Going the ‘Extra’ Mile: The Role of Sensemaking in Extra-Role Security Behaviors

Abstract

As organizations are increasingly challenged by evolving information security threats that demand more than employee compliance to address, interest has grown in understanding extra-role security behaviors (ERSBs)—voluntary actions employees take beyond formal security policies that benefit organizations' security. Despite this interest, theoretical understanding of the individual and organizational factors that shape the cognitive process motivating such behaviors remains limited. Drawing on the lens of sensemaking, this study develops a theoretical framework presenting the process by which employees navigate organizational ambiguity and engage in ERSBs. Based on 40 in-depth interviews, our findings highlight the critical roles of security culture as organizational antecedent as well as cognitive frames and emotions as individual antecedents on the sensemaking process, ultimately influencing ERSBs. Using these insights, organizations and practitioners can better design and communicate policies, promote security dialogue, and build a security-forward environment that encourages ERSBs across all organizational roles.