Paolo Spagnoletti

• Adamu, Meseret Assefa; Niemimaa, Marko Ilmari & Spagnoletti, Paolo (2026). Temporality of Cybersecurity Culture Amid Rapid Digital Transformation: Evidence From an Ethiopian Bank. Electronic Journal of Information Systems in Developing Countries. 92(2). doi: 10.1002/isd2.70058. Full text in Research Archive Show summary

  Organizational reliance on emerging digital technologies that are transforming the work patterns has left organizations vulnerable to sophisticated cyber threats. Industry reports and incident cases indicate that the rapid pace of digital transformation exacerbates these issues, as organizations' cybersecurity posture must keep pace with the changing organizational and technological landscape. Prior literature suggests that fostering cybersecurity culture (CSC) is foundational for any cybersecurity effort. However, CSC tends to develop slowly and evolutionary, whereas rapid digital transformation (RDT) unfolds quickly and periodically, giving rise to temporal disparity. In this study, we adopt a case study methodology to examine how an Ethiopian bank addressed this temporal disparity and crafted strategies to align CSC with ongoing RDT. We build our analysis on a multilayer temporality model of CSC that draws on and extends Schein's organizational culture model. Our findings highlight the challenges engendered by temporal disparity and underscore the need for strategic organizational actions. The study provides a theoretical basis for fostering CSC amidst RDT and offers practical insights for developing countries, highly regulated sectors, and organizations undergoing RDT.

• Spagnoletti, Paolo & Baskerville, Richard (2025). Safe and Unsafe Information: Managing Risks in the Era of Generative Artificial Intelligence. In Abrahamsen, Eirik Bjorheim; Aven, Terje; Bouder, Frederic Emmanuel; Flage, Roger & Ylönen, Marja Katariina (Ed.), Stavanger ESREL SRA-E 2025 Proceedings: 35th European Safety and Reliability Conference and the 33rd Society for Risk Analysis Europe Conference, 15 - 19 June 2025, Norway. Research Publishing Services. ISSN 9789819432813. p. 1934–1940. doi: 10.3850/978-981-94-3281-3_esrel-sra-e2025-p9196-cd. Full text in Research Archive Show summary

  The transformative impact of digitalization on organizations has significantly increased the availability of organizational information to the public. This shift amplifies the responsibility of organizations to ensure the safety of their digital products and services, as unsafe information can cause harm to society or the environment. Generative artificial intelligence (GenAI) introduces unique risks by enabling the effortless production of ungrounded and potentially harmful content, such as hallucinations, which can propagate misinformation when uncritically used. These challenges necessitate a departure from traditional corporate social responsibility (CSR) frameworks towards more robust risk management strategies. This paper develops a taxonomy of characteristics of safe versus unsafe information from GenAI, characterized by three dimensions: correct, open, and benignant for safe information; and incorrect, protected, and dangerous for unsafe information. Drawing on empirical data from Italian organizations we validate and verify the alignment of established risk taxonomies and derive practical recommendations for mitigating these risks. These include implementing rigorous data validation pipelines, restricting inputs to trusted and verified sources, and employing robust processing and oversight mechanisms. By embedding these strategies into governance frameworks, organizations can mitigate the risks of unsafe information while ensuring that GenAI contributes positively to societal and environmental well-being.

• Ceci, Federica; Spagnoletti, Paolo & Prencipe, Andrea (2025). Gatekeeping in Online Markets: An Empirical Investigation of IT-based Self-regulation in Online Black Markets. International Journal of Electronic Commerce. ISSN 1086-4415. 29(4), p. 593–619. doi: 10.1080/10864415.2025.2556641. Full text in Research Archive Show summary

  This study examines how IT-based gatekeeping mechanisms influence platform survival in Online Black Markets (OBMs), anonymous, self-regulated marketplaces where buyers and vendors exchange illegal goods in absence of formal rules and regulatory bodies. In these high-conflict environments, platform owners rely on technological gatekeeping as a form of enhanced self-regulation, delegating specific control functions to IT-based intermediaries such as reputation systems, escrow services and access filters. Employing a sequential exploratory mixed-method approach, we first conducted a qualitative case study of OBMs and then tested the impact of these mechanisms using quantitative survival analysis on a dataset of 56 OBMs spanning 54 months. Our findings reveal that controlling platform access enhances survival, whereas delegating transaction control to third parties increases failure risk. These insights advance the understanding of gatekeeping as a dynamic, IT-based self-regulation process to address conflicting practices in online markets and contributes to platform governance literature by highlighting the risks of decentralizing transaction control in high-conflict online environments.

• Adamu, Meseret Assefa; Niemimaa, Marko Ilmari & Spagnoletti, Paolo (2025). Leadership Role in Fostering Cybersecurity Culture Amid Rapid Digital Transformation. AMCIS 2025 Proceedings. Full text in Research Archive Show summary

  The rapid pace of digital transformation exacerbates cyber risk, thereby necessitating the development of a cybersecurity culture (CSC). However, cultural development is inherently slower than technological change, making leadership a key factor in bridging this gap. This study empirically investigates how leaders develop a CSC amid RDT, drawing on qualitative data from semi-structured interviews, archival reports, and field observations within an Ethiopian bank undergoing digital transformation. The findings show that tailored leadership strategies and targeted interventions are critical in developing a CSC. This research contributes to the IS leadership literature by highlighting that, unlike traditional law enforcement leadership's hierarchical and protocol-driven nature, cybersecurity leadership must be adaptive and responsive to the pace of organizational transformation.

• Adamu, Meseret Assefa; Spagnoletti, Paolo & Niemimaa, Marko Ilmari (2025). Fostering Organizational Cybersecurity Culture Amid Rapid Digital Transformation: A Case Study from Ethiopia. In Tursunbayeva, Aizhan; Virili, Francesco & Braccini, Alessio Maria (Ed.), Technology-Driven Transformation: The Future of Work and Organizations. Springer Nature Switzerland. ISSN 9783032013958. p. 205–222. doi: 10.1007/978-3-032-01396-5_12. Full text in Research Archive Show summary

  Digital transformation introduces significant cybersecurity challenges for organizations, with its rapid pace further complicating the development of a robust cybersecurity culture (CSC). While previous studies have focused on building, developing, and conceptualizing CSC under relatively stable conditions, they often overlook the challenges posed by rapid digital transformation (RDT) and lack detailed insights into the initiatives and key factors that promote a desirable CSC amid RDT. This study employs a qualitative research methodology, collecting data from a financial institution undergoing RDT through semi-structured interviews and archival documents. The findings provide empirical insights into the cybersecurity challenges RDT presents and identify critical factors that contribute to cultivating a desired CSC in such a dynamic context. Theoretically, this research demonstrates that organizations can develop a desired CSC through deliberate actions, such as regular training, leadership initiatives, and updating policies and guidelines, even amid rapid organizational changes. Practically, it deepens the understanding of CSC in dynamic settings and provides strategies to enhance security and address cybersecurity challenges in times of rapid transformation.

• Adamu, Meseret Assefa; Niemimaa, Marko Ilmari & Spagnoletti, Paolo (2025). Towards a Three-Tiered Framework for Fostering Organizational Cybersecurity Culture. Lecture Notes in Business Information Processing. ISSN 1865-1348. 536, p. 313–324. doi: 10.1007/978-3-031-81325-2_22. Full text in Research Archive Show summary

  Cybersecurity is an increasing concern for organizations. Reports indi-cate that most incidents stem from human factors and, fostering a desired cyberse-curity culture (CSC) is a crucial strategy to minimize the risk. Research suggests that exploring CSC in an organizational context requires a theoretical foundation, with numerous theories offering diverse perspectives on studying CSC in vari-ous organizational contexts. Previous studies have proposed and utilized Schein’s organizational culture framework to conceptualize, analyze, and understand orga-nizational CSC. However, these studies have not addressed the dynamics of the framework’s levels for fostering a desired CSC within an organizational context. The present study addresses this gap by adapting a framework based on Schein’s organizational culture framework to use it as a foundation for fostering a desired cybersecurity culture in organizations. The adapted framework is structured into three interconnected levels (tiers): 1) Operations 2) Principles 3) Mindset. The study also explores the interplay of the adapted concepts to foster the desired CSC in an organization. The adapted framework provides a theoretical basis to explore CSC and insights for practitioners on shaping and sustaining a culture that prioritizes cybersecurity.

• Spagnoletti, Paolo; Kazemargi, Niloofar; Constantinides, Panos & Prencipe, Andrea (2025). Data Control Coordination in the Formation of Ecosystems in Highly Regulated Sectors. Journal of the AIS. 26(4), p. 977–1008. doi: 10.17705/1jais.00920. Full text in Research Archive Show summary

  Ecosystems in highly regulated sectors such as banking are orchestrated through institutional policies and technical standards that ensure the interoperability of cloud service infrastructures. Despite such interoperability, actors must still coordinate distributed data control to guarantee that data are treated under equal conditions. Drawing on a case study of the Italian banking sector between 2009 and 2020, we investigate the coordination efforts of ecosystem actors in distributing data control across organizational boundaries and jurisdictions. We show that, despite the availability of interoperability standards, the distribution of data control creates tensions that, on the one hand, hinder integration efforts and, on the other hand, allow disproportionate value capture, together contributing to ecosystem failures. We introduce a process model that details how contractual and procedural coordination mechanisms can mitigate these tensions and facilitate value co-creation. We conclude with a discussion of the contributions and implications of our findings for further research on data control coordination.

• Spahiu, Esli; Kazemargi, Niloofar; Nunziata, Eugenio & Spagnoletti, Paolo (2024). Moving to New Ways of Working Across the Pandemic Crisis: Managerial Challenges and Human-Technology Configurations. In Lazazzara, Alessandra; Reina, Rocco & Za, Stefano (Ed.), Towards Digital and Sustainable Organisations. Springer. ISSN 9783031528804. p. 27–46. doi: 10.1007/978-3-031-52880-4_3. Full text in Research Archive Show summary

  New working modalities such as smart working have removed the constraints of time and place and turned the traditional concept of work into a highly flexible phenomenon that can now be conducted anywhere through digital tools and an array of new technologies. After having experienced it in an unprecedented rate worldwide, following the Covid-19 pandemic, many companies have vowed that these new work configurations are here to stay and will become increasingly common. Organizations will continue to embrace them as a way of improving employees’ satisfaction and revolutionizing operations. Despite the benefits often associated with the new ways of work, evidence shows that many companies have struggled to cope with it. In light of the complexity of such adoption, we investigate through a longitudinal case study of a multinational company that embraced such initiatives before, during and after the pandemic, the main challenges and difficulties voiced by both managers and employees. The analysis of the findings shows that the main issues relate to excessive supervision, longer working hours, change of team dynamics and insufficient use of technologies—all of which call for a change in organizational culture and approach towards new ways of working that goes beyond changes in individual tasks and work practices.

• Spahiu, Esli; Spagnoletti, Paolo & Sposito, Augusto (2024). Building a Blockchain-Based Platform for Interbank Collaboration. International Journal of Electronic Commerce. ISSN 1086-4415. 28(2), p. 269–291. doi: 10.1080/10864415.2024.2332051. Full text in Research Archive
• Satwekar, Abhijeet; Volpentesta, Tiziano; Spagnoletti, Paolo & Rossi, Mara (2023). An Orchestration Framework for Digital Innovation: Lessons from the Healthcare Industry. IEEE transactions on engineering management. ISSN 0018-9391. 70(7), p. 2465–2479. doi: 10.1109/TEM.2022.3167259. Full text in Research Archive Show summary

  The healthcare industry is continuously evolving with innovative discoveries and therapies, and at the same time, there is a decline in the research and development productivity leading to an increased cost for payers, providers, and patients. Despite the benefits that digital technologies can have on healthcare innovation, such a highly regulated industry often relies on proven-established technologies and organizational procedures that can be at odds with the new logics of digital innovation. In this article, we will be introducing a digital innovation management (DIM) framework that guides the pursuit of digital innovations in a phase-appropriate and incremental setup (e.g., scale, costs, risks, value evaluations, policies, and resources). The framework is designed and validated through an iterative process of continuous adaptation with local practices in a biopharmaceutical company. DIM provides practical guidance to drive digital innovations that entail different logics compared to traditional innovations, by improving the visibility of the digital innovation process and increasing organizational confidence in pursuing digital innovations and enhancing decision-making effectiveness.

• Bley, Katja; Rønningen, Martin Holthe; Spagnoletti, Paolo & Pappas, Ilias (2022). The Potential of Big Data Analytics for Decision Support in Sports–The Case of Soccer. In Brown, Sue & Subramani, Mani (Ed.), AMCIS 2022 PROCEEDINGS. Association for Information Systems (AIS). ISSN 9781958200001. p. 1–11. Full text in Research Archive Show summary

  Compared to other popular sports, soccer is quite a fluid sport with high degrees of freedom, which is why evaluating games or single players' performance is more demanding and complex. Even though the availability of different types of soccer data has increased steadily over the last few years, the process of strategic and tactical decision-making is still traditionally done by single specialists. In this context, the potentials of big data analytics (BDA) provide an advantage in automatically assessing and assembling data from various sources and generating insights that exceed the analytical capability of individual human experts. We focus on this potential by developing a design science research-based BDA artifact, which aims at providing strategic decisional support for managers and experts. In several evaluations with different soccer and sports experts, we are able to show advanced usability of the artifact's instantiation over traditional tools provided by large stats providers.

• Baskerville, Richard; Depaoli, paolo & Spagnoletti, Paolo (2022). Organizing cybersecurity in action: a Pragmatic Ethical Reasoning approach. Lecture Notes in Information Systems and Organisation (LNISO). ISSN 2195-4968. 50. doi: 10.1007/978-3-030-86858-1_11. Full text in Research Archive Show summary

  This paper contributes to the literature on cybersecurity governance by suggesting an approach based on pragmatism. As Jeffrey Sachs in his The Age of Sustainable Development, 2015, reminds us: “The essence of sustainable development in practice is scientifically and morally based problem solving”. Cybersecurity deals with problem solving in complex socio-technical settings where ethics and organizational learning are tightly related. The paper draws on pragmatism because from its earliest formulation, pragmatist thought was anchored to a dual interest in ethics and science. Under this lens, pragmatic ethics cannot exist as a set of rules or principles, but rather requires a cyclical, empirical process whereby ethical principles and context interact to promote justice among stakeholders in the research of reliable solutions during the unravel of critical events. As a result, an Ethically oriented Cybersecurity Approach (ECA) based on Pragmatic Ethical Reasoning (PER) is proposed for managing unexpected critical events when organizations must learn on-the-fly and improve their security profiles.

• Spagnoletti, Paolo; Kazemargi, Niloofar & Prencipe, Andrea (2021). Agile Practices and Organizational Agility in Software Ecosystems. IEEE transactions on engineering management. ISSN 0018-9391. p. 1–14. doi: 10.1109/TEM.2021.3110105. Full text in Research Archive Show summary

  As software products increasingly become part of larger ecosystems, research and development (R&D) units of software producers organize themselves around projects to become more responsive to the environment. Organizations participating in software ecosystems must continuously adapt and adjust their software development and maintenance processes to drive both medium-term and long-term innovation. Agile methods and practices are widely adopted to guide the collaboration within and between project teams in software development. Moreover, when successfully attained, agility can drive innovation by enabling software development organizations to cope with technological changes and exploit emerging opportunities in software ecosystems. In this article, we focus on how organizations attain agility in the maintenance and development of software products. To answer this question, we conduct a longitudinal case study of Agile Scrum implementation in the R&D unit of a major supplier of telecommunication equipment. We investigate the emerging tensions and highlight practices used to balance these tensions in the Agile Scrum implementation. We identify four capabilities and ten practices that support effective collaboration and coordination in the development and maintenance of software products. The study offers practical guidance for R&D managers to attain agility in software ecosystems.

• Spagnoletti, Paolo & Za, Stefano (2021). Digital Resilience to Normal Accidents in High-Reliability Organizations. In Aier, Stephan; Rohner, Peter & Schelp, Joachim (Ed.), Engineering the Transformation of the Enterprise. Springer. ISSN 9783030846541. p. 339–353. doi: 10.1007/978-3-030-84655-8_21. Full text in Research Archive Show summary

  Digital technologies play a dual role on organizational resilience. On one side, digital systems introduce new technological risks. On the other side, digital systems increase the performances in response to hazardous accidents. Normal Accident Theory (NAT) and High-Reliability Organization (HRO) provide useful ground to explain the dynamics of digital resilience. However, the two theories have been either used as alternatives or with one theory dominating the other. We posit that to fully understand digital resilience we need to integrate NAT and HRO concepts instead of using them in isolation. We conduct a bibliometric analysis to identify major themes and application domains characterizing HRO and NAT research. We look at similarities and differences between the two streams and we build an integrated framework for the analysis of digital resilience. With our systematic analysis of the NAT and HRO discourses we advance the current understanding on resilience in digitally enabled operations.

• Spagnoletti, Paolo; Ceci, Federica & Bygstad, Bendik (2021). Online Black-Markets: An Investigation of a Digital Infrastructure in the Dark. Information Systems Frontiers. ISSN 1387-3326. doi: 10.1007/s10796-021-10187-9. Full text in Research Archive Show summary

  Abstract This paper investigates the functioning of Online Black-Markets (OBMs), i.e. a digital infrastructure operating in the Dark Net that enables the exchange of illegal goods such as drugs, weapons and fake digital identities. OBMs exist notwithstanding adverse conditions such as police interventions, scams and market breakdowns. Relying on a longitudinal case study, we focus on the dynamics of interactions among actors and marketplace technologies and we identify three mechanisms explaining OBMs operations. In particular, we show that OBMs infrastructure is the result of commoditization, platformization and resilience processes. Our contribution relies on the identification of community-based mechanisms that generate the OBMs infrastructure, extending the current understanding of e-commerce and social commerce.

• Salvi, Andrea; Spagnoletti, Paolo & Noori, Nadia (2021). Cyber-resilience of Critical Cyber Infrastructures: integrating digital twins in the electric power ecosystem. Computers & Security. ISSN 0167-4048. doi: 10.1016/j.cose.2021.102507. Full text in Research Archive Show summary

  Here in this work a simple and direct method to synthesize Rubik’s cube-like Linda Type (LTA) zeolite NaA structure is reported. Linda Type (LTA) zeolite was synthesized by hydrothermal method without using any organic template additives. The molar ratio of 3.165Na2O:Al2O3:1.926SiO2:128H2O have been used to prepare the zeolite NaA hydrogel. The thermal stability of the synthesized zeolite NaA was studied through the thermogravimetric analysis (TGA). The results of X-ray diffraction (XRD) analysis showed that the crystallinity of the synthesized zeolite is good and the material is of high purity. Through the FTIR study, functional groups belonging to the zeolite NaA was confirmed. From the FESEM analysis, morphology of the synthesized sample was found to be Rubik’s cube-like structure. The elemental composition of the material was studied using the EDAX analysis and the ratio of Si:Al was found to be ∼ 1. Further from the SAED patterns of the prepared sample, it was observed that the material is polycrystalline in nature. From the nitrogen adsorption/desorption results the zeolite NaA samples was found to be mesoporous in nature. The pore size of the samples have been obtained using the Barrett-Joyner-Halenda (BJH) analysis. The CO2 adsorption isotherm study was carried out at 298 K and the isotherm was fitted by using Langmuir and Freundlich adsorption isotherm.

• Spagnoletti, Paolo & Salvi, Andrea (2020). Digital systems in High-Reliability Organizations: balancing mindfulness and mindlessness. CEUR Workshop Proceedings. 2789, p. 155–161. Full text in Research Archive
• Kazemargi, Niloofar & Spagnoletti, Paolo (2020). Cloud Sourcing and Paradigm Shift in IT Governance: Evidence from the Financial Sector. In Agrifoglio, Rocco; Lamboglia, Rita; Mancini, Daniela & Ricciardi, Francesca (Ed.), Digital Business Transformation. Springer International Publishing. ISSN 9783030473556. p. 47–61. doi: 10.1007/978-3-030-47355-6_4. Full text in Research Archive
• Kazemargi, Niloofar & Spagnoletti, Paolo (2020). IT Investment Decisions in Industry 4.0: Evidences from SMEs. In Agrifoglio, Rocco; Lamboglia, Rita; Mancini, Daniela & Ricciardi, Francesca (Ed.), Digital Business Transformation. Springer International Publishing. ISSN 9783030473556. p. 77–92. doi: 10.1007/978-3-030-47355-6_6. Full text in Research Archive

View all works in NVA

• Kazemargi, Niloofar; Spagnoletti, Paolo; Constantinides, Panos & Prencipe, Andrea (2023). Data control coordination in cloud-based ecosystems: the GAIA-X case. In Cennamo, Carmelo; Dagnino, Giovanni Battista & Zhu, Feng (Ed.), Research Handbook on Digital Strategy. Edward Elgar Publishing. ISSN 9781800378896. p. 289–307. doi: 10.4337/9781800378902.00024. Full text in Research Archive
• Spagnoletti, Paolo; spahiu, esli & Sæbø, Øystein (2022). Blockchain Technology for Data Transparency in Digital Infrastructures. Full text in Research Archive
• Flak, Leif Skiftenes; Sæbø, Øystein & Spagnoletti, Paolo (2019). Privacy violations in light of digital transformation: insights from data breaches in Norway. Full text in Research Archive

View all works in NVA