PsySecPsychological Security

Research / Studies

SupportsQualitative · 2025

Phishing reporting in organizations: What motivates employees to take action?

Pavlo Burda, Luca Allodi, Alexander Serebrenik, Nicola Zannone · Information & Computer Security, 2025

Key finding

The main reason employees report suspicious emails is wanting to protect and help the organization and coworkers, followed by responsibility, awareness of consequences, and feelings of insecurity. Reporters were more likely to report convincing, well-impersonated emails, showing they judge potential impact.

Why it matters for PsySec

Reporting is driven by prosocial motives and belonging rather than compliance, supporting culture-based, non-punitive reporting programs.

Stance: Supports. Evidence consistent with a PsySec claim. Summaries are written by the database editors; read the original for full results and limitations.

Tags

P1. Psychographics > DemographicsP2. Culture eats compliance for breakfast Helpfulness BeliefBehavior ReportingMotivationSecurity culture

Behaviors this study informs

Cite this study

APA

Burda, P., Allodi, L., Serebrenik, A., & Zannone, N. (2025). Phishing reporting in organizations: What motivates employees to take action?. Information & Computer Security. https://doi.org/10.1108/ICS-02-2025-0037

BibTeX

@article{burda_2025_phishing_reporting_motivation,
  title = {Phishing reporting in organizations: What motivates employees to take action?},
  author = {Pavlo Burda and Luca Allodi and Alexander Serebrenik and Nicola Zannone},
  year = {2025},
  journal = {Information & Computer Security},
  doi = {10.1108/ICS-02-2025-0037},
  url = {https://doi.org/10.1108/ICS-02-2025-0037}
}