by both institutions and employees, especially since IT employees tend to work remotely or hybridly. Therefore, this thesis study focuses on IT employees who work remotely and hybridly. Within the scope of the research, the factors affecting the cyber hygiene behavioral intention of IT employees are examined in the combination of protection motivation theory, rational action theory and habits theory. The data of 535 IT professionals collected via the LinkedIn platform were analyzed using the statistical software packages SPSS 22.0 and Smart-PLS 4.0. According to the research findings, aside from perceived security vulnerability, all elements of KMT significantly determine cyber hygiene behavior. The factor of subjective norms was found to have no effect on the cyber hygiene of both remote and hybrid-working IT professionals. It was found that the attitude of remote-working IT professionals towards information security policies did not affect cyber hygiene. However, it was found that the attitude of hybrid-working IT professionals towards information security policies did affect cyber hygiene. It was found that security habits significantly influenced the cyber hygiene of remote workers. However, it was found that security habits did not affect the cyber hygiene of hybrid workers. Research results are important for all institutions, as remote and hybrid working systems will become increasingly common. In addition, it is thought that the research results will serve as a guide for policy makers and managers by providing recommendations to improve the cyber hygiene of IT professionals working remotely and hybridly to facilitate compliance with corporate security policies.