{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,7]],"date-time":"2026-10-07T18:01:05Z","timestamp":1791396065716,"version":"4.3.3"},"reference-count":45,"publisher":"Public Library of Science (PLoS)","issue":"10","license":[{"start":{"date-parts":[[2026,10,7]],"date-time":"2026-10-07T00:00:00Z","timestamp":1791331200000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["www.plosone.org"],"crossmark-restriction":false},"short-container-title":["PLoS One"],"abstract":"<jats:p>Information security has become a critical organizational and HR priority in an era of escalating cyber threats. Despite extensive technological investments in cybersecurity infrastructure, the human dimension of information safeguarding remains underexplored, creating significant vulnerabilities in organizational defense mechanisms. This exploratory research investigates employees\u2019 reactions, thoughts, and experiences regarding information safeguarding practices within a large multinational energy corporation in Saudi Arabia. Grounded in Protection Motivation Theory (PMT), this study examines how employees perceive threats to organizational information assets and their behavioral responses to safeguarding imperatives. The research employs a unique dual-method qualitative approach, analyzing 87 firsthand computerized employee comments \u2014 one comment contributed by each of 87 distinct employees \u2014 extracted from an internal electronic system and conducting 24 semi-structured interviews with full-time employees across various organizational levels. Through systematic thematic analysis, the study identifies five major themes: perceived vulnerability and threat awareness, individual responsibility and accountability, organizational security culture, technical versus human factors in information protection, and knowledge gaps and training. Findings reveal a persistent paradox: heightened threat awareness does not automatically translate into consistent protective behaviors, a pattern moderated by organizational culture, variations in self-efficacy, and response-cost barriers. The study extends PMT to an underexplored context of critical infrastructure. It offers actionable insights for practitioners seeking to cultivate security cultures, address self-efficacy gaps, and design human-centered security interventions in high-stakes organizational environments.<\/jats:p>","DOI":"10.1371\/journal.pone.0349656","type":"journal-article","created":{"date-parts":[[2026,10,7]],"date-time":"2026-10-07T17:35:41Z","timestamp":1791394541000},"page":"e0349656","update-policy":"https:\/\/doi.org\/10.1371\/journal.pone.corrections_policy","source":"Crossref","is-referenced-by-count":0,"title":["Employee perspectives on safeguarding information: An exploratory study in a multinational energy corporation"],"prefix":"10.1371","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6701-3071","authenticated-orcid":true,"given":"Mohamed","family":"Mohiya","sequence":"first","affiliation":[{"name":"King Khalid University","place":["Abha, Saudi Arabia"],"department":["Human Resources Management Department, College of Business"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"340","published-online":{"date-parts":[[2026,10,7]]},"reference":[{"key":"pone.0349656.ref001","volume-title":"Principles of information security","author":"ME Whitman","year":"2021","edition":"7"},{"key":"pone.0349656.ref002","unstructured":"U.S. Energy Information Administration. Country analysis brief: Saudi Arabia. 2024. https:\/\/www.eia.gov\/international\/analysis\/country\/SAU"},{"key":"pone.0349656.ref003","doi-asserted-by":"crossref","unstructured":"Cherdantseva Y, Hilton J. A Reference Model of Information Assurance & Security. In: 2013 International Conference on Availability, Reliability and Security, 2013. pp. 546\u201355. https:\/\/doi.org\/10.1109\/ares.2013.72","DOI":"10.1109\/ARES.2013.72"},{"key":"pone.0349656.ref004","doi-asserted-by":"crossref","first-page":"52","DOI":"10.1016\/j.ijcip.2015.02.002","article-title":"A survey of cyber security management in industrial control systems","volume":"9","author":"W Knowles","year":"2015","journal-title":"Int J Crit Infrastruct Prot"},{"issue":"3","key":"pone.0349656.ref005","doi-asserted-by":"crossref","first-page":"122","DOI":"10.1023\/A:1011902718709","article-title":"Transforming the \u2018Weakest Link\u2019 \u2014 a human\/computer interaction approach to usable and effective security","volume":"19","author":"MA Sasse","year":"2001","journal-title":"BT Technology Journal"},{"key":"pone.0349656.ref006","doi-asserted-by":"crossref","unstructured":"Beautement A, Sasse MA, Wonham M. The compliance budget: managing security behaviour in organisations. In: Proceedings of the 2008 New Security Paradigms Workshop, New York: ACM; 2008. pp. 47\u201358.","DOI":"10.1145\/1595676.1595684"},{"key":"pone.0349656.ref007","doi-asserted-by":"crossref","first-page":"567","DOI":"10.1016\/j.chb.2015.03.054","article-title":"Design and validation of information security culture framework","volume":"49","author":"A AlHogail","year":"2015","journal-title":"Comput Human Behav"},{"issue":"10","key":"pone.0349656.ref008","doi-asserted-by":"crossref","DOI":"10.14569\/IJACSA.2021.0121049","article-title":"Factors impacting users\u2019 compliance with information security policies: An empirical study","volume":"12","author":"L Alzahrani","year":"2021","journal-title":"IJACSA"},{"issue":"2","key":"pone.0349656.ref009","doi-asserted-by":"crossref","first-page":"106","DOI":"10.1057\/ejis.2009.6","article-title":"Protection motivation and deterrence: A framework for security policy compliance in organisations","volume":"18","author":"T Herath","year":"2009","journal-title":"Eur J Inf Syst"},{"issue":"3","key":"pone.0349656.ref010","doi-asserted-by":"crossref","first-page":"523","DOI":"10.2307\/25750690","article-title":"Information security policy compliance: An empirical study of rationality-based beliefs and information security awareness","volume":"34","author":"B Bulgurcu","year":"2010","journal-title":"MIS Quarterly"},{"issue":"3","key":"pone.0349656.ref011","doi-asserted-by":"crossref","first-page":"246","DOI":"10.1108\/ICS-05-2014-0033","article-title":"Information security culture \u2013 state-of-the-art review between 2000 and 2013","volume":"23","author":"F Karlsson","year":"2015","journal-title":"Inf Comput Secur"},{"key":"pone.0349656.ref012","doi-asserted-by":"crossref","first-page":"90","DOI":"10.1016\/j.cose.2012.09.010","article-title":"Future directions for behavioral information security research","volume":"32","author":"RE Crossler","year":"2013","journal-title":"Comput Secur"},{"issue":"4","key":"pone.0349656.ref013","doi-asserted-by":"crossref","first-page":"837","DOI":"10.25300\/MISQ\/2015\/39.4.5","article-title":"What do systems users have to fear? using fear appeals to engender threats and fear that motivate protective security behaviors","volume":"39","author":"SR Boss","year":"2015","journal-title":"MIS Quarterly"},{"issue":"1","key":"pone.0349656.ref014","doi-asserted-by":"crossref","first-page":"42","DOI":"10.1108\/IMCS-08-2012-0045","article-title":"Variables influencing information security policy compliance: A systematic review of quantitative studies","volume":"22","author":"T Sommestad","year":"2014","journal-title":"Inf Manag Comput Secur"},{"issue":"2","key":"pone.0349656.ref015","doi-asserted-by":"crossref","first-page":"99","DOI":"10.1016\/j.im.2011.12.005","article-title":"Applying an extended model of deterrence across cultures: An investigation of information systems misuse in the U.S. and South Korea","volume":"49","author":"A Hovav","year":"2012","journal-title":"Inf Manag"},{"issue":"1","key":"pone.0349656.ref016","doi-asserted-by":"crossref","first-page":"2","DOI":"10.1108\/JSIT-02-2018-0028","article-title":"Human factor security: Evaluating the cybersecurity capacity of the industrial workforce","volume":"21","author":"UD Ani","year":"2019","journal-title":"J Syst Inf Technol"},{"issue":"1","key":"pone.0349656.ref017","doi-asserted-by":"crossref","first-page":"93","DOI":"10.1080\/00223980.1975.9915803","article-title":"A protection motivation theory of fear appeals and attitude change","volume":"91","author":"RW Rogers","year":"1975","journal-title":"J Psychol"},{"issue":"5","key":"pone.0349656.ref018","doi-asserted-by":"crossref","first-page":"469","DOI":"10.1016\/0022-1031(83)90023-9","article-title":"Protection motivation and self-efficacy: A revised theory of fear appeals and attitude change","volume":"19","author":"JE Maddux","year":"1983","journal-title":"J Exp Soc Psychol"},{"issue":"3","key":"pone.0349656.ref019","doi-asserted-by":"crossref","first-page":"549","DOI":"10.2307\/25750691","article-title":"Fear appeals and information security behaviors: An empirical study","volume":"34","author":"AC Johnston","year":"2010","journal-title":"MIS Quarterly"},{"key":"pone.0349656.ref020","volume-title":"Qualitative research and evaluation methods: integrating theory and practice","author":"MQ Patton","year":"2015","edition":"4"},{"key":"pone.0349656.ref021","volume-title":"Case study research and applications: design and methods","author":"RK Yin","year":"2018","edition":"6"},{"key":"pone.0349656.ref022","unstructured":"Organization of the Petroleum Exporting Countries. Saudi Arabia facts and figures. 2025. https:\/\/www.opec.org\/opec_web\/en\/about_us\/169.htm"},{"key":"pone.0349656.ref023","unstructured":"Kingdom of Saudi Arabia. Saudi Vision 2030. 2016. Available from: https:\/\/www.vision2030.gov.sa"},{"issue":"3","key":"pone.0349656.ref024","doi-asserted-by":"crossref","first-page":"487","DOI":"10.2307\/25750688","article-title":"Neutralization: New insights into the problem of employee information systems security policy violations","volume":"34","author":"M Siponen","year":"2010","journal-title":"MIS Quarterly"},{"key":"pone.0349656.ref025","doi-asserted-by":"crossref","unstructured":"Schlienger T, Teufel S. Analyzing information security culture: increased trust by an appropriate information security culture. In: 14th International Workshop on Database and Expert Systems Applications, 2003. Proceedings. pp. 405\u20139. https:\/\/doi.org\/10.1109\/dexa.2003.1232055","DOI":"10.1109\/DEXA.2003.1232055"},{"issue":"2","key":"pone.0349656.ref026","doi-asserted-by":"crossref","first-page":"196","DOI":"10.1016\/j.cose.2009.09.002","article-title":"A framework and assessment instrument for information security culture","volume":"29","author":"A Da Veiga","year":"2010","journal-title":"Comput Secur"},{"key":"pone.0349656.ref027","doi-asserted-by":"crossref","first-page":"26","DOI":"10.1016\/j.cose.2016.01.004","article-title":"Shaping intention to resist social engineering through transformational leadership, information security culture and awareness","volume":"59","author":"W Rocha Flores","year":"2016","journal-title":"Comput Secur"},{"key":"pone.0349656.ref028","doi-asserted-by":"crossref","first-page":"102003","DOI":"10.1016\/j.cose.2020.102003","article-title":"Developing cybersecurity culture to influence employee behavior: A practice perspective","volume":"98","author":"M Alshaikh","year":"2020","journal-title":"Comput Secur"},{"key":"pone.0349656.ref029","first-page":"323","article-title":"Information security culture \u2013 investigating influencing factors","volume-title":"Information Security Theory and Practice","author":"F Karlsson","year":"2017"},{"key":"pone.0349656.ref030","doi-asserted-by":"crossref","first-page":"447","DOI":"10.1016\/j.cose.2013.09.009","article-title":"Understanding the violation of IS security policy in organizations: An integrated model based on social control and deterrence theory","volume":"39","author":"L Cheng","year":"2013","journal-title":"Comput Secur"},{"key":"pone.0349656.ref031","doi-asserted-by":"crossref","first-page":"70","DOI":"10.1016\/j.cose.2015.10.006","article-title":"Information security policy compliance model in organizations","volume":"56","author":"NS Safa","year":"2016","journal-title":"Comput Secur"},{"key":"pone.0349656.ref032","first-page":"13","article-title":"Investigating the impact of cybersecurity policy awareness on employees\u2019 cybersecurity behavior","volume":"45","author":"L Li","year":"2019","journal-title":"Int J Inf Manage"},{"issue":"1","key":"pone.0349656.ref033","doi-asserted-by":"crossref","first-page":"69","DOI":"10.1016\/j.im.2013.10.001","article-title":"Information systems security policy compliance: An empirical study of the effects of socialisation, influence, and cognition","volume":"51","author":"P Ifinedo","year":"2014","journal-title":"Information & Management"},{"key":"pone.0349656.ref034","doi-asserted-by":"crossref","first-page":"165","DOI":"10.1016\/j.cose.2013.12.003","article-title":"Determining employee awareness using the Human Aspects of Information Security Questionnaire (HAIS-Q)","volume":"42","author":"K Parsons","year":"2014","journal-title":"Comput Secur"},{"issue":"3","key":"pone.0349656.ref035","doi-asserted-by":"crossref","first-page":"299","DOI":"10.1007\/s10669-020-09787-8","article-title":"Concurrent threats and disasters: modeling and managing risk and resilience","volume":"40","author":"ZA Collier","year":"2020","journal-title":"Environ Syst Decis"},{"key":"pone.0349656.ref036","doi-asserted-by":"crossref","unstructured":"Pahnila S, Siponen M, Mahmood A. Employees\u2019 Behavior towards IS Security Policy Compliance. In: 2007 40th Annual Hawaii International Conference on System Sciences (HICSS\u201907), 2007. pp. 156b\u2013156b. https:\/\/doi.org\/10.1109\/hicss.2007.206","DOI":"10.1109\/HICSS.2007.206"},{"issue":"2","key":"pone.0349656.ref037","doi-asserted-by":"crossref","first-page":"81","DOI":"10.1080\/00396338.2013.784468","article-title":"The cyber attack on Saudi Aramco","volume":"55","author":"C Bronk","year":"2013","journal-title":"Survival"},{"key":"pone.0349656.ref038","doi-asserted-by":"crossref","first-page":"102030","DOI":"10.1016\/j.cose.2020.102030","article-title":"Information security governance challenges and critical success factors: Systematic review","volume":"99","author":"S AlGhamdi","year":"2020","journal-title":"Comput Secur"},{"issue":"2","key":"pone.0349656.ref039","doi-asserted-by":"crossref","first-page":"77","DOI":"10.1191\/1478088706qp063oa","article-title":"Using thematic analysis in psychology","volume":"3","author":"V Braun","year":"2006","journal-title":"Qual Res Psychol"},{"issue":"1","key":"pone.0349656.ref040","doi-asserted-by":"crossref","first-page":"159","DOI":"10.2307\/2529310","article-title":"The measurement of observer agreement for categorical data","volume":"33","author":"JR Landis","year":"1977","journal-title":"Biometrics"},{"key":"pone.0349656.ref041","volume-title":"Organizational culture and leadership","author":"EH Schein","year":"2010","edition":"4"},{"issue":"1","key":"pone.0349656.ref042","doi-asserted-by":"crossref","DOI":"10.9707\/2307-0919.1014","article-title":"Dimensionalizing cultures: The hofstede model in context","volume":"2","author":"G Hofstede","year":"2011","journal-title":"Online Readings in Psychology and Culture"},{"key":"pone.0349656.ref043","volume-title":"Culture, leadership, and organizations: The GLOBE study of 62 societies","author":"RJ House","year":"2004"},{"key":"pone.0349656.ref044","volume-title":"The adult learner: The definitive classic in adult education and human resource development","author":"MS Knowles","year":"2015","edition":"8"},{"issue":"4","key":"pone.0349656.ref045","doi-asserted-by":"crossref","first-page":"439","DOI":"10.1177\/1350507611408217","article-title":"Organizational learning research: Past, present and future","volume":"42","author":"L Argote","year":"2011","journal-title":"Management Learning"}],"container-title":["PLOS One"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0349656","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,10,7]],"date-time":"2026-10-07T17:35:48Z","timestamp":1791394548000},"score":1,"resource":{"primary":{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0349656"}},"subtitle":[],"editor":[{"given":"Solomiia","family":"Fedushko","sequence":"first","affiliation":[{"name":"Comenius University in Bratislava: Univerzita Komenskeho v Bratislave","place":["SLOVAKIA"]}],"role":[{"vocabulary":"crossref","role":"editor"}]}],"short-title":[],"issued":{"date-parts":[[2026,10,7]]},"references-count":45,"journal-issue":{"issue":"10","published-online":{"date-parts":[[2026,10,7]]}},"URL":"https:\/\/doi.org\/10.1371\/journal.pone.0349656","relation":{},"ISSN":["1932-6203"],"issn-type":[{"value":"1932-6203","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,10,7]]}}}