This vignette study examines employees’ cyber incident reporting intentions by manipulating key constructs of the Theory of Planned Behaviour (TPB), specifically subjective norms and perceived behavioural control. In addition, it investigates the influence of organisational citizenship behaviour (OCB) and psychological safety, while adopting a broader definition of reporting that includes both formal and informal channels. The study employed three vignette scenarios with experimentally varied conditions and collected survey data from 818 Dutch employees in governmental and semi-governmental organisations. Results show that positive subjective norms consistently increased reporting intentions, whereas perceived behavioural control demonstrated partial effects. Both OCB and psychological safety emerged as strong independent predictors of reporting intention, with psychological safety providing the greatest explanatory value beyond the TPB constructs. With regard to reporting channels, higher perceived severity increased preferences for formal reporting channels, while lower perceived severity was associated with greater uncertainty and reduced reporting intentions across both formal and informal channels. These findings suggest that fostering psychological safety and OCB may enhance cyber incident reporting. Further research is needed to better understand how contextual factors, particularly in ambiguous situations, influence reporting preferences. • Feeling supported by others increased intention to report perceived cyber incidents. • Feeling safe at work strongly increased intention to report perceived incidents. • Workers who saw themselves as proactive showed stronger intention to report. • Incidents seen as serious increased intention to use formal reporting channels. • Incidents seen as minor reduced intention to report through any channel.
Ebbers et al. (Wed,) studied this question.
Synapse has enriched 5 closely related papers on similar clinical questions. Consider them for comparative context: