AIS Logo
Living knowledge for digital leadership
All AI Governance & Ethics Digital Transformation & Innovation Supply Chain & Operations AI Adoption & Implementation Platform Ecosystems & Strategy SME & Entrepreneurship Cybersecurity & Risk AI Applications & Technologies Digital Health & Well-being Digital Work & Collaboration Education & Training
Gameful Learning for a More Sustainable World Measuring the Effect of Design Elements on Long-Term Learning Outcomes in Correct Waste Sorting
Business & Information Systems Engineering (2021)

Gameful Learning for a More Sustainable World Measuring the Effect of Design Elements on Long-Term Learning Outcomes in Correct Waste Sorting

Greta Hoffmann, Jella Pfeiffer
This study investigates the effectiveness of using a mobile game app to teach correct municipal waste sorting. In a laboratory experiment, researchers compared the learning outcomes of participants who used the game with a control group that used standard, non-game educational materials. The study also specifically analyzed the impact of two game design elements, repetition and a look-up feature, on long-term knowledge retention and real-world application.

Problem Effective municipal waste sorting is a critical component of sustainability efforts, but many citizens lack the knowledge to do it correctly. Existing educational resources, such as paper-based flyers, are often ineffective for transmitting the large amount of information needed for long-term behavioral change, creating a gap in public education that hinders recycling efficiency.

Outcome - Game-based learning significantly enhanced waste sorting knowledge across all tested measures (in-game, multiple-choice, and real-life sorting) compared to traditional paper-based materials.
- The game successfully transferred learning to a real-life sorting task, a result that has been difficult to achieve in similar studies.
- The 'look-up' feature within the game was identified as a particularly promising and effective design element for improving learning outcomes.
- The combination of 'repetition' and 'look-up' game mechanics resulted in significantly higher learning outcomes, especially within the digital testing environments.
Gameful design, Serious game, Gamification, Game-design elements, Cognitive learning strategies, Sustainability, Knowledge transfer
When Self-Humanization Leads to Algorithm Aversion What Users Want from Decision Support Systems on Prosocial Microlending Platforms
Business & Information Systems Engineering (2022)

When Self-Humanization Leads to Algorithm Aversion What Users Want from Decision Support Systems on Prosocial Microlending Platforms

Pascal Oliver Heßler, Jella Pfeiffer, Sebastian Hafenbrädl
This study investigates why people often reject algorithmic advice, specifically focusing on prosocial (e.g., charitable) versus for-profit decisions on microlending platforms. Using an online experiment, the research examines how the decision-making context affects users' aversion to algorithms and their preference for more human-like decision support systems.

Problem While algorithmic decision support systems are powerful tools, many users are averse to using them in certain situations, which reduces their adoption and effectiveness. This study addresses the gap in understanding why this 'algorithm aversion' occurs by exploring how the desire to feel human in prosocial contexts, where empathy and autonomy are valued, influences user preferences for decision support.

Outcome - In prosocial contexts, like charitable microlending, people place a higher importance on human-like attributes such as empathy and autonomy compared to for-profit contexts.
- This increased focus on empathy and autonomy leads to a greater aversion to using computer-based algorithms for decision support.
- Users who are more averse to algorithms show a stronger preference for decision support systems that seem more human-like.
- Consequently, users on prosocial platforms prefer more human-like decision support than users on for-profit platforms, suggesting that systems should be designed differently depending on their purpose.
Self-humanization, Algorithm aversion, Empathy, Autonomy, Decision support, Prosocial platforms
Smart Bins: Case study-based benefit evaluation of filling level sensors in smart waste containers
HMD Praxis der Wirtschaftsinformatik (2021)

Smart Bins: Case study-based benefit evaluation of filling level sensors in smart waste containers

David Hoffmann, Ruben Franz, Florian Hawlitschek, Nico Jahn
This study evaluates the potential benefits of using filling level sensors in waste containers, transforming them into "smart bins" for more efficient waste management. Through a multiple case study with three German waste management companies, the paper explores the practical application of different sensor technologies to identify key challenges, provide recommendations for pilot projects, and outline requirements for future development.

Problem Traditional waste management relies on emptying containers at fixed intervals, regardless of how full they are. This practice is inefficient, leading to unnecessary costs and emissions from premature collections or overflowing bins and littering from late collections. Furthermore, existing research on smart bin technology is fragmented and often limited to simulations, lacking practical insights from real-world deployments.

Outcome - Pilot studies revealed significant optimization potential, with analyses showing that some containers were only 50% full at their scheduled collection time.
- The implementation of sensor technology requires substantial effort in planning, installation, calibration, and maintenance, including the need for manual data collection to train algorithms.
- Fill-level sensors are not precision instruments and are prone to outliers, but they are sufficiently accurate for waste management when used to classify fill levels into broad categories (e.g., quartiles).
- Different sensor types are suitable for different waste materials; for example, vibration-based sensors proved 94.5% accurate for paper and cardboard, which can expand after being discarded.
- Major challenges include the lack of technical standards for sensor installation and data interfaces, as well as the difficulty of integrating proprietary sensor platforms with existing logistics and IT systems.
Waste management, Smart bins, Filling level measurement, Sensor technology, Internet of Things
Building Habits in the Digital Age: Incorporating Psychological Needs and Knowledge from Practitioners to Inform the Design of Digital Therapeutics
International Conference on Wirtschaftsinformatik (2023)

Building Habits in the Digital Age: Incorporating Psychological Needs and Knowledge from Practitioners to Inform the Design of Digital Therapeutics

Jeannette Stark, Thure Weimann, Felix Reinsch, Emily Hickmann, Maren Kählig, Carola Gißke, and Peggy Richter
This study reviews the psychological requirements for forming habits and analyzes how these requirements are implemented in existing mobile habit-tracking apps. Through a content analysis of 57 applications, the research identifies key design gaps and proposes a set of principles to inform the creation of more effective Digital Therapeutics (DTx) for long-term behavioral change.

Problem Noncommunicable diseases (NCDs), a leading cause of death, often require sustained lifestyle and behavioral changes. While many digital apps aim to support habit formation, they often fail to facilitate the entire process, particularly the later stages where a habit becomes automatic and reliance on technology should decrease, creating a gap in effective long-term support.

Outcome - Conventional habit apps primarily support the first two stages of habit formation: deciding on a habit and translating it into an initial behavior.
- Most apps neglect the crucial later stages of habit strengthening, where technology use should be phased out to allow the habit to become truly automatic.
- A conflict of interest was identified, as the commercial need for continuous user engagement in many apps contradicts the goal of making a user's new habit independent of the technology.
- The research proposes specific design principles for Digital Therapeutics (DTx) to better support all four stages of habit formation, offering a pathway for developing more effective tools for NCD prevention and treatment.
Behavioral Change, Digital Therapeutics, Habits, Habit Apps, Non-communicable diseases
Responsible AI Design: The Authenticity, Control, Transparency Theory
Journal of the Association for Information Systems (2025)

Responsible AI Design: The Authenticity, Control, Transparency Theory

Andrea Rivera, Kaveh Abhari, Bo Xiao
This study explores how to design Artificial Intelligence (AI) responsibly from the perspective of AI designers. Using a grounded theory approach based on interviews with industry professionals, the paper develops the Authenticity, Control, Transparency (ACT) theory as a new framework for creating ethical AI.

Problem Current guidelines for responsible AI are fragmented and lack a cohesive theory to guide practice, leading to inconsistent outcomes. Existing research often focuses narrowly on specific attributes like algorithms or harm minimization, overlooking the broader design decisions that shape an AI's behavior from its inception.

Outcome - The study introduces the Authenticity, Control, and Transparency (ACT) theory as a practical framework for responsible AI design.
- It identifies three core mechanisms—authenticity, control, and transparency—that translate ethical design decisions into responsible AI behavior.
- These mechanisms are applied across three key design domains: the AI's architecture, its algorithms, and its functional affordances (capabilities offered to users).
- The theory shifts the focus from merely minimizing harm to also maximizing the benefits of AI, providing a more balanced approach to ethical design.
Responsible AI, AI Ethics, AI Design, Authenticity, Transparency, Control, Algorithmic Accountability
Making Sense of Discursive Formations and Program Shifts in Large-Scale Digital Infrastructures
Journal of the Association for Information Systems (2025)

Making Sense of Discursive Formations and Program Shifts in Large-Scale Digital Infrastructures

Egil Øvrelid, Bendik Bygstad, Ole Hanseth
This study examines how public and professional discussions, known as discourses, shape major changes in large-scale digital systems like national e-health infrastructures. Using an 18-year in-depth case study of Norway's e-health development, the research analyzes how high-level strategic trends interact with on-the-ground practical challenges to drive fundamental shifts in technology programs.

Problem Implementing complex digital infrastructures like national e-health systems is notoriously difficult, and leaders often struggle to understand why some initiatives succeed while others fail. Previous research focused heavily on the role of powerful individuals or groups, paying less attention to the underlying, systemic influence of how different conversations about technology and strategy converge over time. This gap makes it difficult for policymakers to make sensible, long-term decisions and navigate the evolution of these critical systems.

Outcome - Major shifts in large digital infrastructure programs occur when high-level strategic discussions (macrodiscourses) and practical, operational-level discussions (microdiscourses) align and converge.
- This convergence happens through three distinct processes: 'connection' (a shared recognition of a problem), 'matching' (evaluating potential solutions that fit both high-level goals and practical needs), and 'merging' (making a decision and reconciling the different perspectives).
- The result of this convergence is a new "discursive formation"—a powerful, shared understanding that aligns stakeholders, technology, and strategy, effectively launching a new program and direction.
- Policymakers and managers can use this framework to better analyze the alignment between broad technological trends and their organization's specific, internal needs, leading to more informed and realistic strategic planning.
Discursive Formations, Discourse Convergence, Large-Scale Digital Infrastructures, E-Health Programs, Program Shifts, Sociotechnical Systems, IT Strategy
Unpacking Board-Level IT Competency
Communications of the Association for Information Systems (2025)

Unpacking Board-Level IT Competency

Jennifer Jewer, Kenneth N. McKay
This study investigates how to best measure IT competency on corporate boards of directors. Using a survey of 75 directors in Sri Lanka, the research compares the effectiveness of indirect 'proxy' measures (like prior work experience) against 'direct' measures (assessing specific IT knowledge and governance practices) in reflecting true board IT competency and its impact on IT governance.

Problem Many companies struggle with poor IT governance, which is often blamed on a lack of IT competency at the board level. However, there is no clear consensus on what constitutes board IT competency or how to measure it effectively. Previous research has relied on various proxy measures, leading to inconsistent findings and uncertainty about how boards can genuinely improve their IT oversight.

Outcome - Direct measures of IT competency are more accurate and reliable indicators than indirect proxy measures.
- Boards with higher directly-measured IT competency demonstrate stronger IT governance.
- Among proxy measures, having directors with work experience in IT roles or management is more strongly associated with good IT governance than having directors with formal IT training.
- The study validates a direct measurement approach that boards can use to assess their competency gaps and take targeted steps to improve their IT governance capabilities.
Board of Directors, Board IT Competency, IT Governance, Proxy Measures, Direct Measures, Corporate Governance
The Impact of Gamification on Cybersecurity Learning: Multi-Study Analysis
Communications of the Association for Information Systems (2025)

The Impact of Gamification on Cybersecurity Learning: Multi-Study Analysis

J.B. (Joo Baek) Kim, Chen Zhong, Hong Liu
This paper systematically assesses the impact of gamification on cybersecurity education through a four-semester, multi-study approach. The research compares learning outcomes between gamified and traditional labs, analyzes student perceptions and motivations using quantitative methods, and explores learning experiences through qualitative interviews. The goal is to provide practical strategies for integrating gamification into cybersecurity courses.

Problem There is a critical and expanding cybersecurity workforce gap, emphasizing the need for more effective, practical, and engaging training methods. Traditional educational approaches often struggle to motivate students and provide the necessary hands-on, problem-solving skills required for the complex and dynamic field of cybersecurity.

Outcome - Gamified cybersecurity labs led to significantly better student learning outcomes compared to traditional, non-gamified labs.
- Well-designed game elements, such as appropriate challenges and competitiveness, positively influence student motivation. Intrinsic motivation (driven by challenge) was found to enhance learning outcomes, while extrinsic motivation (driven by competition) increased career interest.
- Students found gamified labs more engaging due to features like instant feedback, leaderboards, clear step-by-step instructions, and story-driven scenarios that connect learning to real-world applications.
- Gamification helps bridge the gap between theoretical knowledge and practical skills, fostering deeper learning, critical thinking, and a greater interest in pursuing cybersecurity careers.
Gamification, Cybersecurity Learning, Student Motivation, Learning Outcomes, Mixed-method Design, PLS-SEM
Conceptualizing IT Artefacts for Policymaking – How IT Artefacts Evolve as Policy Objects
Communications of the Association for Information Systems (2025)

Conceptualizing IT Artefacts for Policymaking – How IT Artefacts Evolve as Policy Objects

Karin Väyrynen, Sari Laari-Salmela, Netta Iivari, Arto Lanamäki, Marianne Kinnula
This study explores how an information technology (IT) artefact evolves into a 'policy object' during the policymaking process, using a 4.5-year longitudinal case study of the Finnish Taximeter Law. The research proposes a conceptual framework that identifies three forms of the artefact as it moves through the policy cycle: a mental construct, a policy text, and a material IT artefact. This framework helps to understand the dynamics and challenges of regulating technology.

Problem While policymaking related to information technology is increasingly significant, the challenges stemming from the complex, multifaceted nature of IT are poorly understood. There is a specific gap in understanding how real-world IT artefacts are translated into abstract policy texts and how those texts are subsequently reinterpreted back into actionable technologies. This 'translation' process often leads to ambiguity and unintended consequences during implementation.

Outcome - Proposes a novel conceptual framework for understanding the evolution of an IT artefact as a policy object during a public policy cycle.
- Identifies three distinct forms the IT artefact takes: 1) a mental construct in the minds of policymakers and stakeholders, 2) a policy text such as a law, and 3) a material IT artefact as a real-world technology that aligns with the policy.
- Highlights the significant challenges in translating complex real-world technologies into abstract legal text and back again, which can create ambiguity and implementation difficulties.
- Distinguishes between IT artefacts at the policy level and IT artefacts as real-world technologies, showing how they evolve on separate but interconnected tracks.
IT Artefact, IT Regulation, Law, Policy Object, Policy Cycle, Public Policymaking, European Al Act
The Digital Language of Emotion: Cautions and Solutions for Strategic Use of Emoji in Responding Information System Incidents
Communications of the Association for Information Systems (2025)

The Digital Language of Emotion: Cautions and Solutions for Strategic Use of Emoji in Responding Information System Incidents

Soojin Roh, Shubin Yu
This paper investigates if, when, and how organizations can strategically use emojis in online communications when responding to information system (IS) incidents. Through three experimental studies conducted with Chinese and U.S. participants, the research examines how cultural context, the source of the message (CEO vs. company account), and incident type influence public perception.

Problem As companies increasingly use emojis in professional communications, there is a risk of missteps, especially in crisis situations. A lack of understanding of how emojis shape public perception across different cultures can lead to reputational harm, and existing research lacks empirical evidence on their strategic and cross-cultural application in responding to IS incidents.

Outcome - For Chinese audiences, using emojis in IS incident responses is generally positive, as it reduces psychological distance, alleviates anger, and increases perceptions of warmth and competence.
- The positive effect of emojis in China is stronger when used by an official company account rather than a CEO, and when the company is responsible for the incident.
- In contrast, U.S. audiences tend to evaluate the use of emojis negatively in incident responses.
- The negative perception among U.S. audiences is particularly strong when a CEO uses an emoji to respond to an internally-caused incident, leading to increased anger and perceptions of incompetence.
Emoji, Information System Incident, Social Media, Psychological Distance, Warmth, Competence
Fostering Group Work in Virtual Reality Environments: Is Presence Enough?
Communications of the Association for Information Systems (2025)

Fostering Group Work in Virtual Reality Environments: Is Presence Enough?

Ayushi Tandon, Yogini Joglekar, Sabra Brock
This study investigates how working in Virtual Reality (VR) affects group collaboration in a professional development setting. Using Construal Level Theory as a framework, the research qualitatively analyzed the experiences of participants in a VR certification course to understand how feelings of spatial, social, and temporal presence impact group dynamics.

Problem Most research on Virtual Reality has focused on its benefits for individual users in fields like gaming and healthcare. There is a significant gap in understanding how VR technology facilitates or hinders collaborative group work, especially as remote and hybrid work models become more common in professional settings.

Outcome - A heightened sense of 'spatial presence' (feeling physically there) in VR positively improves group communication, collaboration, and overall performance.
- 'Social presence' (feeling connected to others) in VR also enhances group cohesion and effectiveness at both immediate (local) and long-term (global) levels.
- The experience of 'temporal presence' (how time is perceived) in VR, which can feel distorted, positively influences immediate group coordination and collaboration.
- The effectiveness of VR for group work is significantly influenced by 'task-technology fit'; the positive effects of presence are stronger when VR's features are well-suited to the group's task.
Virtual Reality, VR Campus, Presence, Group-Work, Construal Level Theory, Group Dynamics
Frugal Fintech Ecosystem Development: A Resource Orchestration Perspective
Communications of the Association for Information Systems (2024)

Frugal Fintech Ecosystem Development: A Resource Orchestration Perspective

Prakash Dhavamani, Barney Tan, Daniel Gozman, Leben Johnson
This study investigates how a financial technology (Fintech) ecosystem was successfully established in a resource-constrained environment, using the Vizag Fintech Valley in India as a case study. The research examines the specific processes of gathering resources, building capabilities, and creating market value under significant budget limitations. It proposes a practical framework to guide the development of similar 'frugal' innovation hubs in other developing regions.

Problem There is limited research on how to launch and develop a Fintech ecosystem, especially in resource-scarce developing countries where the potential benefits like financial inclusion are greatest. Most existing studies focus on developed nations, and their findings are not easily transferable to environments with tight budgets, a lack of specialized talent, and less mature infrastructure. This knowledge gap makes it difficult for policymakers and entrepreneurs to create successful Fintech hubs in these regions.

Outcome - The research introduces a practical framework for building Fintech ecosystems in resource-scarce settings, called the Frugal Fintech Ecosystem Development (FFED) framework.
- The framework identifies three core stages: Structuring (gathering and prioritizing available resources), Bundling (combining resources to build capabilities), and Leveraging (using those capabilities to seize market opportunities).
- It highlights five key sub-processes for success in a frugal context: bricolaging (creatively using resources at hand), prioritizing, emulating (learning from established ecosystems), extrapolating, and sandboxing (safe, small-scale experimentation).
- The study shows that by orchestrating resources effectively, even frugal ecosystems can achieve outcomes comparable to those in well-funded regions, a concept termed 'equifinality'.
- The findings offer an evidence-based guide for policymakers to design regulations and support models that foster sustainable Fintech growth in developing economies.
Fintech Ecosystem, India, Frugal Innovation, Resource Orchestration, Case Study
Antecedents of User Experience in the Immersive Metaverse Ecosystem: Insights from Mining User Reviews
Communications of the Association for Information Systems (2024)

Antecedents of User Experience in the Immersive Metaverse Ecosystem: Insights from Mining User Reviews

Bibaswan Basu, Arpan K. Kar, Sagnika Sen
This study analyzes over 400,000 user reviews from 14 metaverse applications on the Google Play Store to identify the key factors that influence user experience. Using topic modeling, text analytics, and established theories like Cognitive Load Theory (CLT) and Cognitive Absorption Theory (CAT), the researchers developed and empirically validated a comprehensive framework. The goal was to understand what makes these immersive virtual environments engaging and satisfying for users.

Problem While the metaverse is a rapidly expanding technology with significant business potential, there is a lack of large-scale, empirical research identifying the specific factors that shape a user's experience. Businesses and developers need to understand what drives user satisfaction to create more immersive and successful platforms. This study addresses this knowledge gap by moving beyond theoretical discussions to analyze actual user feedback.

Outcome - Factors that positively influence user experience include sociability (social interactions), optimal user density, telepresence (feeling present in the virtual world), temporal dissociation (losing track of time), focused immersion, heightened enjoyment, curiosity, and playfulness.
- These findings suggest that both the design of the virtual environment (CLT factors) and the user's psychological engagement (CAT factors) are crucial for a positive experience.
- Contrary to the initial hypothesis, platform stability was negatively associated with user experience, possibly because too much familiarity can lead to a lack of diversity and novelty.
- The study did not find a significant link between interactivity and social presence with user experience in its final models, suggesting other elements are more impactful.
Metaverse, User Experience, Immersive Technology, Virtual Ecosystem, Cognitive Absorption Theory, Big Data Analytics, User Reviews
Digital Resilience in High-Tech SMEs: Exploring the Synergy of AI and IoT in Supply Chains
Communications of the Association for Information Systems (2025)

Digital Resilience in High-Tech SMEs: Exploring the Synergy of AI and IoT in Supply Chains

Adnan Khan, Syed Hussain Murtaza, Parisa Maroufkhani, Sultan Sikandar Mirza
This study investigates how digital resilience enhances the adoption of AI and Internet of Things (IoT) practices within the supply chains of high-tech small and medium-sized enterprises (SMEs). Using survey data from 293 Chinese high-tech SMEs, the research employs partial least squares structural equation modeling to analyze the impact of these technologies on sustainable supply chain performance.

Problem In an era of increasing global uncertainty and supply chain disruptions, businesses, especially high-tech SMEs, struggle to maintain stability and performance. There is a need to understand how digital technologies can be leveraged not just for efficiency, but to build genuine resilience that allows firms to adapt to and recover from shocks while maintaining sustainability.

Outcome - Digital resilience is a crucial driver for the adoption of both IoT-oriented supply chain practices and AI-driven innovative practices.
- The implementation of IoT and AI practices, fostered by digital resilience, significantly improves sustainable supply chain performance.
- AI-driven practices were found to be particularly vital for resource optimization and predictive analytics, strongly influencing sustainability outcomes.
- The effectiveness of digital resilience in promoting IoT adoption is amplified in dynamic and unpredictable market environments.
Digital Resilience, Internet of Things-Oriented Supply Chain Management Practices, AI-Driven Innovative Practices, Supply Chain Dynamism, Sustainable Supply Chain Performance
Affordance-Based Pathway Model of Social Inclusion: A Case Study of Virtual Worlds and People With Lifelong Disability
Journal of the Association for Information Systems (2026)

Affordance-Based Pathway Model of Social Inclusion: A Case Study of Virtual Worlds and People With Lifelong Disability

Karen Stendal, Maung K. Sein, Devinder Thapa
This study explores how individuals with lifelong disabilities (PWLD) use virtual worlds, specifically Second Life, to achieve social inclusion. Using a qualitative approach with in-depth interviews and participant observation, the researchers analyzed how PWLD experience the platform's features. The goal was to develop a model explaining the process through which technology facilitates greater community participation and interpersonal connection for this marginalized group.

Problem People with lifelong disabilities often face significant social isolation and exclusion due to physical, mental, or sensory impairments that hinder their full participation in society. This lack of social connection can negatively impact their psychological and emotional well-being. This research addresses the gap in understanding the specific mechanisms by which technology, like virtual worlds, can help this population move from isolation to inclusion.

Outcome - Virtual worlds offer five key 'affordances' (action possibilities) that empower people with lifelong disabilities (PWLD).
- Three 'functional' affordances were identified: Communicability (interacting without barriers like hearing loss), Mobility (moving freely without physical limitations), and Personalizability (controlling one's digital appearance and whether to disclose a disability).
- These functional capabilities enable two 'social' affordances: Engageability (the ability to join in social activities) and Self-Actualizability (the ability to realize one's potential and help others).
- The study proposes an 'Affordance-Based Pathway Model' which shows how using these features helps PWLD build interpersonal relationships and participate in communities, leading to social inclusion.
Social Inclusion, Virtual Worlds (VW), People With Lifelong Disability (PWLD), Affordances, Second Life, Assistive Technology, Qualitative Study
How Verizon Media Built a Cybersecurity Culture
MIS Quarterly Executive (2022)

How Verizon Media Built a Cybersecurity Culture

Keri Pearlson, Josh Schwartz, Sean Sposito, Masha Arbisman
This case study examines how Verizon Media's security organization, known as “The Paranoids,” successfully built a strong cybersecurity culture across its 20,000 employees. The study details the formation and strategy of the Proactive Engagement (PE) Group, which used a data-driven, three-step process involving behavioral goals, metrics, and targeted actions to change employee behavior. This approach moved beyond traditional training to create lasting cultural change.

Problem Human error is a primary cause of cybersecurity breaches, with reports indicating it's involved in up to 85% of incidents. Standard cybersecurity awareness training is often insufficient because employees fail to prioritize security or find security protocols cumbersome. This creates a significant gap where organizations remain vulnerable despite technical defenses, highlighting the need for a deeper cultural shift to make security an ingrained value.

Outcome - The rate of employees having their credentials captured in phishing simulations was cut in half.
- The number of accurately reported phishing attempts by employees doubled.
- The usage of the corporate password manager tripled across the company.
- The initiative successfully shifted the organizational mindset by using transparent dashboards, positive reinforcement, and practical tools rather than relying solely on awareness campaigns.
- The study provides a replicable framework for other organizations to build a security culture by focusing on changing values and beliefs, not just actions.
Cybersecurity Culture, Organizational Behavior, Change Management, Verizon Media, Phishing Simulation, Employee Training, Information Security
Using Lessons from the COVID-19 Crisis to Move from Traditional to Adaptive IT Governance
MIS Quarterly Executive (2022)

Using Lessons from the COVID-19 Crisis to Move from Traditional to Adaptive IT Governance

Heiko Gewald, Heinz-Theo Wagner
This study analyzes how IT governance structures in nine international companies, particularly in regulated industries, were adapted during the COVID-19 crisis. It investigates the shift from rigid, formal governance to more flexible, relational models that enabled rapid decision-making. The paper provides recommendations on how to integrate these crisis-mode efficiencies to create a more adaptive IT governance system for post-crisis operations.

Problem Traditional IT governance systems are often slow, bureaucratic, and focused on control and risk avoidance, which makes them ineffective during a crisis requiring speed and flexibility. The COVID-19 pandemic exposed this weakness, as companies found their existing processes were too rigid to handle the sudden need for digital transformation and remote work. The study addresses how organizations can evolve their governance to be more agile without sacrificing regulatory compliance.

Outcome - Companies successfully adapted during the crisis by adopting leaner decision-making structures with fewer participants.
- The influence of IT experts in decision-making increased significantly, shifting the focus from risk-avoidance to finding the best functional solutions.
- Formal controls were complemented or replaced by relational governance based on social interaction, trust, and collaboration, which proved to be more efficient.
- The paper recommends permanently adopting these changes to create an 'adaptive IT governance' system that balances flexibility with compliance, ultimately delivering more business value.
IT governance, adaptive governance, crisis management, COVID-19, relational governance, formal governance, decision-making structures
Applying the Lessons from the Equifax Cybersecurity Incident to Build a Better Defense
MIS Quarterly Executive (2021)

Applying the Lessons from the Equifax Cybersecurity Incident to Build a Better Defense

Ilya Kabanov, Stuart Madnick
This study provides an in-depth analysis of the 2017 Equifax data breach, which affected 148 million people. Using the Cybersafety method, the authors reconstructed the attack flow and Equifax's hierarchical safety control system to identify systemic failures. Based on this analysis, the paper offers recommendations for managers to strengthen their organization's cybersecurity.

Problem Many organizations miss the opportunity to learn from major cybersecurity incidents because analyses often focus on a single, direct cause rather than addressing deeper, systemic root causes. This paper addresses that gap by systematically investigating the Equifax breach to provide transferable lessons that can help other organizations prevent similar catastrophic failures.

Outcome - The breach was caused by 19 systemic failures across four hierarchical levels: technical controls (e.g., expired certificates), IT/Security teams, management and the board, and external regulators.
- Critical technical breakdowns included an expired SSL certificate that blinded the intrusion detection system for nine months and vulnerability scans that failed to detect the known Apache Struts vulnerability.
- Organizational shortcomings were significant, including a reactive patching process, poor communication between siloed IT and security teams, and a failure by management to prioritize critical security upgrades.
- The board of directors failed to establish an appropriate risk appetite, prioritizing business growth over information security, which led to a culture where security was under-resourced.
- The paper offers 11 key recommendations for businesses, such as limiting sensitive data retention, embedding security into software design, ensuring executive leadership has a say in cybersecurity decisions, and fostering a shared sense of responsibility for security across the organization.
cybersecurity, data breach, Equifax, risk management, incident analysis, IT governance, systemic failure
Load More Showing 18 of 57