Information Systems (IS) security lapses are viewed as a strategic threat to firms. Repeatedly, it has been seen that the individual user is the weak link in the security chain. Much of the research used to model this behavior has been based on theories that view individuals as making conscious and rational choices to maximize their utility, when research has established that it is negligent, unconscious, and careless behavior that leads to security breaches. Drawing on psychoanalytic literature, we identify threats and psychosomatic symptoms as potential factors that lead to dysfunctional behavior. Our model provides empirical evidence that perceived threat by an individual’s ego leads to symptoms of anxiety, which in turn leads to behavior characterized by denial of security threats and reactive behavior that exhibits indifference. This is one of the earliest papers to use psychoanalytic models relating to ego defense mechanisms to understand user behavior in the IS security context.
