{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,27]],"date-time":"2025-11-27T07:41:39Z","timestamp":1764229299507,"version":"3.46.0"},"reference-count":49,"publisher":"Oxford University Press (OUP)","issue":"1","license":[{"start":{"date-parts":[[2025,1,31]],"date-time":"2025-01-31T00:00:00Z","timestamp":1738281600000},"content-version":"vor","delay-in-days":30,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100005416","name":"Research Council of Norway","doi-asserted-by":"publisher","award":["288856"],"award-info":[{"award-number":["288856"]}],"id":[{"id":"10.13039\/501100005416","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,1,17]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Delay discounting is a behavioral process, which explains certain peculiarities of human decision-making when choices and their consequences are separated from each other in time. The concept has been used in psychology and behavioral economics to explain how individuals make suboptimal choices with undesirable individual and societal consequences. Existing research shows that individuals can be characterized by several discounting parameters (k) across contexts, capturing the rate at which future gains and losses decrease in value as seen from the present. This present paper investigates how the concept of delay discounting can be utilized to better understand human choices regarding the implementation of information security controls in organizational settings. The study relies on a validated psychometric instrument (MCQ-21) to collect gold-standard k parameters with monetary outcomes. Furthermore, two novel variants are developed to estimate individuals\u2019 k parameters with outcomes specific to the information security context. Within the framework of a nonexperimental correlational research design, an online survey was distributed among the employees ($n = 135$) of three Norwegian organizations. Contrary to expectations, none of the k parameters provided predictive power as predictors of real-world behavior in organizational settings. Nevertheless, the same behaviors were predicted by an attitude-based measure with an accuracy (adjusted $R^2=0.22$), which is observed generally in the literature of behavior prediction using attitudes as predictors. This paper contributes the first results on assessing the effectiveness of delay discounting parameters for behavior prediction within the context of information security.<\/jats:p>","DOI":"10.1093\/cybsec\/tyaf001","type":"journal-article","created":{"date-parts":[[2025,1,10]],"date-time":"2025-01-10T15:20:33Z","timestamp":1736522433000},"source":"Crossref","is-referenced-by-count":0,"title":["Implementing information security controls: now or later? Delay discounting of losses and gains"],"prefix":"10.1093","volume":"11","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-1189-7835","authenticated-orcid":false,"given":"Marte Marjorie","family":"S\u00f8gnen","sequence":"first","affiliation":[{"name":"Department of Information Security and Communication Technology, Norwegian University of Science and Technology , Teknologivegen 22, Gj\u00f8vik 2815 ,","place":["Norway"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0715-5382","authenticated-orcid":false,"given":"Adam","family":"Szekeres","sequence":"additional","affiliation":[{"name":"Department of Information Security and Communication Technology, Norwegian University of Science and Technology , Teknologivegen 22, Gj\u00f8vik 2815 ,","place":["Norway"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2277-6964","authenticated-orcid":false,"given":"Einar Arthur","family":"Snekkenes","sequence":"additional","affiliation":[{"name":"Department of Information Security and Communication Technology, Norwegian University of Science and Technology , Teknologivegen 22, Gj\u00f8vik 2815 ,","place":["Norway"]}]}],"member":"286","published-online":{"date-parts":[[2025,1,31]]},"reference":[{"key":"2025112702395958200_bib1","first-page":"191","article-title":"Information security culture","author":"Schlienger","year":"2002"},{"key":"2025112702395958200_bib2","doi-asserted-by":"publisher","first-page":"e06522","DOI":"10.1016\/j.heliyon.2021.e06522","article-title":"Human factor, a critical weak point in the information security of an organization\u2019s Internet of things","volume":"7","author":"Hughes-Lartey","year":"2021","journal-title":"Heliyon"},{"key":"2025112702395958200_bib3","doi-asserted-by":"publisher","first-page":"51","DOI":"10.1016\/0167-4048(93)90012-T","article-title":"Human error: an overlooked but significant information security problem","volume":"12","author":"Wood","year":"1993","journal-title":"Comput Secur"},{"key":"2025112702395958200_bib4","first-page":"82","article-title":"Human errors in information security","volume":"1","author":"Ahmed","year":"2012","journal-title":"Int J"},{"key":"2025112702395958200_bib5","doi-asserted-by":"publisher","first-page":"117","DOI":"10.1177\/1555343415575152","article-title":"The influence of organizational information security culture on information security decision making","volume":"9","author":"Parsons","year":"2015","journal-title":"J Cognitive Eng Decis Making"},{"key":"2025112702395958200_bib6","doi-asserted-by":"publisher","first-page":"343","DOI":"10.1016\/S0376-6357(04)00140-8","article-title":"Measuring state changes in human delay discounting: an experiential discounting task","volume":"67","author":"Reynolds","year":"2004","journal-title":"Behav Process"},{"key":"2025112702395958200_bib7","doi-asserted-by":"publisher","first-page":"155","DOI":"10.1016\/j.future.2021.12.017","article-title":"Predicting time preference from social media behavior","volume":"130","author":"Kurz","year":"2022","journal-title":"Future Gener Comput Syst"},{"key":"2025112702395958200_bib8","doi-asserted-by":"crossref","DOI":"10.5220\/0010663400003060","article-title":"Inferring delay discounting factors from public observables: applications in risk analysis and the design of adaptive incentives","volume-title":"Proceedings of the 5th International Conference on Computer-Human Interaction Research and Applications","author":"Szekeres","year":"2021"},{"key":"2025112702395958200_bib9","first-page":"1","article-title":"Losses, gains, and hyperbolic discounting: an experimental approach to information security attitudes and behavior","volume-title":"Proceedings of the 2nd Annual Workshop on Economics and Information Security","author":"Acquisti","year":"2003"},{"key":"2025112702395958200_bib10","doi-asserted-by":"publisher","first-page":"293","DOI":"10.1007\/s40614-016-0070-9","article-title":"Automating scoring of delay discounting for the 21-and 27-item monetary choice questionnaires","volume":"39","author":"Kaplan","year":"2016","journal-title":"Behav Anal"},{"key":"2025112702395958200_bib11","doi-asserted-by":"publisher","first-page":"100","DOI":"10.3758\/BF03210748","article-title":"Delay-discounting probabilistic rewards: rates decrease as amounts increase","volume":"3","author":"Kirby","year":"1996","journal-title":"Psychonomic Bull Rev"},{"key":"2025112702395958200_bib12","doi-asserted-by":"publisher","first-page":"83","DOI":"10.1111\/j.1467-9280.1995.tb00311.x","article-title":"Preference reversals due to myopic discounting of delayed reward","volume":"6","author":"Kirby","year":"1995","journal-title":"Psychol Sci"},{"key":"2025112702395958200_bib13","doi-asserted-by":"publisher","first-page":"128","DOI":"10.1016\/j.cose.2015.04.006","article-title":"Analyzing the role of cognitive and cultural biases in the internalization of information security policies: recommendations for information security awareness programs","volume":"52","author":"Tsohou","year":"2015","journal-title":"Comput Secur"},{"key":"2025112702395958200_bib14","doi-asserted-by":"publisher","first-page":"769","DOI":"10.1037\/0033-2909.130.5.769","article-title":"A discounting framework for choice with delayed and probabilistic rewards","volume":"130","author":"Green","year":"2004","journal-title":"Psychol Bull"},{"key":"2025112702395958200_bib15","doi-asserted-by":"publisher","first-page":"657","DOI":"10.1002\/jeab.589","article-title":"Delay discounting of different outcomes: review and theory","volume":"113","author":"Odum","year":"2020","journal-title":"J Exp Anal Behav"},{"key":"2025112702395958200_bib16","doi-asserted-by":"publisher","first-page":"135","DOI":"10.3922\/j.psns.2012.2.03","article-title":"Delay discounting: concepts and measures","volume":"5","author":"Matta","year":"2012","journal-title":"Psychol Neurosci"},{"key":"2025112702395958200_bib17","doi-asserted-by":"crossref","first-page":"21","DOI":"10.1145\/988772.988777","article-title":"Privacy in electronic commerce and the economics of immediate gratification","volume-title":"Proceedings of the 5th ACM Conference on Electronic Commerce","author":"Acquisti","year":"2004"},{"key":"2025112702395958200_bib18","doi-asserted-by":"publisher","first-page":"26","DOI":"10.1109\/MSP.2005.22","article-title":"Privacy and rationality in individual decision making","volume":"3","author":"Acquisti","year":"2005","journal-title":"IEEE Secur Priv"},{"key":"2025112702395958200_bib19","first-page":"83","article-title":"Social status and the demand for security and privacy","volume-title":"Proceedings of the 14th International Symposium on Privacy Enhancing Technologies Symposium","author":"Grossklags","year":"2014"},{"key":"2025112702395958200_bib20","doi-asserted-by":"publisher","first-page":"769","DOI":"10.1002\/bdm.2000","article-title":"Associations between delay discounting and risk-related behaviors, traits, attitudes, and outcomes","volume":"30","author":"Mishra","year":"2017","journal-title":"J Behav Decis Making"},{"article-title":"Better late (r) than never: increasing cyber-security compliance by reducing present bias","year":"2018","author":"Frik","key":"2025112702395958200_bib21"},{"key":"2025112702395958200_bib22","doi-asserted-by":"crossref","first-page":"3215","DOI":"10.1145\/2858036.2858303","article-title":"Tales of software updates: the process of updating software","volume-title":"Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems","author":"Vaniea","year":"2016"},{"key":"2025112702395958200_bib23","doi-asserted-by":"publisher","first-page":"tyaa002","DOI":"10.1093\/cybsec\/tyaa002","article-title":"Update now or later? Effects of experience, cost, and risk preference on update decisions","volume":"6","author":"Rajivan","year":"2020","journal-title":"J Cybersecur"},{"volume-title":"Practical Research Planning and Design","year":"2021","author":"Paul","key":"2025112702395958200_bib24"},{"key":"2025112702395958200_bib25","doi-asserted-by":"publisher","first-page":"97","DOI":"10.1177\/1468794106058877","article-title":"Integrating quantitative and qualitative research: how is it done?","volume":"6","author":"Bryman","year":"2006","journal-title":"Qual Res"},{"key":"2025112702395958200_bib26","doi-asserted-by":"publisher","first-page":"255","DOI":"10.3102\/01623737011003255","article-title":"Toward a conceptual framework for mixed-method evaluation designs","volume":"11","author":"Greene","year":"1989","journal-title":"Educ Eval Policy Anal"},{"article-title":"Amerikansk dollar til Norsk krone","year":"2023","author":"Google","key":"2025112702395958200_bib27"},{"key":"2025112702395958200_bib28","doi-asserted-by":"crossref","first-page":"47","DOI":"10.1145\/1595676.1595684","article-title":"The compliance budget: Managing security behaviour in organisations","volume-title":"Proceedings of the 2008 New Security Paradigms Workshop","author":"Beautement","year":"2008"},{"key":"2025112702395958200_bib29","doi-asserted-by":"crossref","first-page":"133","DOI":"10.1145\/1719030.1719050","article-title":"So long, and no thanks for the externalities: the rational rejection of security advice by users","volume-title":"Proceedings of the 2009 Workshop on New Security Paradigms Workshop","author":"Herley","year":"2009"},{"article-title":"Oljefondet utsettes for tre alvorlige dataangrep daglig","year":"2022","author":"NTB","key":"2025112702395958200_bib30"},{"article-title":"Annual report 2022","year":"2023","author":"DNB","key":"2025112702395958200_bib31"},{"article-title":"Europeans\u2019 attitudes towards cyber security","year":"2020","author":"European Commission","key":"2025112702395958200_bib32"},{"article-title":"People being proactive about their personal cyber risks, but poor behaviors remain\u2013survey","year":"2022","author":"Snape","key":"2025112702395958200_bib33"},{"key":"2025112702395958200_bib34","first-page":"61","article-title":"A self-report measure of end-user security attitudes (SA-6)","volume-title":"Proceedings of the Fifteenth USENIX Conference on Usable Privacy and Security","author":"Faklaris","year":"2019"},{"article-title":"SA-6 handout","year":"2019","author":"Faklaris","key":"2025112702395958200_bib35"},{"key":"2025112702395958200_bib36","doi-asserted-by":"publisher","first-page":"1317","DOI":"10.1111\/j.1559-1816.1998.tb01679.x","article-title":"Predicting and explaining intentions and behavior: How well are we doing?","volume":"28","author":"Sutton","year":"1998","journal-title":"J Appl Soc Psychol"},{"key":"2025112702395958200_bib37","doi-asserted-by":"publisher","first-page":"58","DOI":"10.1177\/0146167295211007","article-title":"Attitudes and the prediction of behavior: a meta-analysis of the empirical literature","volume":"21","author":"Kraus","year":"1995","journal-title":"Pers Soc Psychol Bull"},{"key":"2025112702395958200_bib38","doi-asserted-by":"publisher","first-page":"106","DOI":"10.3844\/jssp.2007.106.116","article-title":"Ten common misunderstandings, misconceptions, persistent myths and urban legends about Likert scales and Likert response formats and their antidotes","volume":"3","author":"Carifio","year":"2007","journal-title":"J Soc Sci"},{"key":"2025112702395958200_bib39","doi-asserted-by":"publisher","first-page":"270","DOI":"10.1287\/mnsc.35.3.270","article-title":"Discount rates inferred from decisions: an experimental study","volume":"35","author":"Benzion","year":"1989","journal-title":"Manag Sci"},{"key":"2025112702395958200_bib40","doi-asserted-by":"crossref","first-page":"136","DOI":"10.21037\/atm.2016.03.35","article-title":"Variable selection with stepwise and best subset approaches","volume":"4","author":"Zhang","year":"2016","journal-title":"Ann Transl Med"},{"key":"2025112702395958200_bib41","doi-asserted-by":"publisher","first-page":"387","DOI":"10.1177\/1094428106292901","article-title":"Improved shrinkage estimation of squared multiple correlation coefficient and squared cross-validity coefficient","volume":"11","author":"Shieh","year":"2008","journal-title":"Organ Res Methods"},{"key":"2025112702395958200_bib42","doi-asserted-by":"publisher","first-page":"200","DOI":"10.1287\/mnsc.34.2.200","article-title":"Frames of mind in intertemporal choice","volume":"34","author":"Loewenstein","year":"1988","journal-title":"Manag Sci"},{"key":"2025112702395958200_bib43","doi-asserted-by":"publisher","first-page":"81","DOI":"10.1037\/h0046016","article-title":"Convergent and discriminant validation by the multitrait-multimethod matrix","volume":"56","author":"Campbell","year":"1959","journal-title":"Psychol Bull"},{"article-title":"Sign Effects in Quasi-Hyperbolic Discounting: Evidence from An Incentivized Experiment","year":"2023","author":"Krause","key":"2025112702395958200_bib44"},{"key":"2025112702395958200_bib45","doi-asserted-by":"publisher","first-page":"1327","DOI":"10.1007\/s00426-018-1013-8","article-title":"Acceptable losses: the debatable origins of loss aversion","volume":"83","author":"Yechiam","year":"2019","journal-title":"Psychol Res"},{"volume-title":"Exploring the Nature of Loss Aversion","year":"2006","author":"G\u00e4chter","key":"2025112702395958200_bib46"},{"key":"2025112702395958200_bib47","doi-asserted-by":"publisher","first-page":"497","DOI":"10.1002\/jcpy.1047","article-title":"The loss of loss aversion: will it loom larger than its gain?","volume":"28","author":"Gal","year":"2018","journal-title":"J Consum Psychol"},{"key":"2025112702395958200_bib48","article-title":"Quasi-hyperbolic present bias: a meta-analysis","author":"Cheung","year":"2021","journal-title":"Life Course Centre Working Paper"},{"key":"2025112702395958200_bib49","doi-asserted-by":"publisher","first-page":"78","DOI":"10.1037\/0096-3445.128.1.78","article-title":"Heroin addicts have higher discount rates for delayed rewards than non-drug-using controls","volume":"128","author":"Kirby","year":"1999","journal-title":"J Exp Psychol: General"}],"container-title":["Journal of Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article-pdf\/11\/1\/tyaf001\/61716948\/tyaf001.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article-pdf\/11\/1\/tyaf001\/61716948\/tyaf001.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,27]],"date-time":"2025-11-27T07:40:07Z","timestamp":1764229207000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article\/doi\/10.1093\/cybsec\/tyaf001\/7993897"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":49,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2025,1,17]]}},"URL":"https:\/\/doi.org\/10.1093\/cybsec\/tyaf001","relation":{},"ISSN":["2057-2085","2057-2093"],"issn-type":[{"type":"print","value":"2057-2085"},{"type":"electronic","value":"2057-2093"}],"subject":[],"published-other":{"date-parts":[[2025]]},"published":{"date-parts":[[2025]]},"article-number":"tyaf001"}}