Understanding insider threat: Ethical decision making in information security is related to negative, but not positive, reward prediction errors

The global cost of cybercrime was estimated to exceed $10 trillion US dollars in 2025. Insider threat represents a significant source of breaches of cybersecurity, making understanding the person and situational variables that drive decision making related to information security critically important. In two studies we examined the relationship between ethical decision making in the context of information security and neural activity (i.e., event-related brain potentials (ERPs)) related to reward processing in a gambling task. Individual differences in ethical decision making were related to ERP activity for losses (frontal P3), but not gains (RewP), when the participant was the agent of a choice. These findings lead to the suggestion that ethical decision making in information security may be related to sensitivity to negative, but not positive, reward prediction errors.