Impact on risk perception and cyber security behaviour
Cybersecurity risk communication: its impact on individual risk perception and cybersecurity behaviour in German SMEs
The project examines how SMEs communicate about cyber security internally and how this communication influences staff behaviour. The aim is to identify effective strategies and develop practical recommendations for strengthening the cyber security culture.
| PhD students: | Alexander Wilke |
| Supervisors: | Dr. habil. Andreas Schwarz (Ilmenau University of Technology), Prof. Dr. Florian Meißner |
| Duration: | June 2025 to June 2028 |
| Participating institutions: | Ilmenau University of Technology |
Cyber security is increasingly becoming a challenge for society as a whole, as digitalisation permeates all areas of life and work. The protection of digital data and infrastructure plays a key role in this. At the same time, it is evident that large sections of the German population have little awareness of the risks associated with everyday digital life and that knowledge of appropriate protective measures is insufficient. However, raising awareness and imparting knowledge merely lay the foundations – what is crucial is that these are translated into security-conscious behaviour.
Small and medium-sized enterprises (SMEs), local authorities and educational and research institutions, in particular, are increasingly becoming targets of cyberattacks. Compared to large companies, they often lack both sufficient resources and an established security culture. This raises the key question of how internal communication strategies within organisations are designed to convey cybersecurity issues, and how this communication affects employees’ perceptions and behaviour. Given that there are around 35 million people in employment in Germany, this topic is also of considerable social relevance.
In order to systematically analyse the mechanisms underlying internal risk communication, this PhD project draws on established theoretical models of risk and health communication. Of particular relevance here are the Protection Motivation Theory (PMT) and the Extended Parallel Process Model (EPPM). Both theories are part of the ‘fear appeal’ approach, which demonstrates how perceptions of threat and expectations of efficacy interact to promote protective behaviour.
PMT distinguishes between Threat Appraisal and Coping Appraisal:
- Threat Appraisal encompasses the perceived severity of a threat and perceived vulnerability. At the same time, it takes into account maladaptive rewards – that is, the benefits employees perceive when they do not follow protective measures (e.g. time saved).
- Coping Appraisal comprises Response Efficacy (the effectiveness of the recommended protective measure), Self-Efficacy (the subjective ability to implement it) and Response Costs (perceived costs or effort).
The EPPM integrates these dimensions into a model that explains whether individuals actively counter threats with protective behaviour (risk control) or avoid and ward them off (fear control). In the context of cyber security, the model is extended to include the constructs of response costs and maladaptive rewards (Chen et al., 2021) in order to better reflect how employees weigh up costs, benefits and risks. The extended EPPM thus provides a sound basis for analysing internal communication strategies and assessing their impact on the cybersecurity culture in SMEs.
Research questions
- What risk communication strategies are used in small and medium-sized enterprises to communicate cybersecurity issues internally?
- What influence does internal risk communication have on the perception of threat appraisal, efficacy and response costs in the context of cybersecurity?
- To what extent does risk perception influence the cybersecurity behaviour of employees in SMEs?
Methodology
The study is conducted using a multi-stage research design:
Qualitative analysis:
- Structured interviews with IT security managers, senior executives and communications managers from eight to ten SMEs across various sectors.
- Objective: To identify the risk communication strategies employed, previous experiences with cyber incidents and the respective corporate culture.
- Analysis: Thematic analysis focusing on patterns and sector-specific differences.
Quantitative survey:
- Online survey of approximately 200 employees (20–25 per company).
- Assessment of perceptions of risk communication, the clarity and relevance of measures, and aspects of security behaviour (e.g. password management, response to phishing, reporting of suspicious incidents).
- Statistical analysis using correlation and regression analyses to identify relationships between communication, risk perception and behaviour.
Experimental study:
- Development and testing of different communication strategies within a selected SME.
- Analysis of the effects on risk perception and behaviour through a direct comparison of different strategies.
Objective and Transfer
The aim of this PhD project is to systematically analyse the role of internal risk communication in SMEs and to examine its influence at the individual level (micro-level) as well as on the cyber security culture (meso-level).
- Identification and evaluation of existing communication strategies.
- Investigation of employees’ perceptions of cybersecurity risks and internal communication.
- Evaluation of the extended EPPM, taking into account response costs and maladaptive rewards.
This is intended to help bridge existing gaps in research. The findings offer practical insights for SMEs on how to design internal communication measures to strengthen security awareness and behaviour in the long term.
References
Floyd, D. L., Prentice-Dunn, S., & Rogers, R. W. (2000). A meta-analysis of research on protection motivation theory. Journal of Applied Social Psychology, 30(2), 407–429. https://doi.org/10.1111/j.1559-1816.2000.tb02323.x
Rogers, R. W. (1975). A protection motivation theory of fear appeals and attitude change. Journal of Psychology, 91(1), 93–114. https://doi.org/10.1080/00223980.1975.9915803
Rogers, R. W. (1983). Cognitive and physiological processes in fear appeals and attitude change: A revised theory of protection motivation. In J. T. Cacioppo & R. E. Petty (Eds.), Social psychophysiology: A sourcebook (pp. 153–176). Guildford Press.
Witte, K. (1992). Putting the fear back into fear appeals: The extended parallel process model. Communication Monographs, 59(4), 329–349. https://doi.org/10.1080/03637759209376276
Meissner, F., Wilke, A. J., & Puikytė, M. (2025). How is cybersecurity discussed across media channels? Exploratory analyses of Twitter content and news reporting. Journal of Risk Research, 1–21. https://doi.org/10.1080/13669877.2025.2553079
Meissner, F., Wilke, A. J., & Puikytė, M. (2025). Can Young People Be Persuaded to Adopt Secure Behaviour in Cyberspace? An Experimental Study Based on Protection Motivation Theory. International Crisis and Risk Communication Association Reports.
Meissner, F., Nold, J. M., Sasse, M. A., Panskus, R., & Wilke, A. (2025). ‘Encryption doesn’t matter’: Pitfalls in cybersecurity communications. In T. Kox, A. Ullrich, & H. Zech (Eds.), Uncertain Journeys into Digital Futures (pp. 219–238). Nomos Verlagsgesellschaft mbH & Co. KG. https://doi.org/10.5771/9783748947585-219
Wilke, A. J., Nold, J. M., Braun, O., Meissner, F., & Große-Kampmann, M. (2024). Self-promotion with a chance of warnings: Exploring cybersecurity communication amongst government institutions on LinkedIn. Proceedings of the International Conference on Mobile and Ubiquitous Multimedia (pp. 119–132). https://doi.org/10.1145/3701571.3701575
Meissner, F., Buse, C. & Wilke, A. (2024). Mediated perspectives on cyber risk: A content analysis of news reporting about cyber threats and safety measures. Proceedings of the International Crisis and Risk Communication Conference, Volume 6 (pp. 45–48). Orlando, FL: Nicholson School of Communication. www.doi.org/10.30658/icrcc.2024.XX
