How does overconfidence affect information security investment and information security performance?

Abstract

ABSTRACT Although organizational information security investment has attracted a great deal of attention from academia and industry, there is a lack of studies on the decision maker's overconfidence. This paper examines the relationship between overconfidence of executives, information security investment and information security performance. The study shows that overconfidence is negatively associated with information security investment and an inverted U-shaped curvilinear relationship existed between information security investment and information security performance. Furthermore, to illustrate the robustness of our results, the suppressing effect and the serial mediating role between overconfidence, information security investment and information security performance are tested finally.