Explore the intersection of Self-Determination Theory and cybersecurity education - A literature review

This paper explores how organizations can create a sustainable, security-first culture in an increasingly complex environment where organizational and national cultures are strong influencing factors in human behaviour. In cybersecurity education, as in any effort of education, there must be a principled commitment to long-term behaviour modification through intrinsic motivation, foundational to employees acting consistently in secure ways. The review of the literature falls squarely within Self-Determination Theory, underlining the pertinence of autonomy, competence, and relatedness as distinctive factors in cybersecurity education, highlighting that these constructs are necessary at all levels for perpetual security and compliance. The results indicated that an effective security-first culture could only emerge when cybersecurity formed part of the core values and practices within organizations. It also explained that leadership styles, such as transformational and servant leadership, play an important role in the development of intrinsic motivation by fostering trust, empowerment, and a sense of shared responsibility. It also highlights how national cultural dimensions, such as individualism and power distance, may change how differently oriented employees respond to cybersecurity policies and practices. Approaches to cybersecurity education should be tailored to both organizational and national cultural factors to develop cybersecurity education strategies that could go beyond mere compliance and build a proactive security mindset. This is important because it underlines how the SDT acts as a framework for understanding how companies could help foster a security-first culture that, at the same time, will create sustainable, resilient, and intrinsically driven cybersecurity behaviours among employees.