Meseret Assefa Adamu

• Adamu, Meseret Assefa; Niemimaa, Marko Ilmari & Spagnoletti, Paolo (2026). Temporality of Cybersecurity Culture Amid Rapid Digital Transformation: Evidence From an Ethiopian Bank. Electronic Journal of Information Systems in Developing Countries. 92(2). doi: 10.1002/isd2.70058. Fulltekst i vitenarkiv Vis sammendrag

  Organizational reliance on emerging digital technologies that are transforming the work patterns has left organizations vulnerable to sophisticated cyber threats. Industry reports and incident cases indicate that the rapid pace of digital transformation exacerbates these issues, as organizations' cybersecurity posture must keep pace with the changing organizational and technological landscape. Prior literature suggests that fostering cybersecurity culture (CSC) is foundational for any cybersecurity effort. However, CSC tends to develop slowly and evolutionary, whereas rapid digital transformation (RDT) unfolds quickly and periodically, giving rise to temporal disparity. In this study, we adopt a case study methodology to examine how an Ethiopian bank addressed this temporal disparity and crafted strategies to align CSC with ongoing RDT. We build our analysis on a multilayer temporality model of CSC that draws on and extends Schein's organizational culture model. Our findings highlight the challenges engendered by temporal disparity and underscore the need for strategic organizational actions. The study provides a theoretical basis for fostering CSC amidst RDT and offers practical insights for developing countries, highly regulated sectors, and organizations undergoing RDT.

• Adamu, Meseret Assefa; Niemimaa, Marko Ilmari & Spagnoletti, Paolo (2025). Leadership Role in Fostering Cybersecurity Culture Amid Rapid Digital Transformation. AMCIS 2025 Proceedings. Fulltekst i vitenarkiv Vis sammendrag

  The rapid pace of digital transformation exacerbates cyber risk, thereby necessitating the development of a cybersecurity culture (CSC). However, cultural development is inherently slower than technological change, making leadership a key factor in bridging this gap. This study empirically investigates how leaders develop a CSC amid RDT, drawing on qualitative data from semi-structured interviews, archival reports, and field observations within an Ethiopian bank undergoing digital transformation. The findings show that tailored leadership strategies and targeted interventions are critical in developing a CSC. This research contributes to the IS leadership literature by highlighting that, unlike traditional law enforcement leadership's hierarchical and protocol-driven nature, cybersecurity leadership must be adaptive and responsive to the pace of organizational transformation.

• Adamu, Meseret Assefa; Spagnoletti, Paolo & Niemimaa, Marko Ilmari (2025). Fostering Organizational Cybersecurity Culture Amid Rapid Digital Transformation: A Case Study from Ethiopia. I Tursunbayeva, Aizhan; Virili, Francesco & Braccini, Alessio Maria (Red.), Technology-Driven Transformation: The Future of Work and Organizations. Springer Nature Switzerland. ISSN 9783032013958. s. 205–222. doi: 10.1007/978-3-032-01396-5_12. Fulltekst i vitenarkiv Vis sammendrag

  Digital transformation introduces significant cybersecurity challenges for organizations, with its rapid pace further complicating the development of a robust cybersecurity culture (CSC). While previous studies have focused on building, developing, and conceptualizing CSC under relatively stable conditions, they often overlook the challenges posed by rapid digital transformation (RDT) and lack detailed insights into the initiatives and key factors that promote a desirable CSC amid RDT. This study employs a qualitative research methodology, collecting data from a financial institution undergoing RDT through semi-structured interviews and archival documents. The findings provide empirical insights into the cybersecurity challenges RDT presents and identify critical factors that contribute to cultivating a desired CSC in such a dynamic context. Theoretically, this research demonstrates that organizations can develop a desired CSC through deliberate actions, such as regular training, leadership initiatives, and updating policies and guidelines, even amid rapid organizational changes. Practically, it deepens the understanding of CSC in dynamic settings and provides strategies to enhance security and address cybersecurity challenges in times of rapid transformation.

• Adamu, Meseret Assefa; Niemimaa, Marko Ilmari & Spagnoletti, Paolo (2025). Towards a Three-Tiered Framework for Fostering Organizational Cybersecurity Culture. Lecture Notes in Business Information Processing. ISSN 1865-1348. 536, s. 313–324. doi: 10.1007/978-3-031-81325-2_22. Fulltekst i vitenarkiv Vis sammendrag

  Cybersecurity is an increasing concern for organizations. Reports indi-cate that most incidents stem from human factors and, fostering a desired cyberse-curity culture (CSC) is a crucial strategy to minimize the risk. Research suggests that exploring CSC in an organizational context requires a theoretical foundation, with numerous theories offering diverse perspectives on studying CSC in vari-ous organizational contexts. Previous studies have proposed and utilized Schein’s organizational culture framework to conceptualize, analyze, and understand orga-nizational CSC. However, these studies have not addressed the dynamics of the framework’s levels for fostering a desired CSC within an organizational context. The present study addresses this gap by adapting a framework based on Schein’s organizational culture framework to use it as a foundation for fostering a desired cybersecurity culture in organizations. The adapted framework is structured into three interconnected levels (tiers): 1) Operations 2) Principles 3) Mindset. The study also explores the interplay of the adapted concepts to foster the desired CSC in an organization. The adapted framework provides a theoretical basis to explore CSC and insights for practitioners on shaping and sustaining a culture that prioritizes cybersecurity.

• Adamu, Meseret Assefa (2023). Conceptualizing and Learning to Foster Cybersecurity Culture: A Literature Review. MCIS 2023. doi: https:/aisel.aisnet.org/menacis2023/16/. Fulltekst i vitenarkiv Vis sammendrag

  The purpose of this study is to conceptualize cybersecurity culture and discuss lessons that organizations can learn from the research findings to foster an appropriate cybersecurity culture. The PRISMA method and scoping literature review were used in the study. An intensive literature search was conducted in well-known publishers and online databases. Literature was selected that dealt exclusively with cybersecurity culture. Cybersecurity culture was conceptualized based on Schein's organizational culture model and Van Niekerk & Von Solm's information security culture model. The results show that cybersecurity culture could be defined and conceptualized based on four important elements, namely competencies, behaviors, policy compliance, and practices of employees at all levels of an organization toward the cybersecurity goal of protecting digital assets from intentional cyberattacks or unintentional employee mistakes. In addition to the lessons learned from the literature, organizations could also consider the four important elements proposed in this study to foster their cybersecurity culture and improve their security posture. The main contribution of this study is to provide researchers with an understanding of the current concepts and scope of cybersecurity culture and to simplify the approaches for organizations to foster an appropriate cybersecurity culture.

Se alle arbeider i NVA

• Adamu, Meseret Assefa (2026). Temporal Dynamics of Cybersecurity Culture Amid Rapid Digital Transformation. Universitetet i Agder. ISSN 9788284273181. Fulltekst i vitenarkiv Vis sammendrag

  As organizations undergo rapid digital transformation (RDT) to drive innovation and efficiency, they increasingly face heightened cybersecurity risks. Despite substantial investments in advanced technical security controls, cyber threats continue to grow, with empirical evidence consistently showing that human factors account for the majority of successful cyberattacks. This persistence highlights a fundamental limitation of technologycentric security approaches and underscores the need to address the human and cultural dimensions of cybersecurity. In this thesis, I reconceptualize cybersecurity culture (CSC) as a temporal and context dependent phenomenon, rather than a fixed organizational trait. It argues that developing a desired CSC within RDT is inherently difficult due to a mismatch in temporality: while digital transformation advances quickly through faster technological deployment, such as AI-powered zero-trust architectures and detection and prevention systems, the CSC develops gradually through the slow shaping of values, practices, and mindsets. This temporal misalignment creates periods of increased vulnerability that cyber adversaries can exploit. Managing this temporal gap is, therefore, a strategic priority for organizational resilience. Empirically, I explore how organizations navigate and manage the temporal disparity between rapid digital change and slower cultural adaptation. Using an interpretive qualitative research approach, the study examines an Ethiopian bank (EtBank) undergoing a government-driven digital transformation under tight timelines. Primary data were collected through semistructured interviews, complemented by secondary data from organizational documents, workshops, videos, and relevant literature. This empirical inquiry explores the cybersecurity challenges that emerge during RDT and the organizational practices employed to align cultural adaptation with accelerated change. This thesis advances CSC by developing a contextually relevant, temporally informed understanding of CSC within organizations experiencing RDT. Instead of proposing a complete redefinition of CSC, the research offers a refinement that integrates organizational culture theory, multilayer temporality, and CSC development within RDT. The contributions include contextualizing CSC development approaches, advancing temporal theorization, and presenting a framework to guide CSC development in a rapidly changing organizational environment.

Se alle arbeider i NVA