Predictors of employees' cyber incident reporting intention: A vignette study on TPB, psychological safety, and organisational citizenship behaviour

Abstract
This vignette study examines employees’ cyber incident reporting intentions by manipulating key constructs of the Theory of Planned Behaviour (TPB), specifically subjective norms and perceived behavioural control. In addition, it investigates the influence of organisational citizenship behaviour (OCB) and psychological safety, while adopting a broader definition of reporting that includes both formal and informal channels.
The study employed three vignette scenarios with experimentally varied conditions and collected survey data from 818 Dutch employees in governmental and semi-governmental organisations.
Results show that positive subjective norms consistently increased reporting intentions, whereas perceived behavioural control demonstrated partial effects. Both OCB and psychological safety emerged as strong independent predictors of reporting intention, with psychological safety providing the greatest explanatory value beyond the TPB constructs.
With regard to reporting channels, higher perceived severity increased preferences for formal reporting channels, while lower perceived severity was associated with greater uncertainty and reduced reporting intentions across both formal and informal channels.
These findings suggest that fostering psychological safety and OCB may enhance cyber incident reporting. Further research is needed to better understand how contextual factors, particularly in ambiguous situations, influence reporting preferences.