The Role of Organisational Culture in Implementing Cybersecurity Practices to Address Insider Threats in South Africa

The Role of Organisational Culture in Implementing Cybersecurity Practices to Address Insider Threats in South Africa

Kumasi, Ghana & Virtual

Cybersecurity is a critical component of organisational resilience as digital transformation reshapes operations and risk management. Despite substantial investment in technical controls, insider threats remain a persistent challenge, shaped as much by cultural and organisational factors as by technology. This study examines how cultural factors influence the implementation of cybersecurity practices aimed at mitigating insider threats in South African organisations, considering national, organisational, and individual dimensions. Using a qualitative research design, semi‑structured interviews were conducted from nine participants working across a range of industries including ICT consulting, financial services, IT services, gaming, telecommunications, pharmaceuticals, and IT managed services. The findings indicate that power distance, collectivism, uncertainty avoidance, leadership engagement, and employee attitudes significantly affect cybersecurity behaviour. Leadership commitment, clear communication, and collaboration support effective implementation, while rigid hierarchies and limited empowerment hinder proactive behaviour. The study highlights that insider threat mitigation is a socio‑technical process, requiring alignment between leadership, organisational values, and individual responsibility, and offers practical recommendations for culturally informed cybersecurity governance. The study contributes to policy by advocating a people-centred insider-threat mitigation approach that emphasises leadership commitment, employee engagement, collective accountability, and continuous awareness and training to strengthen cybersecurity culture and reduce insider-threat risk.