د. طاهر صبحي طه الشيخ

Exploring Factors to Improve Intentions to Adopt Cybersecurity: A Study of Saudi Banking Sector

Tariq Saeed Mian^1,Eman M. Alatawi2

Department of IS, College of Computer Science and Engineering, Taibah University, Madinah Almunwarah, Saudi Arabia

Email: tmian@taibahu.edu.sa ORCID: 0000-0003-2666-9223

² Department of IS, College of Computer Science and Engineering, Taibah University, Madinah Almunwarah, Saudi Arabia. ORCID: 0000-0002-9692-3410

HNSJ, 2023, 4(9); https://doi.org/10.53796/hnsj498

Download

Published at 01/09/2023 Accepted at 08/08/2023

Abstract

Ecommerce is a lynch pin of Saudi Vision 2030, which has a lot of potential but simultaneously poses risks of cyber-attacks. In the banking sector, the vision encourages financial sector growth, technological innovation, and improved access to financial services. This includes enhancing digital banking, promoting financial literacy, and enabling SME financing. Around the world the financial and banking sector has increased their reliance on evolving technology which increased their vulnerability to face cyber-attacks. So, main objective of the study was to identify the factors that can improve cyber security among the employees of Saudi banks. Therefore, this study examined the effect of perceived usefulness, technology readiness, training and development and user satisfaction on cyber security adoption. This research also examined mediating role of user satisfaction as well. Cross sectional research design was adopted in the present study. Data was collected from the employees of KSA private banks through survey questionnaires. Usable response rate of the study was 63.14%. The collected data was examined using Smart PLS 3.3.9. Results revealed that perceived usefulness, training and development, and technology readiness were significant predictors of user satisfaction. Similarly, user satisfaction had a significant effect on intention to adopt cybersecurity. The mediating role of user intention was also confirmed through the results of the study. This study bridges the gap of limited studies of cybersecurity in the context of banking sector of KSA.

Key Words: Saudi Vision 2030, Cybersecurity, User Satisfaction, perceived usefulness, technology readiness, Kingdom of Saudi Arabia (KSA), Banking

Introduction

Ecommerce plays a pivotal role in Saudi Vision 2030 by fostering economic diversification and reducing oil dependency. It promotes digital entrepreneurship, job creation, and global trade, driving the nation’s transformation into a vibrant digital economy. Concurrently, cybersecurity is paramount to safeguarding this digital ecosystem. Protecting sensitive data, ensuring secure transactions, and establishing robust defenses against cyber threats are integral to maintaining consumer trust, investor confidence, and overall sustainable growth. A resilient cybersecurity framework supports Vision 2030’s goals, enabling Saudi Arabia to harness the benefits of ecommerce while mitigating risks to achieve its socio-economic objectives.

Implementation of cyber security Li and Liu (2021) is mainly impacted by several different concerns like security and privacy. Security is also the main concern for the computer users who are using it at home in terms of its appropriate user which will lead to adoption of it. Presently, technology collect real time data analyze and recognize all of the issues that are possible to impact efficient use of resources and assets. As the technology is growing with the passage of time, cyber threats have become major threats for the computer users. One of the important aspect of technology development is cyber security because its objective is to protect critical infrastructure communication systems, and information from attacks and unauthorized access (Addae, Sun, Towey, & Radenkovic, 2019). Therefore, the importance of cybersecurity is mounting with the passage of time. Despite that, there is need of more research in terms of economic, social and cultural issues and challenges in order to adopt different practices of cybersecurity. In order to ensure technology resilience and safety, it is key to prioritize cybersecurity as well as to address the mentioned challenges (Arpaci & Bahari, 2023). Researchers have also mentioned that there is need to understand the behavior of cybersecurity and assess the mechanism to enhance that behaviour (Alhalafi & Veeraraghavan, 2023). Thus, this study intends to fill this gap by examining the factors that can help in improving cybersecurity intentions among users.

To measure the success of information system, user satisfaction is most acceptable measure among the researchers (Sebetci, 2018). Thus, it is regarded as the critical measure to gauge the success of any system. Organizations that are considered as most forward-looking and successful looking always consider customer experience as the first consideration regarding online presence, experience, and website design (Bleier, Harmeling, & Palmatier, 2019). Evaluation of users in terms of information systems is the key for the IT managers as it enables them to take decisions on monitoring, implementation and adoption of the information systems. Satisfaction Vasić, Kilibarda, and Kaurin (2019) of the customers is mainly dependent on the implementation of IT related product, their reliability and security.

Scholars Corallo, Lazoi, Lezzi, and Luperto (2022) have pointed that there is need to review and assess the factors that can improve the cybersecurity of the system and improve it on the long term basis. In these terms, there is strong correlation among behavior of user and perception regarding cybersecurity risks. Perceived usefulness is regarded as perception of the individual the regarding the technology may improve the tasks assigned. Acceptance of IT is also influenced by the perceived usefulness (Mou, Shin, & Cohen, 2017). On the other hand, perceived usefulness of the system will also be high if any system is easy to use by the user and has tendency to improve the performance of user as well. Thus, if the perceived usefulness of the user increase, it will also enhance the intention to adopt the system as well (Islami, Asdar, & Baumassepe, 2021).

Technology readiness is the way to assess and measure the maturity of the technology. Assessment of technology readiness is the metric based, systematic process that has tendency to examine the risks associated with and maturity of the technology. For the users, the construct of technology readiness is very important. The profile of potential adopters can be determined by the marketers with the help of this construct that will later help in communicating and formulating the strategies according to adopter’s profile. The construct of technology readiness is very important in order to understand the dynamics that can influence adoption of technologies. A number of different researchers have examined the impact of this construct (Berlilana, Noparumpa, Ruangkanjanases, Hariguna, & Sarmini, 2021). Scholars have reported that cybersecurity achieved through technology readiness have successfully reduced breaches of data, improved reputation of security, improved security of internal processes and reliability of the information processing (Kaushik & Agrawal, 2021).

There is a need to take a number of different steps to minimize the uncertainty of threats that are faced by the users of internet. One of the key steps is the awareness of the cybersecurity (Catal, Ozcan, Donmez, & Kasif, 2023). It provides the organizations the workforce that is knowledgeable, confident and skilled. As a result, the performance of the organization is also bound to improve as the chances of error by the users are reduced. Furthermore, employees working in the organization can better handle and identify security threats in situations when they arise. The cybersecurity mistakes by the employees can be reduced by their training. The security awareness training the process in order to educate the employees and other stakeholders like business partners and contractors (Esteves, Ramalho, & De Haro, 2017). This training helps the employees to understand the way they can protect the computer systems and data of the organization from criminals and threats that can be done through internet. There is need of training on the regular basis as technology is being evolved on the regular basis increasing the level of threat as well (Khando, Gao, Islam, & Salman, 2021). So, the main purpose of this study is to identify the factors that can improve cyber security intentions among banking employees of KSA. In this regard, this study examined effect of perceived usefulness, technology readiness, training and development, and user satisfaction on CAI.

Saudi Vison 2030: A Transformation

E-commerce and cybersecurity play integral roles in Saudi Vision 2030, a comprehensive roadmap launched by the Saudi Arabian government to diversify the economy, reduce its dependency on oil, and drive sustainable development. This ambitious vision encompasses various sectors, and the integration of e-commerce and robust cybersecurity measures is essential to its success.

E-commerce, defined as the buying and selling of goods and services over the internet, is a cornerstone of Saudi Vision 2030. The vision seeks to transform Saudi Arabia into a global investment powerhouse and a hub connecting three continents. E-commerce serves as a catalyst for achieving this goal by fostering entrepreneurship, attracting foreign direct investment, and expanding the reach of Saudi businesses beyond traditional boundaries. It promotes the growth of small and medium-sized enterprises (SMEs) and empowers youth and women to participate in the economy through digital platforms. By facilitating access to a global marketplace, e-commerce contributes to economic diversification and job creation.

However, as e-commerce flourishes, the importance of cybersecurity becomes even more pronounced. The increased digital connectivity brings about heightened risks of cyberattacks, data breaches, and financial fraud. Safeguarding the digital infrastructure and the personal information of citizens, businesses, and institutions is a paramount concern. Saudi Arabia’s Vision 2030 recognizes the critical role of cybersecurity in maintaining trust, fostering innovation, and ensuring the continuity of digital services.

To realize the vision’s objectives, the Saudi government is actively investing in cybersecurity initiatives. This includes the establishment of regulatory frameworks and standards for data protection, privacy, and online transactions. Collaborations with international cybersecurity organizations and experts facilitate knowledge sharing and capacity building. Additionally, initiatives to enhance cybersecurity education and awareness help build a skilled workforce equipped to combat emerging cyber threats.

The synergy between e-commerce and cybersecurity in Saudi Vision 2030 is evident through various strategies. The growth of e-commerce relies on secure digital transactions and protected customer data. Robust cybersecurity measures, such as encryption, firewalls, and multi-factor authentication, instill confidence in consumers, encouraging them to embrace online shopping and electronic payments. Furthermore, e-commerce platforms must comply with stringent cybersecurity regulations to prevent cybercriminals from exploiting vulnerabilities.

As mentioned before, Saudi Vision 2030 is a strategic plan by the Saudi Arabian government to diversify the economy and reduce reliance on oil and aims to transform the country into a global investment hub and foster social and economic development. In the banking sector, the vision encourages financial sector growth, technological innovation, and improved access to financial services. This includes enhancing digital banking, promoting financial literacy, and enabling SME financing. The sector’s evolution aligns with the broader goals of economic diversification, job creation, and sustainable growth outlined in Saudi Vision 2030.

In conclusion, e-commerce and cybersecurity are two interconnected pillars of Saudi Vision 2030 that contribute to economic transformation, diversification, and resilience. E-commerce drives economic growth by opening up new avenues for trade and entrepreneurship, while cybersecurity ensures the safety and integrity of digital transactions and infrastructure. Together, these elements empower Saudi Arabia to become a leading player in the global digital economy while safeguarding its citizens and businesses from evolving cyber threats. By fostering innovation, enabling secure digital interactions, and nurturing a culture of digital trust, e-commerce and cybersecurity propel Saudi Arabia towards the realization of its visionary goals by 2030.

Literature review

Cybersecurity

Literature has discussed the concept of cybersecurity and cyberspace on a number of places. Basically, cyberspace is the interconnection of web technology that enables the sharing of services, products, and information available to the participants on the broader range. In literature, cybersecurity is defined as “the art of continuity and existence of information society of an organization protecting and guaranteeing its critical infrastructure, assets and information from criminals” (Addae et al., 2019). The main concern of cybersecurity is to protect the data, applications and devices from the unauthorised usage and access that is possible through internet connectivity. In modern technology and era, most of the things are being connected through internet and attached to different networks, it is not possible to provide separate security on each computer (Jang-Jaccard & Nepal, 2014).

The security controls are classified into three categories namely technical countermeasures, operational measures and management measures by the Addae et al. (2019). These categories are applied for the protection, availability, integrity and confidentiality of the information and system. The focus of managerial and operational controls is on the incidents and security risks that can be managed and monitored by people for training, continuity planning, business and usage policies etc. technical control is the mechanism that use set-ups on the basis of technology such as intrusion detection systems, encryption technologies and user authentication as measures to protect the systems (Abomhara & Køien, 2015). The cybersecurity threats are being evolved rapidly with the passage of time as more and more users have the ability to store, transfer, process and gather sensitive personal and commercial information over the internet (Alromaihi, Elmedany, & Balakrishna, 2018).

Most of the times, users need confirmation that information without their consent will not be tempered. On the other hand, users also want the readily availability of the data along with its access whenever they want. Unfortunately, any kind of data, personal or corporate is at risk that is accessible on the internet. Consequently, the users of internet should be able to easily adopt any mechanism to minimize the risk of security (Sivarethinamohan, 2021). In past studies Arpaci and Bahari (2023), size factors of cybersecurity are mentioned that may impact its adoption. These factors include utility, control, integration, authenticity, confidentiality and availability.

User Satisfaction

In different studies related to technology, researchers have mentioned that user satisfaction is one of the important factor for the adoption and evaluation of technology. Scholars have defined, satisfaction of user as the level to which it is believed by the user that certain system has the ability to satisfy their information needs, proposing that information system that fulfils the needs of the users can reinforce the satisfaction. In order to diagnose the user’s behavior in relationship with information security of the system, the key starting point is to assess the satisfaction of the users. Keeping in view that user satisfaction is the process that is based on satisfaction, if the practices of information security are complex, difficulties will be encountered by the users while using information system (Montesdioca & Maçada, 2015). In competitive market, key differentiator is the user satisfaction. Additionally, in order to improve the performance of system, it is very important to analyze the satisfaction of user. Loyalty of the user for the system is also impacted by the user satisfaction (Almarashdeh, 2016).

Perceived Usefulness

The main objective of using any system is to be useful so it can improve achievement of the task by the technology. Researchers have defined usefulness as to how far it is assumed by the user that certain system has the ability to improve the performance. On these grounds, Ardiansyah and Usman (2021) has defined perceived usefulness as the level of individual’s belief that job performance will be improved by using certain system. This definition is aligned with the definition of usefulness which is the ability to use the advantage. In terms of online technologies Saleem, Aslam, Kim, Nauman, and Khan (2022), perceived usefulness is described as the extent to which it is it is believed by the users that purchasing products online is useful. In another study, in order to adopt new technology, perceived usefulness plays very important role. Therefore, user perceives a technology useful if it is believed by the user that performance will be upgraded by the use of any certain technology. In other words, PU plays integral role to develop intention among user to adopt any technology (Kahar, Wardi, & Patrisia, 2019).

Technology Readiness (TR)

Technology readiness involves measurement of user’s readiness to use any technology that is new. There are two factors to technology readiness namely inhibitors and enablers. Technology readiness in terms of innovation plays very important role for the usage of latest technology. The variable of innovative technology readiness plays critical roles in altering attitude of users towards usage of any new technology (Berlilana et al., 2021). Innovative technology readiness is a very broad terminology that has focus on the tendency to adopt new technology and innovativeness (Nugroho & Fajar, 2017). The state of mind of the user is assessed through technology anxiety. This term express the willingness and ability of the user to adopt new technologies or tools related to any new technology. Researchers in their past El Alfy, Gómez, and Ivanov (2017) studies have mentioned four factors of TR namely insecurity, discomfort, optimism and innovativeness.

Training & Development

Training and development within a firm is the important factor to improve its performance. On the other hand, Mishra (2021) adoption of new technology is also influenced by the training and development of the employees. With the advancement of new technology, the implementation of training and development is totally changed. It is very important for the personal dealing with training and development that technology is being evolved on the regular basis and learning process is also being improved as well (Santos, Trevisan, Veloso, & Treff, 2021). With the advancement of new technology, it is possible to use artificial intelligence for a number of different matters. The term training and development means the lifelong learning. It explains the way an individual learn something on regular basis, accommodate with change, grow & improve, adjust, fit to changes, and add value. The programs related to training and development convinces the employees that the top management of the organization care about professional development of the employees. Moreover, the top management is committed in success of the employees in terms of technology (Beydoun & Saleh, 2023).

Hypotheses development

Perceived Usefulness and User Satisfaction

Consumer behavior is impacted by several different factors. Among these, researchers have mentioned perceived usefulness as one of the key predictor in the context of online environment. The satisfaction of the user is influenced if consumers understand that certain technology is installed in their computers or laptops. Perceived usefulness Geil, Sagers, Spaulding, and Wolf (2018) refers to the level to which an individual believes that setting of web browser can prevent any cyber-attack.

A number of past studies have assessed and confirmed the significant role of perceived usefulness in positively impacting satisfaction. Researchers have defined PU as the level to which a system can play an integral role to improve its job performance (Ramkumar, Schoenherr, Wagner, & Jenamani, 2019). On the other hand, Hart, Margheri, Paci, and Sassone (2020) perceived usefulness refers the level to which a user believed setting of the internet security is the computer can provide protection against cyber-attacks. Adoption of any technology is positively impacted by the perceived usefulness. It is mentioned by the researchers that it is more likely that if users believe that users will feel secured if proper security mechanism is provided to them (Addae et al., 2019).

Technology Readiness and User Satisfaction

Several past studies Hamzah, Hamzah, and Mat (2022) have reported that satisfaction of the user is impacted by the technology readiness. Also, social comfort is an integral determinant that influences the satisfaction of the customers. In these lines, it is assumed that if customers use technology, they will feel satisfied if they get relaxed as result of it. Based on it Wang, So, and Sparks (2017), it is inferred that satisfaction will be positively influenced by the technological readiness of the user.

According to researchers, Wiese and Humbani (2020) technology readiness is the variable of several different constructs. It includes factors that improve the technology acceptance by the users. The main objective of technology readiness is to examine the level the maturity of the technology so they can be adopted by the users.

Training & Development and User Satisfaction

Employees are an integral part of achieving satisfaction. Training of the employees who are dealing with customers is very important. The performance of the employees will be very good if they are trained. Thus, the satisfaction of the customers will be positively impacted as well. The well-trained employee has the skill to deal with the customers. They have understanding regarding tactics to deal with consumers, and they also have understanding regarding needs of the customers. Therefore, they play very important role to satisfy the customers by fulfilling these customers’ needs (Shah, 2020). According to scholars Akinbowale, Klingelhöfer, and Zerihun (2020), the employees of banks who are well trained and keep record and prompt reporting of the stolen funds, are successfully able to satisfy their clients because the clients never face the issue of financial loss in case of cyberattacks.

In order minimize the probability of such attacks; organizations need to spend a lot of capital on the training. On the other hand, customers (as they are users) also need training to use mobile banking apps and banking by using internet to get awareness of cybersecurity (Johri & Kumar, 2023). Also, if organizations can maintain procedure and policies, they will be able to keep their customers satisfied (Kumar, Biswas, Bhatia, & Dora, 2021).

User Satisfaction (US) and Intention to adopt Cyber Security

In order to maintain the measures that are important to adopt cyber security, user satisfaction plays very important role. Whereas intention to adopt cybersecurity is impacted by a number of different factors like education, training etc. If the user is satisfied with the usage of any computer based service, it will have significant impact on the adoption of that online service (Kar, 2021). Same findings were reported by Belanche, Casaló, and Guinalíu (2012) who pointed that intention to use website was positive influenced by user satisfaction.

Following hypothesis are developed in the basis of above discussion.

H1: Perceived usefulness (PU) has positive effect on US.

H2: Training and Development (T&D) has significant positive effect on US.

H3: Technology Readiness (TR) has significant positive impact on US.

H4: US has significant effect on CAI (Cybersecurity Adaptation Intention).

H5: US mediates the relationship between T&D and CAI.

H6: US mediates the relationship between TR and CAI.

H7: US mediates the relationship between PU and CAI.

Perceived Usefulness

User Satisfaction

Cybersecurity Adoption Intention

Technology Readiness

Training & Development

Figure 1: Research Framework

Methodology

In this study, we used quantitative methods on the basis of survey questionnaire. This study was conducted in the banks of Kingdom of Saudi Arabia. For this study, the sample was collected from the private banks of the KSA. According to past studies, the threshold level of sample is between 30 to 500. Therefore, we distributed questionnaire among 350 employees who are working in private banks of KSA. The sampling technique used in this research is simple random sampling. The questionnaire was distributed personally by the researcher and team. We received back 296 questionnaires from the respondents. Among these, 221 questionnaires were usable having the response rate of 63.14%. The questionnaire was distributed in two sections i.e. demographical information regarding respondents (in 1^st section) and information regarding variables of the study in second section.

The questionnaire of the study was adapted from the past studies. The questionnaire of Intentions was adapted from Addae et al. (2019), items of user satisfaction were adapted from Boubker and Douayri (2020), items of perceived usefulness were adapted from Addae et al. (2019), items of technological readiness is adopted from Berlilana et al. (2021), and questionnaires of training and development were adapted from Aburumman, Salleh, Omar, and Abadi (2020). The collected data was later assessed using SEM as technique and PLS modelling as tool for the analysis of the collected data. In this study, PLS was used as it is previously used in a number of studies related to management and social sciences Ashraf, Ali, Khan, and Aslam (2021) and Ali, Azeem, Marri, and Khurram (2021). Moreover, aim of this research was to predict the dependence of the variable therefore, PLS-SEM was considered more suitable as method to investigate (Ashraf, Ishfaq, Ali, & Sandhu, 2021).

Results and Analysis

Researchers suggested that analysis through PLS-SEM is based on two stages i.e. measurement model and structural model Hair Jr, Hult, Ringle, and Sarstedt (2021) and Ali et al. (2021). The assessment of measurement model was based in the utilization of convergent reliability, Cronbach Alpha, individual item reliability and discriminant validity (Hair, Hult, Ringle, Sarstedt, & Thiele, 2017).

Table 1: Factor Loading

	CAI	PU	T&D	TR	US
CAI1	0.891
CAI2	0.923
CAI3	0.966
PU1		0.819
PU2		0.795
PU3		0.809
T&D1			0.837
T&D2			0.880
T&D3			0.813
T&D4			0.814
TR1				0.868
TR2				0.818
TR3				0.803
US1					0.819
US2					0.814
US3					0.815
US4					0.852