Wael Anwar Abdel Aziz Soliman

• Siponen, Mikko; Topalli, Volkan; Soliman, Wael & Vestman, Tiina (2025). Reconsidering neutralization techniques in behavioral cybersecurity as cybersecurity hygiene discounting. Computers & Security. ISSN 0167-4048. 150. doi: 10.1016/j.cose.2024.104306. Full text in Research Archive Show summary

  Neutralization Theory (NT), with its popular neutralization techniques, have been established as a major framework to explain or predict cybersecurity policy noncompliance by users. NT states that people anticipating the perpetration of a norm violation activity will excuse their behaviors through self-talk justifications (neutralization) to avoid guilt and shame. NT's appeal for cybersecurity is obvious. One can easily imagine users justifying noncompliance by neutralizing the negative outcomes of their behavior. NT, as originally formulated, assumed that guilt and shame were the exclusive outcomes of anticipated transgressions. However, in the cybersecurity context, the role of guilt and shame as the sole motivators of neutralization excuses is debatable. We argue that users may be motivated by other factors (e.g., fear, boredom, concern for efficiency) in neutralizing that could be causally more relevant in predicting noncompliance behavior in cybersecurity. What holds value for behavioral cybersecurity, we argue, is the general mechanism of NT, the process of neutralizing the impact of an anticipated negative outcome on the decision to move forward (or not) with noncompliance. We call for decoupling the general mechanism of NT (e.g., neutralizing) from the criminologically identified motivations for engaging in NT (e.g., guilt and shame). In doing so, we put forward a behavioral cybersecurity security version of NT – cybersecurity hygiene discounting – and suggest four streams of research.

• Soliman, Wael & Rinta-Kahila, Tapani (2023). Unethical but not illegal! A critical look at two-sided disinformation platforms: Justifications, critique, and a way forward. Journal of Information Technology. ISSN 0268-3962. 39(3). doi: 10.1177/02683962231181145. Full text in Research Archive Show summary

  Crowdsourced disinformation represents a two-sided-market model wherein a platform organizer orchestrates the interaction between disinformation requesters and crowdworkers for a fee. Academic research and industry reports demonstrate that the disinformation business is thriving and that its consequences can be severe; however, research on this topic has focused mainly on developing technical methods to detect disinformation, while leaving the social aspects of the phenomenon unaddressed. In particular, very little is known about the discursive tactics that platforms apply to justify disinformation-service offerings such that these appear acceptable to potential customers. Taking a critical approach to the topic, the paper examines how platform organizers justify their disinformation services and to what extent the justifications given are valid. These questions are addressed via a unique dataset from 10 crowdsourcing platforms specializing in social-media–based reputation management. Drawing on the lens of accounts, the analysis suggests that these platforms employ six means of justification for persuasion purposes: the “claim of entitlement,” “defense of the necessity,” the “claim of ubiquity,” “language sanitization,” “appeal to professionalism,” and “appeal to codified rules.” Critical discourse analysis scrutinizing these accounts against the validity claims of comprehensibility, truth, sincerity, and legitimacy indicates that they cannot be considered valid. The paper discusses the implications of the findings and offers several recommendations designed for improving the status quo.

• Soliman, Wael & Ojalainen, Anniina (2023). Conflict Resolution in an ISO/IEC 27001 Standard Implementation: A Contradiction Management Perspective. In Bui, Tung X. (Eds.), Proceedings of the 56thAnnual Hawaii International Conference on System Sciences. HICSS Conference Office. ISSN 9780998133164. p. 4839–4848. Full text in Research Archive Show summary

  The ISO/IEC 27001 standard provides organizations with guidelines to help them evaluate, document, and improve their information security processes. In practice, however, the generality of the standard can create a conflict between its requirements and the adopters’ expectations. To better understand how an organization manages such conflicts, we conduct a case study in a Finnish corporation during the standard’s implementation in one of its units. Two critical conflicts emerged: Conflict I reflects a tension between the standard requirement for disciplinary measures vis-à-vis the organization’s punishment-averse culture. Conflict II reflects a tension between the organization’s aspiration for concrete code reviewing instructions vis-à-vis the lack thereof in the standard. Our findings reveal that whereas the conflict resolution process was similar in managing both conflicts, their content was radically different. Specifically, whereas conflict I’s resolution was paradoxical, conflict II’s resolution was dialectical. We discuss the theoretical and practical implications of our findings.

• Mallmann, Gabriela Labres & Soliman, Wael (2023). The Collective Violation Talk Show: How Do Workgroups Account of Cyberdeviance? IRIS Selected Papers of the Information Systems Research Seminar in Scandinavia. ISSN 1891-9863. 9. Full text in Research Archive Show summary

  Cyberdeviance within workgroups is one of the most challenging cybersecurity problems facing modern organizations. Cyberdeviance is an intentional form of security policy violation, reflecting the outcome of a justification process deeming the violation acceptable for the violator. The collective nature of cyberdeviance within groups increases the challenge because group context can steer members to act in accordance with the group’s decisions, even when it violates organizational directives. Despite these challenges, we know very little about how workgroups justify cyberdeviance. We ask: How do workgroups create and validate accounts for cyberdeviance? Guided by the theoretical lens of accounts and based on insights from five deviant workgroups using unauthorized technologies (aka, shadow IT), our analysis points to three core findings. First, the group context is crucial to understanding the violation framing process. Second, at the discursive level, the groups use a unique set of verbalizations that deem cyberdeviance acceptable within the group. Third, we found that this set of verbalized accounts is instrumental to ensure group cohesion and belongingness. We discuss the theoretical and practical implications of these novel insights.

• Rinta-Kahila, Tapani; Penttinen, Esko; Salovaara, Antii; Soliman, Wael & Ruissalo, Joona (2023). The Vicious Circles of Skill Erosion: A Case Study of Cognitive Automation. Journal of the AIS. 24(5), p. 1378–1412. doi: 10.17705/1jais.00829. Full text in Research Archive Show summary

  Cognitive automation powered by advanced intelligent technologies is increasingly enabling organizations to automate more of their knowledge work tasks. Although this often offers higher efficiency and lower costs, cognitive automation exacerbates the erosion of human skill and expertise in automated tasks. Accepting the erosion of obsolete skills is necessary to reap the benefits of technology—however, the erosion of essential human expertise is problematic if workers remain accountable for tasks for which they lack sufficient understanding, rendering them incapable of responding if the automation fails. Though the phenomenon is widely acknowledged, the dynamics behind such undesired skill erosion are poorly understood. Thus, taking the perspective of sociotechnical systems, we conducted a case study of an accounting firm that had experienced skill erosion over a number of years due to reliance on their software’s automated functions. We synthesized our findings using causal loop modeling based on system dynamics. The resulting dynamic model explains skill erosion via an interplay between humans’ automation reliance, complacency, and mindful conduction. It shows how increasing reliance on automation fosters complacency at both individual and organizational levels, weakening workers’ mindfulness across three work task facets (activity awareness, competence maintenance, and output assessment), resulting in skill erosion. Such skill erosion may remain obscure, acknowledged by neither workers nor managers. We conclude by discussing the implications for theory and practice and identifying directions for future research.

View all works in NVA

• Soliman, Wael; Mikkelesen, Adrian & Seljåsen, Terje Heum (2025). Security Operations Centers and the Battle between Mindfulness and Mindlessness: Toward a Model of Mindful Balancing. Full text in Research Archive Show summary

  Analysts in Security Operation Centers (SOCs) face numerous alerts daily, with 50% to 90% being false positives, leading to alert fatigue—a state of desensitization and cognitive overload that raises the risk of successful cyberattacks. While High Reliability Organizing (HRO) literature highlights organizational mindfulness in handling unexpected events, its application in SOCs and vulnerability to alert fatigue is less explored. Our study addressed this by exploring two questions: “How does mindful organizing manifest in SOCs at the organizational level?” and “How does alert fatigue affect analysts’ mindful behavior at the individual level?” Through qualitative interviews with 12 analysts from five SOCs, we identified core activities that establish SOCs as HROs. At the individual level, analysts employ "mindful balancing" tactics to alternate between mindfulness and mindlessness to manage their demanding work. Our study offers important theoretical and practical insights, elaborated further in the article.

• Kam, Hwee-Joo; Soliman, Wael; Nehme, Alaa & Warkentin, Merrill (2024). Organizational tensions: Learning from cybersecurity incidents. Full text in Research Archive
• Kam, Hwee-Joo; Zhong, Chen; Soliman, Wael & Johnston, Allen (2024). Generative AI and Cybersecurity: An Activity Theory Perspective. Full text in Research Archive
• Järveläinen, Jonna; Soliman, Wael & Porjo, Peppi (2024). The Weakest Link in Cybersecurity Discourse between Hembig and Evidence-Based Argumentation - A Problematizing Review. Full text in Research Archive
• Soliman, Wael & Järveläinen, Jonna (2024). Reconceptualizing the Human in the Loop: A Problematization of Taken-for-Granted Metaphors in Cybersecurity Research. Full text in Research Archive
• Kam, Hwee-Joo; Johnston, Allen; Zhong, Chen & Soliman, Wael (2024). Integrating generative AI in cybersecurity: A sensemaking perspective. Full text in Research Archive
• Soliman, Wael & Mohammadnazar, Hojat (2022). Revisiting neutralization theory and its underlying assumptions to inspire future information security research. Full text in Research Archive Show summary

  Over two decades ago, neutralization theory was introduced to information systems research from the field of criminology and is currently emerging as an influential foundation to both explain and solve the information security policy noncompliance problem. Much of what we know about the theory focuses exclusively on the neutralization techniques identified in the original as well as subsequent criminological writings. What is often left unexamined in IS research is the underlying assumptions about the theory’s core elements; assumptions about the actor, the act, the normative system, and the nature of neutralizing itself. The objective of this commentary is to revisit the origin of neutralization theory to identify its core assumptions and to lay a foundation for future IS research inspired by these assumptions. This paper points to five core assumptions: (1) The actor is an early-stage offender; (2) The act is shameful; (3) Neutralizing precedes and facilitates deviance; (4) Normative rules are disputable; and (5) Specific neutralization techniques are more relevant to specific violations. Ignoring these underlying assumptions could lead to a situation where we make unfounded claims about the theory or provide practitioners with harmful, rather than helpful, guidance.

View all works in NVA