Date of Conferral

10-8-2026

Date of Award

October 2026

Degree

Doctor of Information Technology (D.I.T.)

School

Information Systems and Technology

Advisor

Dana Haywood

Abstract

Some Information technology (IT) managers may have insufficient protection motivation (Prmo) to follow phishing policies, which may leave organizations more vulnerable to phishing attacks that exploit human behavior. IT and business managers worry that low Prmo to recommended protective actions against phishing exposes them to unauthorized disclosure of sensitive information, financial loss, operational disruption, and reputational harm. Grounded in protection motivation theory (PMT), the purpose of this quantitative correlational study was to examine the relationships between fear appraisal (Fapr), perceived threat severity (PTsev), perceived threat vulnerability (PTvul), response efficacy (Reff), self-efficacy (Seff), and response costs (Reco), and Prmo. The participants included 178 IT managers in the Southeastern United States with at least 3 years of experience who completed a previous developed PMT survey instrument. The multiple linear regression model was statistically significant, F(6, 171) = 43.320, p < .001, R2 = .603, indicating that the six predictors collectively explained approximately 60% of the variance in Pmro. PTsev, PTvul, Reff, Seff, and Reco were significant predictors, whereas Fapr was not. The key recommendation is that IT managers should strengthen Reff, Seff, PTsev, and PTvul by clarifying how recommended responses reduce phishing risk and provide recurring skills-based phishing education without relying on fear-only messaging. The implications for positive social change include the potential for IT managers to use these findings to strengthen the motivational conditions associated with phishing-policy compliance, thereby helping reduce security breaches that harm organizations and the individuals whose information they protect.

Download

Share

 
COinS