Understanding the enacted behaviors of university students susceptible to cybersecurity risks: a community of practice perspective

Purpose Organizations carry out an ethical hacking approach to combat cybersecurity challenges, focusing on the technical aspects of cybersecurity vulnerabilities. This practice persists despite evidence that shows that human-enacted cybersecurity vulnerabilities constitute a significant threat to organizational cybersecurity. To address this challenge, we propose a socio-ethical hacking framework to deal with cybersecurity vulnerabilities in organizations. This framework shows how these behaviors are embedded in and reinforced through the everyday practices of organizational actors. Design/methodology/approach We adopted an interpretive case study research method using the community of practice (CoP) theory as the theoretical lens and university undergraduate students as the study context. Research data were collected through interviews and participatory observation. Findings The study identified how the social structure of undergraduate students shapes the enactment of behaviors that constitute cybersecurity vulnerabilities. Organizational actors jointly create social behaviors and actions that make organizations vulnerable to cybersecurity challenges. Practical implications Using this study, organizations can combine both technical ethical hacking and social ethical hacking practices to detect technical and behavioral vulnerabilities that expose their organization to cyber security threats. Social implications Organizations develop new insights on how to detect taken-for-granted enacted vulnerabilities that can surpass the best cyber security protocols put in place. Using the CoP theory, this study has established the relevance of social factors and how they can enhance understanding human vulnerability, particularly behaviors vulnerable to cybersecurity threats. Originality/value While there are numerous studies looking at the human factor in cybersecurity, there is little evidence of studies showing how these behaviors are enacted and experienced as taken-for-granted actions within their social contexts. This study enhanced studies in the human vulnerability research stream particularly as they relate to how social structure of organizational actors lead to the enactment of behaviors susceptible to a cybersecurity threat.