Exploring Workers' Subjective Experiences of Habit Formation in Cybersecurity: A Qualitative Survey

Employee behaviors remain at the center of cybersecurity workplaces, despite challenges they face in doing so. Time pressures and competing demands mean that users tend to rely on habitual often run counter good practice. One possible solution may be encourage positive habit formation. Designing such interventions, however, relies knowledge perception experience formation context cybersecurity. To this end, a qualitative survey containing open-ended questions was completed by 195 participants (mean age = 35.51, 53 percent female) recruited via an online participant panel. Participants were asked what perform work how believe any habits prompted, formed, maintained. Thematic analysis identified three over-arching themes: (a) forming unavoidably or unconsciously (some mandated, formed without conscious awareness), (b) consciously cultivating (including roles intrinsic motivation external prompts), (c) social organizational influences influence occupational culture, modeling, previous experiences, information gathering practices). Based these findings, we present guidelines for supporting workplace reflecting subjective namely introducing automatic solutions, facilitating cues, fostering interest issues among employees, creating culture highlighting behavior, providing access accessible employees. These results constitute first step identifying can exploited behavior change way accounts reliance busy, time-pressured workplaces.