From Ownership to Action: The Role of Spiral of Silence in Information Security Behavior

Abstract

Drawing on psychological ownership and spiral-of-silence perspectives, this study examined the relationships among psychological ownership, spiral of silence, and information security behavior, with particular attention to the mediating role of employee silence. Using a cross-sectional survey design, data were collected from 550 employees. Psychological ownership was assessed using the Psychological Ownership Questionnaire (Avey et al., 2009), spiral of silence through the Spiral of Silence Scale (Lee et al., 2014), and information security behavior using the Security Behavior Intentions Scale (SeBIS; Egelman & Peer, 2015). The findings revealed that greater psychological ownership was associated with stronger information security behavior and lower levels of spiral of silence. Employees reporting greater reluctance to express cybersecurity-related concerns also tended to report weaker information security behavior. Furthermore, the findings supported an indirect pathway in which psychological ownership was associated with stronger information security behavior partly through reduced spiral of silence, while a substantial direct relationship between psychological ownership and security behavior remained. Moreover, in demographics, women reported greater psychological ownership, silence, and security behavior than men. Certified employees reported greater ownership and less silence. These findings extend behavioral cybersecurity research by demonstrating that secure workplace behavior involves not only individual responsibility but also the social conditions surrounding cybersecurity communication. Employees who develop a stronger sense of ownership toward organizational resources may be more inclined to protect those resources and less likely to remain silent about potential security concerns. Organizations should therefore complement technical safeguards and conventional cybersecurity training with practices that strengthen employee responsibility and create psychologically safe, accessible, and nonpunitive opportunities for communicating vulnerabilities, mistakes, and unsafe practices. Given the cross-sectional and self-report design, longitudinal and behavioral research is needed to establish the temporal direction of these relationships.