Siste publikasjoner ved Institutt for informasjonssystemer

This chapter explores the integration of 360-degree Virtual Reality (VR) immersive content as a tool for facilitating ethical reflection among undergraduate students in the social educator program at University of Agder. The VR-based intervention was integrated into the second-semester course “Practice: Functional Impairment, Environmental Work, Coping, and Welfare Technology” at a critical juncture before the students’ first clinical placement. The three-stage educational intervention comprised: (1) theoretical introduction to ethical challenges, (2) 360-degree immersive video depicting an interaction scenario between a person with intellectual disabilities and a caregiver, and (3) guided group reflection using the Systematic Ethical Reflection Model (SME). A total of 54 students across nine groups participated in the intervention, with 15 students participating in focus group interviews to evaluate their experiences. This formative evaluation reveals mixed results. Students demonstrated strong emotional engagement, empathy development, and recognition of ethical tensions related to autonomy and self-determination. However, students struggled to systematically apply ethical theories without substantial facilitator prompting, and the assessment methods did not adequately capture evidence regarding communication practices or independent use of the SME framework. The chapter identifies both promising outcomes and areas requiring pedagogical refinement, discussing practical implementation challenges (cost, technical issues, preparation needs) and pedagogical limitations (theory application, framework transfer). The chapter concludes with implications for professional education programs and recommendations for integrating VR-based ethical reflection in similar contexts, emphasizing the importance of scaffolded theoretical preparation, structured reflection protocols, and longitudinal assessment of learning transfer to clinical practice.

Higher Education Institutions (HEIs) face growing pressure to navigate the intersection of technology, pedagogy, and governance within rapid digital transformation and the rise of generative AI (GenAI). This paper explores how HEIs support university teachers’ professional development for integrating GenAI into teaching practices. Guided by the research question How do higher education institutions support university teachers’ professional development for integrating generative AI into their teaching practices? We analysed internal web resources from two Norwegian HEIs to map organisational structures, stakeholders, and the nature of AI-related offerings. Findings indicate contrasting approaches at the two institutions under study, and illustrate different pathways: one mainly addressing innovation and faculty engagement, the other focusing on compliance and administrative control. These differences highlight tensions between risk management and transformative practice. For AI integration to enhance educational quality, HEIs are suggested to move beyond restrictive governance and actively foster teacher agency through structured professional development, distributed decision-making, and operational ecosystems that encourage experimentation and learning. In the paper, we thus argue that such strategies are essential for aligning technological innovation with pedagogical goals, ensuring that GenAI becomes a catalyst for meaningful educational change rather than a compliance-driven exercise.

Data governance research recognizes that formal governance acquires meaning through situated interpretation and enactment. Yet, little is known about the normative assumptions underlying actors' judgments when data governance is responsible. We address this gap by conceptualizing them as normative reference points (NRPs) that guide how responsibility is understood, assigned, and justified in governance practice. Drawing on an abductive analysis of qualitative interviews, we identify five NRPs and show how their relations constitute two modes of responsibility enactment: stabilizing and deliberating. The stabilizing mode renders responsibility actionable through concentration, routinization, and traceability, whereas the deliberating mode keeps responsibility open to reflection, stakeholder consideration, and case-sensitive judgment. We contribute threefold. First, we develop NRPs as a vocabulary for theorizing the plurality of responsibility in data governance. Second, we theorize the tension generated by the relation between the stabilizing and deliberating modes. Third, we show how data governance practices mediate this tension.

Artificial Intelligence (AI) is poised to revolutionize project-oriented organizations by driving innovation and increasing operational efficiency. Although there is substantial research in areas like automation and predictive analytics, AI’s specific application in project management is less developed. This literature review examines AI’s potential to enhance project management practices, focusing on efficiency and resource optimization. It identifies significant research gaps, particularly in implementation strategies, challenges, and the long-term benefits of AI implementation. Key findings highlight AI’s transformative role, reshaping human-technology collaboration and decision-making processes. This research underscores the necessity for strategic AI integration, addressing cultural shifts and workflow adaptations, and stresses the importance of developing expertise through employee training. By offering insights and identifying unresolved questions, this review seeks to guide future research and practical approaches in applying AI in project management

Advances in Quantitative Structure Activity Relationship (QSAR) are led by two core paradigms, (1) descriptor engineering, where complex fixed-length vectors of compounds are generated and conventional ML methods are applied to those representations and (2) graphical chemical inputs (e.g., Simplified Molecular Input Line Entry System (SMILES), 2D-graph) being provided to deep learning neural network (NN) models, which construct their own internal representations of molecules and learn iteratively over them. Here we present the Tsetlin Machine (TM)─which combines the accuracy and easy-use of existing rule-based QSAR ML methods (e.g., RF and XGBoost), the iterative learning aspect of NN algorithms and its intrinsic interpretability. The TM uses teams of finite-state automata which capture frequent patterns as propositional logic (clauses) via reinforcement learning. The benchmarking pipeline presented here demonstrates that TM-QSAR coupled with ECFP4 descriptors frequently performs better than existing rule-based QSAR methods for ROC-AUC, PRC-AUC and PPV, with a high capacity for interscaffold generalization. However, due to the binary nature of TM-QSAR, performance it is currently limited when descretised continuous descriptors are used. TM-QSAR demonstrated particularly impressive classification scores for MOR (ROC-AUC = 0.87, PRC-AUC = 0.77) and CYPA4 (ROC-AUC = 0.92, PRC-AUC = 0.63), when compared to RF and XGBoost. Using TM in combination with substructural fingerprinting descriptors allows for an interpretability suite which can be extracted directly from clauses. Here we detail molecule property maps (TM-MPM) to view atom-wise TM-QSAR bioactivity contributions for single molecules and closed-form WAC scores (Weights × Activations × Clauses) for descriptor-wise contributions to regions of predicted chemical space. These methods show strong alignment of TM-QSAR interpretations to known ligand–protein interactions of the MOR target and gives nonlinear, conditional interpretations for greater predicted bioactivity. Given this combination of accuracy, computational efficiency and interpretability, we provide a basis for TM-QSAR to be explored as a standard methodology in virtual screening toolkits.

Purpose This article systematically reviews research at the intersection of gamification and the metaverse to understand how gamified immersive environments contribute to business value. It consolidates current knowledge, proposes an integrative framework to guide research and practice, and identifies gaps that can guide scholarly inquiry in this emergent domain. Design/methodology/approach A systematic literature review (SLR) was conducted. A total of 38 relevant articles were identified through initial screening and forward–backward search. These were analyzed via concept-centric coding and synthesized into thematic clusters. The insights were used to develop a business-oriented, comprehensive framework integrating design, engagement, value and ethical considerations for responsible metaverse gamification. Findings Four thematic clusters were identified: (1) Design and Mechanics, highlighting game elements (e.g. avatars, narratives, feedback systems) that promote immersion and flow; (2) Business and Consumer Engagement, showing how gamification influences affective and cognitive engagement, loyalty and purchase intentions; (3) Business Value, demonstrating how gamified experiences generate economic, relational and strategic benefits and (4) Ethics, Policy and Societal Impact, underscoring risks including data misuse, manipulation and inequitable access. Drawing on these themes, the article introduces the “GAMIFY” framework, synthesizing these dimensions for gamification in the metaverse. Research limitations/implications The review is limited to peer-reviewed, English-language publications and excludes gray literature, yielding a focused corpus of 38 studies that reflects the emerging state of metaverse-specific gamification research. Given the predominance of consumer-facing contexts in the reviewed literature, GAMIFY's applicability across all sectors should be interpreted with these boundaries in mind. The framework offers a structured research roadmap and opens avenues for longitudinal, ethically informed and cross-industry studies that would refine and validate it across diverse metaverse ecosystems. Practical implications GAMIFY gives managers an actionable diagnostic for turning gamified metaverse engagement into sustainable business value, reframing immersive design from a set of engagement tactics into a coherent strategic architecture. By aligning goals, mechanics and metrics while pairing Fair Governance with Yield-focused evaluation, it shifts attention from surface metrics to high-impact outcomes such as customer lifetime value and skill mastery, providing a structured basis for ethical, scalable and measurable gamification in the metaverse. Originality/value This is the first systematic review to integrate insights on gamification design and business value in the context of the metaverse. The article contributes a novel framework for responsible, value-driven metaverse gamification (GAMIFY) and a future research agenda.

What is the position of gender and intersectional analysis within ISCRAM's research community, and how has it developed over time? In this paper, we conduct a systematic literature review exploring the presence of gender perspectives and intersectionality in the ISCRAM digital library from 2004 to 2025, and we outline a research agenda based on our findings. Using the theoretical frameworks of feminist technoscience studies and intersectionality studies, we have categorised papers in the digital library. The identified articles fall into four categories, ranging from studies that treat gender as one of many variables for statistical purposes to papers offering a deeper analysis grounded in gender theory and intersectionality. Our analysis highlights growing momentum within the ISCRAM community to more fully integrate gender-sensitive perspectives, potentially aided by broader inclusion of social science scholars in the conference and its network.

This study examines how situational disabilities (SDs) act as barriers to situational awareness (SA) in multi‑organisational emergency response, using empirical data from four full‑scale crisis exercises (2022–2025) in Norway. Drawing on Endsley’s SA framework and models of disability (medical/social/ICF), we combine observations, qualitative interviews and open-ended survey responses to explore how contextual factors, device design, and human stress interact to produce Situational Disabilities (SD) that degrade perception, comprehension, and projection. Findings show pronounced sensory SDs (auditory masking and reduced verbal communication), device‑induced SDs (auto‑muting of radio channels, small screens, fine‑motor requirements incompatible with gloves), and cognitive SDs (information overload, attentional tunnelling, SA-level lock‑in). SDs often amplify Endsley’s SA “demons” by creating emergent socio‑technical accessibility barriers: protective equipment, noise, extreme weather, and interface affordances frequently prevent actors from receiving or acting on critical shared information. We argue that crisis systems and Shared SA devices must be designed with situational‑disability awareness, adopting universal‑design principles, configurable audio/visual channels, and resilient interaction modalities, to strengthen shared situational awareness under real‑world stressors.

Online screening tools are recommended in well-child visits to support early detection and standardized assessment, while also facilitating meaningful dialogue and collaboration with parents. However, little is known about how public health nurses experience and handle these tools in practice. The aim of this study was to explore public health nurses’ experiences with, and handling of, online screening tools in their work practices in well-child clinics and school health services. We used observations and semi-structured interviews to capture public health nurses’ experiences and practices after integration of online screening tools. Public health nurses were observed during well-child visits, and when possible, also before and after visits to provide a broader understanding of their practice. In total, eight public health nurses were observed in connection to well-child visits with families of children aged 0–7 years. Interviews were conducted over an extended time-period, with a total of 13 public health nurses participating individually or in groups. Data was analyzed using reflexive thematic analysis of verbatim transcripts and field notes. The findings from this study illustrate how public health nurses experienced tension between structural requirements and relational values when online screening tools were implemented into their practice. The relationship with families was considered the cornerstone of their work, shaping trust, continuity, and holistic understanding. While the tools offered opportunities for structured assessment and dialogue, they also introduced uncertainty about interpretation, follow-up, and professional responsibility, often diverting time and attention away from nurturing relationships. The experienced tension between standardized procedures and relational care reflected a deeper struggle to balance professional obligations with the relational connection that public health nurses regarded as foundational to their role. These dynamics are explored through three themes: When the Structures Comes Between Us, When We Get Trapped Within the Structures, and When the Structures Supports Our Practice. To realize the potential benefits of online screening tools, integration must safeguard both structural requirements and relational needs, ensuring that structures do not come at the expense of trust, relationship, and presence.

Marketing in the metaverse is growing rapidly and so are the ethical problems that come with it. Platforms like Roblox, Meta Horizon and Decentraland collect detailed biometric and behavioral data from users as part of their marketing infrastructure, yet existing EU regulations: the EU General Data Protection Regulation (GDPR), Digital Markets Act, (DMA) and Digital Services Act (DSA) were not designed with these environments in mind. This gap leaves marketers, developers and regulators unsure of how to act. We interviewed 17 experts from three groups including technology developers, marketing professionals and legal and policy specialists to understand how metaverse marketing works in practice and where current rules fall short. Our analysis directed by Gioia methodology produced four aggregate dimensions: data privacy strains in immersive marketing, transparency and ethical gaps in immersive advertising, jurisdiction and accountability gaps and the need for adaptive regulatory frameworks. Together, these dimensions indicate that consumer protection in immersive environments requires both incremental adaptation of existing laws and the co-creation of ethics-by-design practices.

This study explores how end users perceive ethical issues in metaverse marketing, an area that existing information systems (IS) theories have not sufficiently addressed. We conducted semi-structured interviews with 16 metaverse users from Decentraland, Roblox and Meta Horizon. Using the Gioia methodology, our thematic analysis identified four key dimensions shaping user experience: gaps in privacy awareness and lack of control, problems with consent including dysfunction and fatigue, imbalances of trust and power, and concerns about transparency and fairness. Based on these findings, we make three theoretical contributions grounded in IS research. First, we introduce the concept of immersive blindness, describing how users ability to evaluate privacy trade-offs is significantly constrained in highly immersive environments. Second, we propose spatial capitalism, a conceptually distinct extension of surveillance capitalism that addresses embodied, presence-triggered data extraction in three dimensional (3D) environments; a form of data collection that is qualitatively different from two dimensional (2D) behavioral tracking and requires new theoretical tools. Third, we argue that the sociotechnical design of metaverse platforms disrupts contextual integrity in ways that existing general data protection regulation (GDPR) consent mechanisms do not fully address at the level of user experience, perceived legitimacy, or ethical adequacy even where formal legal compliance is maintained. These contributions have important implications for future IS research on privacy, platform governance and the design of ethical information systems particularly those used for marketing in the metaverse.

While the proliferation of smart home technologies and the domestic Internet of Things (IoT) bring opportunities for a high level of control over household appliances and entertainment systems, it also presents challenges, not least in terms of privacy. In this study, we explore domestic IoT users’ perceptions of privacy issues and digital risk through in-depth semistructured interviews and digital home visits with 12 adults in 10 households in Norway. Based on the results of this study, we present a framework for an updated understanding of current privacy protection behaviors and decision-making from the perspective of domestic IoT users. Our “Scales of Privacy" model provides a holistic view of the process underlying the privacy calculus framework, incorporating both perceived risks and perceived benefits of data disclosure and including neutralizing factors, such as privacy cynicism and “nothing to hide” arguments. The results show a variety of perceived sources of risk, including national entities, technology companies, hackers, and partners/family. However, we highlight a discrepancy between the understanding of risk and perceived risk of our informants, on the one hand, and their actual behavior, on the other. We examine users’ stated reasons for utilizing an IoT-connected technology despite the risk, identifying five underlying motivations. Two were intrinsically related to the frictionless user experience provided by the devices (i.e., convenience and ease of use), whereas the remaining three (i.e., inevitability, unimpeachability and indiscernibility) revealed attitudes toward privacy protection partially influenced by a sense of being overwhelmed by the friction-filled experience of setting boundaries around personal data in the current digital environment.

The ubiquitous productivity software for information-sharing and collaboration activities has been designed mainly for a sighted organisational environment. This ingrained assumption inevitably leads to normative and habitual information sharing and collaborative practices that accentuate the ‘visual’ nature of information, consequently excluding blind professionals from workplace participation. By acknowledging the interconnectedness between exclusion and inclusion as socially embedded processes and considering the entanglement between visual information representations and visual information practices, this study examines how blind and sighted professionals use digital tools to overcome the challenges of working in a predominantly visual information context. We examine email messages, office documents and PowerPoint slides as they are commonly used information objects in organisations. Our multilevel analysis pays attention to the enabling and constraining roles of representational materialities of information and scrutinises the individual actions of blind professionals, their dyadic interactions with sighted colleagues and the emerging collective actions with other sighted individuals. Drawing on our analysis, we develop a workplace inclusion framework that articulates carefully orchestrated collaborative processes between sighted and blind professionals to overcome constraints imposed by visuals. These processes reveal how ambiguity, imperfection and complexity in information representations trigger the reframing of visuals and deliberate actions of disconfirmation, enquiry and remaking of habitual ways of working with information, thereby evolving collaborative information practices, namely de-visualising, re-visualising, and co-visualising, that shape workplace inclusion.

This study investigates how developers, marketers and regulators perceive ethical and regulatory challenges in metaverse marketing. As immersive digital environments expand, they offer novel engagement opportunities while at the same time raising concerns about privacy, manipulation and platform governance. We conducted semi-structured interviews with 18 participants across these stakeholder groups and analyzed the data using thematic analysis. Results reveal role-specific differences: developers emphasize technical feasibility and the need for regulatory clarity; marketers focus on creative innovation and brand safety; regulators prioritize user protection and enforcement of legal frameworks. While all stakeholders agree that trust and safety are crucial for sustainable metaverse marketing, they diverge on data practices, responsibility allocation and the scope of regulation. By providing one of the first multi-stakeholder empirical studies in this area, our research contributes to stakeholder theory and platform governance by highlighting the importance of collaborative approaches to ensure ethically responsible and legally robust metaverse marketing ecosystems.

The General Data Protection Regulation (GDPR), yet decentralized enforcement across 27 member states creates uncertainty about actual privacy compliance. This study presents the first quantitative benchmarking of Crypto-Asset Service Provider (CASP) privacy practices in the post-MiCA context. Using a validated 14-item rubric grounded in GDPR Articles 5 to 35, MiCA Articles 60 to 65, and NIST/ISO standards, privacy policies from 27 CASPs across twelve EU jurisdictions were assessed across five weighted dimensions (Cohen's kappa >= 0.80). Results reveal fragmentation: scores range from 2.45 to 4.87 with a 1.82-point gap between the top and bottom jurisdictions. Crypto-specific provisions scored lowest (mean = 2.61), three times more variable than transparency. Compliance correlates with regulatory maturity (r = 0.682, p = 0.043, large effect) evidencing a privacy lottery for EU consumers and informing post MiCA policy.

Driven by advances in augmented reality (AR), virtual reality (VR), and artificial intelligence (AI), the metaverse has begun to reshape digital marketing while raising complex ethical challenges. We conducted a systematic literature review to analyze 50 peer-reviewed literature reviews (2019–2024) from Scopus and AISeL with a focus on digital marketing, branding, and the metaverse. We mapped objectives, themes, contribution types, publication outlets, and methodologies based on which we identified most contributions as theoretical (68%) followed by empirical (16%), methodological (12%), and opinion based (4%), while PRISMA emerged as the dominant reporting standard. Through a meta-synthesis, we identified and analyzed four core ethical dimensions: privacy, transparency, authenticity, and fairness. By integrating insights across fragmented domains, the review highlights how these ethical challenges intersect and require interdisciplinary responses that involve marketers, platform providers, policymakers, and consumers. We advance theoretical implications by linking immersive marketing to foundational perspectives such as privacy theory, media richness, self-determination, and algorithmic transparency while also outlining nine actionable implications for practice and future research. In doing so, we establish a foundation for responsible, inclusive, and sustainable digital marketing in the metaverse.

In recent years, artificial intelligence (AI) has become increasingly influential in society and in education (UNESCO, 2024). Nevertheless, previous research indicates that teacher education still faces significant challenges in developing the professional digital competence (PDC) of both teacher educators and student teachers (Kelentrić, Helland & Arstorp, 2024; Pedersen et al., 2024). A core problem has been the persistent emphasis on instrumental uses of digital technologies, with comparatively limited attention to how such technologies shape society, individual learners, and the processes through which knowledge is acquired (Aagaard et al., 2025). With the rapid emergence of AI layered on top of these developments, there is reason for concern. At present, there is limited knowledge on how teacher education institutions respond at the organisational level to the introduction of AI, and to what extent they integrate AI in meaningful and pedagogically grounded ways (Ceallaigh, T. Ó et al., 2025). This study seeks to generate deeper insight into how teacher education institutions in Norway address AI as part of their institutional and educational practices. Specifically, we ask: To what extent do institutional measures reflect a shift from an instrumental towards a more critical and society-oriented perspective on digital technologies? To explore this question, we examine how AI is framed, legitimised and operationalised within strategic documents, guidelines, and institutional initiatives, and how these overall regulations, guidelines and general institutional efforts are perceived by the institutional leadership responsible for teacher education. Based on our findings, we also discuss how these findings may relate to broader discussions concerning digital competence, professional knowledge, and epistemic change in the context of emerging technologies. The study employs a qualitative design combining document analysis with semi-structured interviews. Data will be collected from key actors across five Norwegian teacher education institutions, including deans responsible for teacher education and programme leaders or coordinators. Our analytical approach is grounded in discourse theory, using interpretative repertoires as a sensitizing concept. The material is examined through a reflexive thematic analysis (Braun & Clarke, 2021) that recognizes the situated and interpretive role of the researcher (Byrne, 2022). Through this approach, the project aims to identify similarities and differences in institutional strategies, understandings, and practices related to AI, and to assess the extent to which these reflect varying degrees of institutional digital maturity (Akbarighatar et al., 2023; Begicevic et al., 2021). This way, our study may offer an empirical contribution to understanding how higher education institutions interpret and operationalize AI based on their existing digital capacities. At the conference, we will present and discuss preliminary findings from the study.

Bildung has historically been a central educational aim in the Nordic countries (Burman, 2014; Sjöström et al., 2017), grounding education in democratic participation, ethical awareness, and the development of autonomous, socially engaged citizens. In today’s post-digital societies, where digital technologies permeate economic, political, and social life, the boundaries between humans and technologies are increasingly blurred (Knox, 2019). We collaborate with digital systems as epistemic partners (Lund & Aagaard, 2020), a dynamic intensified by the rapid diffusion of generative AI (GenAI). These developments challenge democratic education systems to critically reconsider how knowledge is produced, mediated, and valued, and also what it means to be and develop as humans. Bildung entails understanding oneself as a social and civic actor (Hegel & Elster, 1967), cultivating ethical responsibility, and contributing to democratic development (Kant & Zehbe, 1975). Yet recent decades have seen the diminishing status of Bildung in favour of qualifications, labor-market relevance, and measurable learning outcomes in Nordic curricula (Biesta, 2020; Erstad & Voogt, 2018). This shift risks narrowing education’s democratic and relational dimensions. GenAI forces a renewed reckoning with these tensions. On the one hand, GenAI destabilizes outcome-focused pedagogies by producing traditional educational artefacts, such as essays, with minimal student engagement. This underscores the need to refocus on learning processes, critical inquiry, and collaborative meaning-making. In doing so, GenAI paradoxically re-opens space for Bildung-oriented educational goals. On the other hand, GenAI also presents substantive risks to democratic Bildung. Its capacity to generate misinformation and authoritative-sounding but inaccurate content challenges students’ and citizens’ ability to navigate truth, trust, and public discourse. Established models of critical thinking, democratic deliberation, and epistemic agency therefore require re-examination in a technological landscape where information is abundant, ambiguous, and automated. Teacher education becomes crucial in addressing these democratic and pedagogical challenges. Teacher educators must navigate GenAI’s opportunities and risks while supporting student teachers in cultivating both their own Bildung and Bildung in their future pupils. Teacher educators’ understandings of educational purposes, digital technologies, and democratic responsibility shape how GenAI is integrated, or resisted, within schooling. This paper presents findings from a reflexive thematic analysis (Braun & Clarke, 2021) of semi-structured in-depth interviews (Morris, 2015) with 20 teacher educators across five Norwegian teacher education institutions. We ask: How can teacher educators promote Bildung in a world of generative AI? We explore how these educators understand Bildung today and how they perceive and address the challenges following the rise of GenAI through a discursive approach (Edley, 2001). Our aim is to contribute to a deeper understanding of how to rethink education and democratic responsibility in an AI-driven society.

Seminar June 2026 for all participants involved in the project with invited presenters.

This thesis examines how the buyers of disinformation services justify their purchase and use of artificial engagement on social media platforms. These services sell likes, followers, views, comments and other forms of engagement in order to manipulate the perceived popularity, credibility or relevance of online content. While previous research on Disinformation-as-a-Service has examined the supply-side of this ecosystem, including platform organizers and crowdworkers, the buyer perspective remains underexplored. This thesis addresses this gap in knowledge by analysing how buyers of disinformation services justify their participation in this ecosystem, and how these justifications are received by others. The study employs a qualitative two-stage research design. The first stage consists of semi-structured interviews with individuals who have real experience buying, using or reselling disinformation services. These interviews were analysed through the lens of neutralization theory, using both Sykes and Matza’s original neutralization techniques, as well as supplementary techniques identified in prior cybercrime research. The second stage consists of qualitative vignette interviews with university students, where participants responded to a scenario based on the findings of the first stage. The purpose of this stage was to examine how acceptable the justifications of the buyers were to individuals outside their group. The findings illustrate that buyers justified their behaviour through a combination of original and supplementary neutralization techniques. Denial of Victim, Denial of Injury and Denial of Responsibility were particularly relevant among the original techniques, whilst Language Sanitization, Defence of Necessity, Claim of Normalcy, Claim of Ubiquity, Appeal to Codified Rules and Claim of Relative Acceptability were significant among the supplementary techniques. The thesis also identified Platform Logic as a Means of Justification, where buyers justified their behaviour by referring to engagement metrics, recommendation algorithms, monetization thresholds and the perceived difficulty of legitimate growth. The study also contributes to the understanding of Disinformation-as-a-Service by identifying the role of resellers or shop providers, who mediate between buyers and service providers. Finally, the vignette interviews show that the buyers’ arguments were often understandable to others, but seldom fully accepted. Overall, this thesis contributes to neutralization theory and Disinformation-as-a-Service research by illustrating how demand-side actors justify acts of deception within platform environments where visibility and engagement carry social and economic value.

Kunstig intelligens (KI) er en bidragsyter til økt digitalisering i helsevesenet. KI-basert tale-til-notat-teknologi utforskes i dag for å støtte klinikere med klinisk dokumentasjon. Helseetaten i Oslo kommune gjennomfører et pilotprosjekt med et egenutviklet tale-til-notat-verktøy ved Oslo allmennlegevakt. Verktøyet lytter til pasientkonsultasjonen og genererer et strukturert utkast til et pasientjournalnotat ved hjelp av kunstig intelligens. Forskning på tale-til-notat i en legevaktkontekst er begrenset, og det er lite forskning på hvordan innføringen påvirker arbeidsprosessene i praksis. På bakgrunn av dette undersøker studien følgende problemstilling: Hvordan påvirker et egenutviklet tale-til-notat-verktøy arbeidsprosessene ved Oslo allmennlegevakt? Det teoretiske rammeverket tar utgangspunkt i et sosioteknisk perspektiv og arbeidssystemrammeverket. Problemstillingen undersøkes gjennom en kvalitativ casestudie av Helseetatens pilotprosjekt. Datagrunnlaget består av tolv informanter fordelt på tre aktørgrupper, hvor disse er ledelse, prosjektgruppe og klinikere. Ni av de semistrukturerte intervjuene gjennomførte vi selv, mens de tre siste ble gjennomført av Helseetaten. Funnene er analysert med utgangspunkt i tematisk analyse og Alters arbeidssystemrammeverk. Analysen viser at klinikerne må gjøre en omstilling fra en skriftlig til en mer verbal arbeidsmåte, noe som medfører at de må balansere mellom et språk som er forståelig for pasienten og et presist språk som passer i journalnotatet. Selv om studien ikke inkluderer pasientdata, peker funnene på at tale-til-notat kan gi pasientene bedre innsikt i grunnlaget for klinikernes vurderinger. Dette kan legge til rette for at pasientene blir en mer aktiv deltaker i egen behandling. For klinikeren er skriveprosessen en viktig del av den kliniske tenkningen. Inkludering av tale-til-notat fjerner klinikerens naturlige sted for bearbeiding av informasjon. Innholdet i journalnotatet omformes fra å reflektere klinikerens vurdering til en oppsummering av dialogen mellom kliniker og pasient. Sett gjennom arbeidssystemrammeverket tydeliggjør studien at små tekniske endringer forplanter seg i hele arbeidssystemet. Det er mer enn bare den konkrete aktiviteten teknologien prøver å endre som påvirkes, og teknologien kan derfor ikke betraktes isolert. Samspillet mellom teknologien og de resterende elementene illustrerer at innføringen av ny teknologi ikke bare kan fokusere på det tekniske. Det sosiotekniske perspektivet synliggjør viktigheten av å involvere brukerne av teknologien i utviklingsfasen for å minimere spenningen mellom brukerne og teknologien. Studien bidrar med kunnskap om hvordan tale-til-notat påvirker arbeidsprosessene i en legevaktkontekst. Arbeidssystemrammeverket viser seg å være et nyttig verktøy for å avdekke endringer som ikke er umiddelbart synlige ved innføring av ny teknologi. Nøkkelord: Sosioteknisk perspektiv, tale-til-notat, arbeidsprosesser, allmennlegevakt, kunstig intelligens, arbeidssystemrammeverket, helsesektoren

Kunstig intelligens (KI) er en bidragsyter til økt digitalisering i helsevesenet. KI-basert tale- til-notat-teknologi utforskes i dag for å støtte klinikere med klinisk dokumentasjon. Helseetaten i Oslo kommune gjennomfører et pilotprosjekt med et egenutviklet tale-til-notat- verktøy ved Oslo allmennlegevakt. Verktøyet lytter til pasientkonsultasjonen og genererer et strukturert utkast til et pasientjournalnotat ved hjelp av kunstig intelligens. Forskning på tale-til-notat i en legevaktkontekst er begrenset, og det er lite forskning på hvordan innføringen påvirker arbeidsprosessene i praksis. På bakgrunn av dette undersøker studien følgende problemstilling: Hvordan påvirker et egenutviklet tale-til-notat-verktøy arbeidsprosessene ved Oslo allmennlegevakt? Det teoretiske rammeverket tar utgangspunkt i et sosioteknisk perspektiv og arbeidssystemrammeverket. Problemstillingen undersøkes gjennom en kvalitativ casestudie av Helseetatens pilotprosjekt. Datagrunnlaget består av tolv informanter fordelt på tre aktørgrupper, hvor disse er ledelse, prosjektgruppe og klinikere. Ni av de semistrukturerte intervjuene gjennomførte vi selv, mens de tre siste ble gjennomført av Helseetaten. Funnene er analysert med utgangspunkt i tematisk analyse og Alters arbeidssystemrammeverk. Analysen viser at klinikerne må gjøre en omstilling fra en skriftlig til en mer verbal arbeidsmåte, noe som medfører at de må balansere mellom et språk som er forståelig for pasienten og et presist språk som passer i journalnotatet. Selv om studien ikke inkluderer pasientdata, peker funnene på at tale-til-notat kan gi pasientene bedre innsikt i grunnlaget for klinikernes vurderinger. Dette kan legge til rette for at pasientene blir en mer aktiv deltaker i egen behandling. For klinikeren er skriveprosessen en viktig del av den kliniske tenkningen. Inkludering av tale-til-notat fjerner klinikerens naturlige sted for bearbeiding av informasjon. Innholdet i journalnotatet omformes fra å reflektere klinikerens vurdering til en oppsummering av dialogen mellom kliniker og pasient. Sett gjennom arbeidssystemrammeverket tydeliggjør studien at små tekniske endringer forplanter seg i hele arbeidssystemet. Det er mer enn bare den konkrete aktiviteten teknologien prøver å endre som påvirkes, og teknologien kan derfor ikke betraktes isolert. Samspillet mellom teknologien og de resterende elementene illustrerer at innføringen av ny teknologi ikke bare kan fokusere på det tekniske. Det sosiotekniske perspektivet synliggjør viktigheten av å involvere brukerne av teknologien i utviklingsfasen for å minimere spenningen mellom brukerne og teknologien. Studien bidrar med kunnskap om hvordan tale-til-notat påvirker arbeidsprosessene i en legevaktkontekst. Arbeidssystemrammeverket viser seg å være et nyttig verktøy for å avdekke endringer som ikke er umiddelbart synlige ved innføring av ny teknologi. Nøkkelord: Sosioteknisk perspektiv, tale-til-notat, arbeidsprosesser, allmennlegevakt, kunstig intelligens, arbeidssystemrammeverket, helsesektoren

Denne masteroppgaven undersøker hvordan beslutningsstøtteverktøy kan bidra til bedre planlegging, samvirke og håndtering av uønskede hendelser i kommunal beredskap. Studien bygger på kvalitative intervjuer med aktører fra kommuner, Kommunesektorens organisasjon (KS), statsforvalteren, nødetater, helse og tilknyttede fagmiljøer, og benytter bruk av beslutningsstøtteverktøyet Strategyfinder som empirisk case. Analysen viser at beslutningsstøtteverktøy i liten grad forstås som erstatning for menneskelig skjønn, men mer som hjelpemidler som støtter strukturert refleksjon, felles situasjonsforståelse og mer eksplisitte beslutningsprosesser i komplekse situasjoner. Funnene indikerer at en sentral verdi hos denne type verktøy ligger i evnen til å strukturere vurderinger, synliggjøre avhengigheter og legge til rette for dialog mellom flere aktører. Dette kommer særlig til sin rett under forhold preget av usikkerhet, tidspress og ufullstendig informasjon. I diskusjonen settes funnene inn i et teoretisk rammeverk som omfatter begrenset rasjonalitet, beslutningstaking under usikkerhet og gruppeprosesser. Resultatene tyder på at beslutningsstøtteverktøy har størst effekt innen planlegging, beredskapsforberedelser, og i tidlige faser av hendelser der det fortsatt finnes et handlingsrom. De viser til mindre effekt i akutte og tidskritiske situasjoner som i større grad styres av etablerte operative rutiner og planverk. Videre viser studien at nytteverdien av beslutningsstøtteverktøy er sterkt avhengig av organisatoriske og menneskelige faktorer, herunder ledelsesforankring, kompetanse, fasilitering og godt etablerte samvirkestrukturer. Med dette bidrar oppgaven med en nyansert forståelse av beslutningsstøtteverktøy som støtte for strukturert profesjonelt skjønn i kommunal beredskap, og ikke som teknologiske løsninger som eliminerer usikkerhet eller automatiserer beslutninger. Funnene understreker betydningen av å bruke beslutningstøtte og beslutningsstøtteverktøy som en del av et bredere organisatorisk og sosialt system i kommunal beredskap.

Generative artificial intelligence (GenAI) has rapidly become part of students’ academic work, but its consequences for how students think and engage with academic knowledge remain insufficiently understood. This study examines how GenAI shapes the critical thinking processes of Information Systems master’s students during the literature review phase of thesis work. The study is based on semi-structured interviews with six master’s students in Information Systems at the University of Agder (UiA), Norway. All participants used GenAI in their academic practice. The interviews were supplemented by selected participant-provided GenAI interaction artefacts, including chat-log excerpts, screenshots, and descriptions of real GenAI conversations. The critical incident technique was used to ground participants’ accounts in concrete experiences, and the data were analysed through reflexive thematic analysis. The theoretical framework draws on critical thinking, cognitive offloading, automation bias, and trust calibration. The findings show that GenAI changes how students engage with academic sources. Several participants used GenAI before reading the original source, creating a GenAI-first reading sequence in which the student’s initial understanding was shaped by GenAI. Verification practices varied: some participants checked GenAI output systematically against primary sources, while others relied on intuition, prior understanding, or prompt revision. The study develops two analytical concepts from the data: epistemic circularity, where GenAI is used to validate the student’s own AI-shaped interpretation of a source, and the autonomy gap, the discrepancy between perceived independence from GenAI and actual cognitive or epistemic delegation. The study concludes that GenAI does not uniformly strengthen or weaken critical thinking. It functions as a cognitive scaffold when it supports engagement with difficult academic material while preserving the primary source as the final reference point. It becomes a cognitive substitute when it replaces the analytical, evaluative, or reflective work that the literature review phase is intended to develop. Keywords: GenAI, critical thinking, higher education, master’s students, literature review, cognitive offloading, epistemic circularity, autonomy gap.

This thesis investigates how AI-based tools reshape audit routines, examined from the two perspectives involved in an audit: the auditors conducting the review and the auditee organisation preparing for it. Audit routines face growing pressure from data volumes, regulatory complexity, and time constraints, and AI-based tools are increasingly introduced as part of these routines. However, limited empirical work has investigated how AI-based tools reshape the recurring routines through which audit is actually enacted across both perspectives. The study draws on organisational routine theory as its analytical lens, complemented by the addition/subtraction distinction and the three orders of effect to see where, whether and how deeply routines change as a result of AI-based tools being implemented. The thesis adopts a qualitative research approach and uses nine semi-structured interviews and two organisational documents, mapping eight routines across four lifecycle phases: orientation, preparation, execution and continuity. The findings show that AI-based tools reshape audit routines primarily through addition rather than subtraction: they enter the routines as new artifacts without replacing existing ones. The change happens mainly in the performative aspect, how the work gets done, rather than the ostensive aspect, what the routine is understood to be. Most of the changes are first-order, making tasks and activities more efficient and timesaving without transforming the work and happens unevenly across the lifecycle. Across both perspectives, AI-based tools behave as a generative, additive artifact, something audit routines draw on to get the work done, not something that redefines them.

Abstract Municipal building permit processing is a central public service in Norwegian municipalities. It involves legal assessment, professional judgement, coordination between several municipal functions, communication with applicants, and the use of multiple digital systems. Although digitalization is often expected to make public-sector case handling more efficient, building permit processing may still be affected by bottlenecks such as incomplete applications, manual data transfer, fragmented systems, coordination dependencies, unclear documentation, and regulatory interpretation. This thesis investigates how bottlenecks emerge in building permit processing in Kristiansand Municipality, and how digital and process-oriented improvements may address them. Kristiansand Municipality is used as the main empirical case, while selected interviews from Drammen, Lillesand, and Stavanger are included as additional municipal context and analytical contrast. The study applies a qualitative case study design based on eleven semi-structured interviews (nine main and two pilot) with municipal employees involved in building permit processing across four municipalities. The analysis is guided by a sociotechnical process perspective and an abductive research logic, combining concepts from digital building permit research, public-sector workflow literature, and empirical interview data. The findings show that bottlenecks are not only located at single points in the workflow. Rather, they are produced through sequences of interaction between applicants, caseworkers, digital systems, organizational routines, regulatory requirements, and coordination practices. Incomplete applications often create rework, waiting, and repeated communication. Weak interoperability and limited data reuse contribute to digital manual work, where information must be copied, checked, or transferred manually despite the use of digital systems. The findings also show that some delays are connected to necessary professional judgement, especially in cases involving old zoning plans, dispensations, unclear documentation, or competing public interests. The thesis contributes by shifting attention from digital permit systems as technical solutions to bottlenecks as sociotechnical process mechanisms in everyday municipal case handling. Rather than proposing a new general theory of public-sector digitalization, it offers a case-based analytical framing of how bottlenecks are produced and how they may be reduced through better alignment between technology, organization, regulation, applicants, and professional work. The study also offers practical improvement directions for municipal building permit processing, primarily for Kristiansand Municipality but with relevance to other municipalities facing similar mechanisms. Keywords: municipal building permit processing, bottlenecks, digitalization, sociotechnical systems, public-sector workflow, process improvement, efficiency, case study, Kristiansand Municipality.

Abstract Municipal building permit processing is a central public service in Norwegian municipalities. It involves legal assessment, professional judgement, coordination between several municipal functions, communication with applicants, and the use of multiple digital systems. Although digitalization is often expected to make public-sector case handling more efficient, building permit processing may still be affected by bottlenecks such as incomplete applications, manual data transfer, fragmented systems, coordination dependencies, unclear documentation, and regulatory interpretation. This thesis investigates how bottlenecks emerge in building permit processing in Kristiansand Municipality, and how digital and process-oriented improvements may address them. Kristiansand Municipality is used as the main empirical case, while selected interviews from Drammen, Lillesand, and Stavanger are included as additional municipal context and analytical contrast. The study applies a qualitative case study design based on eleven semi-structured interviews (nine main and two pilot) with municipal employees involved in building permit processing across four municipalities. The analysis is guided by a sociotechnical process perspective and an abductive research logic, combining concepts from digital building permit research, public-sector workflow literature, and empirical interview data. The findings show that bottlenecks are not only located at single points in the workflow. Rather, they are produced through sequences of interaction between applicants, caseworkers, digital systems, organizational routines, regulatory requirements, and coordination practices. Incomplete applications often create rework, waiting, and repeated communication. Weak interoperability and limited data reuse contribute to digital manual work, where information must be copied, checked, or transferred manually despite the use of digital systems. The findings also show that some delays are connected to necessary professional judgement, especially in cases involving old zoning plans, dispensations, unclear documentation, or competing public interests. The thesis contributes by shifting attention from digital permit systems as technical solutions to bottlenecks as sociotechnical process mechanisms in everyday municipal case handling. Rather than proposing a new general theory of public-sector digitalization, it offers a case-based analytical framing of how bottlenecks are produced and how they may be reduced through better alignment between technology, organization, regulation, applicants, and professional work. The study also offers practical improvement directions for municipal building permit processing, primarily for Kristiansand Municipality but with relevance to other municipalities facing similar mechanisms. Keywords: municipal building permit processing, bottlenecks, digitalization, sociotechnical systems, public-sector workflow, process improvement, efficiency, case study, Kristiansand Municipality.

Denne masteroppgaven undersøker hvordan vedvarende motivasjon og individuell prestasjon kan støttes i programvareutviklingsteam i norske IT-organisasjoner. Motivasjonsnedgang forstås som et strukturelt og organisatorisk designproblem, ikke bare som et individuelt problem. Studien bygger på Design Science Research, støttet av Action Design Research-logikk, og er basert på intervjuer med 15 programvareutviklere. Funnene viser at motivasjon kan svekkes gjennom uklare mål, redusert autonomi, lite tilbakemelding, manglende anerkjennelse og svake ledelsesrutiner. Oppgaven utvikler Motivation Sustainment Canvas for Software Development Teams, et kombinert modell- og metodeartefakt. Artefaktet skal hjelpe team med å oppdage tidlige tegn på motivasjonsnedgang, koble dem til organisatoriske forhold og støtte strukturert refleksjon i eksisterende teamrutiner.

Norwegian municipalities are increasingly dependent on external digital infrastructures and cloud-based ecosystems to deliver critical public services. While this dependency provides operational efficiency, integration, and access to technological capabilities that small municipalities cannot easily develop internally, it also raises concerns about vendor lock-in, reduced autonomy and cyber resilience. This thesis examines how vendor lock-in affects cyber resilience within small Norwegian municipalities. The study is based on an interpretive case study approach, using semi-structured interviews with participants working in municipalities, ICT collaborations, and related governing entities. The empirical data was analyzed through inductive thematic analysis. The research initially focused on secure technology implementation in small Norwegian municipalities, but the data revealed that participants were less concerned with implementation procedures and more concerned with dependency on a limited number of dominant technology vendors. This led to a revised research focus on vendor lock-in and municipal cyber resilience. The findings show that vendor lock-in affects cyber resilience through several mechanisms. First, small municipalities experience reduced bargaining power and strategic autonomy because the municipal supplier market is highly concentrated and dominated by a small number of vendors. Second, cloud ecosystems create systemic vulnerabilities, as core services such as identity management, communication, document storage, and administrative systems may depend on the same vendor infrastructure. Third, outsourcing and cloud adoption contribute to the erosion of internal technical competence, which can further reinforce dependency and make future exit strategies more difficult. Fourth, vendor lock-in is increasingly understood as a geopolitical vulnerability, as reliance on foreign-controlled infrastructure may expose municipal services to uncertainty during international crises. Finally, the findings show that municipal governance is often reactive, as long-term cyber resilience competes with immediate budgetary pressure and everyday welfare responsibilities. Through Resource Dependence Theory, the thesis argues that vendor lock-in should be understood not only as a technical or procurement-related issue, but as a structural dependency that shapes municipal autonomy, preparedness, and crisis response capacity. The study concludes that cloud-based vendor ecosystems may strengthen everyday operational security and efficiency, but they may simultaneously weaken long-term resilience by reducing adaptability, fallback capacity, and independent control over critical digital resources. Vendor lock-in therefore creates a central paradox for small Norwegian municipalities: the same systems that make daily operations more efficient may also make municipalities more vulnerable during major disruptions.

Informasjonssikkerhetstretthet er en sosioemosjonell tilstand der individer blir lei av og desillusjonert av sikkerhetskrav. Tidligere forskning har primært studert dens forløpere og konsekvenser når den er fullt utviklet. Det som er underutviklet er en organisert redegjørelse for hvordan sikkerhetstretthet ser ut før den krysser terskelen til åpenbar manglende overholdelse. Dette rommet utgjør den tidlige manifestasjonssonen der deteksjon og intervensjon fortsatt er meningsfullt. Denne studien adresserer dette gapet ved å utvikle et mekanismebasert konseptuelt rammeverk for å identifisere og organisere tidlige manifestasjoner av informasjonssikkerhetstretthet som indikatorer på økt tretthetsrisiko. Rammeverket er utviklet gjennom en to-trinns metodikk; en systematisk litteraturgjennomgang syntetiserte 24 fagfellevurderte studier som produserte en manifestasjonsmatrise som katalogiserte observerbare tegn på utvikling av sikkerhetstretthet på tvers av fire dreneringsmekanismer. Fra mekanismene ble fire forslag utledet som spesifiserte hvordan tidlige manifestasjoner ville se ut før full tretthet. Disse forslagene ble evaluert, utfordret og raffinert gjennom fem semistrukturerte ekspertintervjuer. Alle de fire påstandene ble støttet med forbedringer. Ressursuttømming ble utvidet til å inkludere tidspress som en ressursdimensjon ved siden av kognitiv kapasitet. Motivasjonsrekalibrering ble teoretisk beriket med selvbestemmelsesteori. Tilvenning ble bekreftet, mens vinduet for tidlig deteksjon viste seg å være smalere enn de andre mekanismene. Ugunstige livsomstendigheter ble introdusert som et tidligere umodellert forbruk. Det foreløpige rammeverket ble forbedret med fargekodede soner som representerer det tidlige manifestasjonsvinduet og et terskelbånd som erstatter den opprinnelige faste linjen for å gjenspeile individuell variabilitet. Rammeverket gir den første strukturerte redegjørelsen for sikkerhetsutmattelse som en dynamisk, individuelt variabel og terskelbasert prosess, og lokaliserer eksplisitt tidlige manifestasjoner innenfor den prosessen som observerbare risikoindikatorer. Det gir organisasjoner et teoretisk forankret grunnlag for tidligere gjenkjenning og intervensjon før atferdsmessige konsekvenser blir synlige. Å gjøre rammeverket til et validert måleinstrument er retningen for fremtidig forskning.

Denne masteroppgaven undersøker hvordan ansatte opplever at spillbaserte digitale læringssystemer påvirker deres motivasjon for arbeidsrelatert læring i organisasjoner. Spillbaserte læringssystemer brukes i økende grad for å støtte kompetanseutvikling og engasjement blant ansatte, men det finnes begrenset kunnskap om hvordan slike systemer oppleves fra et brukerperspektiv. Studien benytter en kvalitativ forskningsmetode med semistrukturerte intervjuer av ansatte som har erfaring med bruk av spillbaserte digitale læringssystemer i arbeidshverdagen.

Organizations increasingly use cybersecurity frameworks such as ISO/IEC 27001 and the NIS2 Directive to demonstrate security. This thesis asks whether formal compliance matches how prepared and organization actually is, and how Norwegian cybersecurity professionals perceive that relationship. It draws on institutional theory, particularly decoupling and symbolic compliance, to ask whether a focus on legitimacy can pull formal structures apart from technical practice. We surveyed 49 Norwegian cybersecurity professionals and tested three hypotheses linking formal compliance status to perceived resilience, the deprioritization of technical security work, and preparedness for evolving threats. Formal compliance predicted both perceived resilience and perceived effectiveness. It had no relationship with technical deprioritization, which in turn was unconnected to every other variable we measured. In short, how secure these professionals felt tracked their compliance standing and little else. The finding carries weight in Norway, where EU directives reach national law years later through the EEA Agreement. Professionals reported the most confidence in frameworks that sit behind the threats they govern. Compliance provides a useful baseline but is not the same as the technical work that decides whether an organization survives an attack, and the two are easy to confuse.

Organizations increasingly use cybersecurity frameworks such as ISO/IEC 27001 and the NIS2 Directive to demonstrate security. This thesis asks whether formal compliance matches how prepared and organization actually is, and how Norwegian cybersecurity professionals perceive that relationship. It draws on institutional theory, particularly decoupling and symbolic compliance, to ask whether a focus on legitimacy can pull formal structures apart from technical practice. We surveyed 49 Norwegian cybersecurity professionals and tested three hypotheses linking formal compliance status to perceived resilience, the deprioritization of technical security work, and preparedness for evolving threats. Formal compliance predicted both perceived resilience and perceived effectiveness. It had no relationship with technical deprioritization, which in turn was unconnected to every other variable we measured. In short, how secure these professionals felt tracked their compliance standing and little else. The finding carries weight in Norway, where EU directives reach national law years later through the EEA Agreement. Professionals reported the most confidence in frameworks that sit behind the threats they govern. Compliance provides a useful baseline but is not the same as the technical work that decides whether an organization survives an attack, and the two are easy to confuse.

Organisations increasingly respond to cybersecurity threats by implementing stricter controls, stronger authentication, and expanded security procedures. While prior research has examined cybersecurity fatigue, less is known about how excessive security demands contribute to employee circumvention and how this affects organisational security posture. Using an interpretive qualitative approach, this study analyses fifteen semi-structured interviews with employees from Norwegian workplaces through Braun and Clarke’s reflexive thematic analysis. The study applies Reeves et al.’s (2021) four-component model of cybersecurity fatigue as its primary analytical framework. The findings show that accumulated security demands can contribute to fatigue, disengagement, and security circumvention. However, the results indicate that fatigue is influenced less by strict controls alone than by insufficient organisational support, including poor communication, inadequate tooling, inconsistent leadership, and weak adaptation of controls to employee workflows. The study also finds that some forms of circumvention emerge independently of fatigue as deliberate and rational workarounds. The thesis proposes a complementary framework for understanding circumvention alongside the four-component model. It argues that effective organisational security depends not on continuously increasing controls, but on balancing security demands with sustainable organisational support.

Organizations are moving more of their critical operations to the cloud, but governing security there is harder than most existing frameworks assume. Regulation is tightening at the same time, not least through the NIS2 Directive, which leaves organizations pulled between proving they meet formal requirements and actually building security that holds up when something goes wrong. This thesis asks how organizations can build resilient cloud security governance under that pressure. It combines a structured review of fifteen studies with seven expert interviews spanning technical, governance, compliance, and leadership roles. The main finding is that effective governance depends less on how sophisticated the formal frameworks are, and more on whether they are lived out in everyday practice, backed by engaged leadership, and built on the assumption that disruption will happen. Accountability is shaped as much by culture and leadership as by formal roles. The central point is that compliance and resilience follow different logics: organizations that treat compliance as the finish line rather than the starting point risk building governance that looks solid on paper but is weaker when it is actually tested.

The convergence of Operational Technology (OT) and Information Technology (IT) systems, introduced by Industry 4.0, exposed traditionally isolated industrial processes to Cyberse- curity (CS) risks (Jbair et al., 2022; Khalil et al., 2024; Saini et al., 2026). These industrial processes have previously been assessed only for process-related or physical risks (Kure et al., 2018). To identify, evaluate, and mitigate these new risks, OT organisations rely on Risk Assessment (RA) consulting services from CS companies. The collaboration between these two domains creates multidisciplinary teams that depend on effective communication, collaboration, and the facilitation of a shared understanding of the OT systems and the RA process across domain boundaries. Existing standards, literature, and practice around the RA process are well developed and mature enough to be employed across the industry, but they fail to consider the human and social aspects of the RA. Highly specialised multidisciplinary teams face the challenges common to team-related work: communication failures, misaligned perceptions of object- ives, and role and responsibility conflicts (Jehn & Mannix, 2001; Marks et al., 2001). These challenges compound the pre-existing technical complexity of the OT domain. Standards such as ISO 31000 define a "Context Establishment" phase in which the context and scope of the RA process are established and team-based matters can be addressed, but the literature has neglected to study the significance of this phase (Cherdantseva et al., 2016). RA prac- titioners describe this phase as essential to RAs, but report that the contextual alignment established during this phase quickly diminishes. We adopted the theory of Shared Mental Models (SMMs) established by Cannon-Bowers et al. (1993), and based our understanding of it on the study conducted by Mathieu et al. (2000). Our study sought to mitigate these challenges through action research in collaboration with the CS organisation Netsecurity. Through this research process, we gained access to an OT CS RA that Netsecurity conducted for an OT organisation, and sought to investigate how shared understanding among RA participants can be established and maintained throughout the assessment. The study employed multiple data sources: we interviewed RA practitioners, collected questionnaire responses from a workshop conducted with Netsecurity and the OT organisation, and interviewed our co-researchers on their experience as RA facilitators. Our findings revealed that communication challenges were a symptom of divergent mental models, leading to misinterpretations of terminology, misaligned documentation, and time lost re-establishing contextual alignment throughout the process. We developed a framework comprising four SMMs, namely Context, System, Task, and Team. Each of these models incorporates an Expert Model, providing an evaluation dimension and a set of behavioural cues that facilitators can use to assess cognitive alignment during the RA. The framework combines conceptual grounding with concrete activities and artefacts. Netsecurity has in- corporated the framework and insights generated through the research process into their RA practice, and we argue the framework can be applied beyond this specific context.

The convergence of Operational Technology (OT) and Information Technology (IT) systems, introduced by Industry 4.0, exposed traditionally isolated industrial processes to Cybersecurity (CS) risks (Jbair et al., 2022; Khalil et al., 2024; Saini et al., 2026). These industrial processes have previously been assessed only for process-related or physical risks (Kure et al., 2018). To identify, evaluate, and mitigate these new risks, OT organisations rely on Risk Assessment (RA) consulting services from CS companies. The collaboration between these two domains creates multidisciplinary teams that depend on effective communication, collaboration, and the facilitation of a shared understanding of the OT systems and the RA process across domain boundaries. Existing standards, literature, and practice around the RA process are well developed and mature enough to be employed across the industry, but they fail to consider the human and social aspects of the RA. Highly specialised multidisciplinary teams face the challenges common to team-related work: communication failures, misaligned perceptions of objectives, and role and responsibility conflicts (Jehn & Mannix, 2001; Marks et al., 2001). These challenges compound the pre-existing technical complexity of the OT domain. Standards such as ISO 31000 define a "Context Establishment" phase in which the context and scope of the RA process are established and team-based matters can be addressed, but the literature has neglected to study the significance of this phase (Cherdantseva et al., 2016). RA practitioners describe this phase as essential to RAs, but report that the contextual alignment established during this phase quickly diminishes. We adopted the theory of Shared Mental Models (SMMs) established by Cannon-Bowers et al. (1993), and based our understanding of it on the study conducted by Mathieu et al. (2000). Our study sought to mitigate these challenges through action research in collaboration with the CS organisation Netsecurity. Through this research process, we gained access to an OT CS RA that Netsecurity conducted for an OT organisation, and sought to investigate how shared understanding among RA participants can be established and maintained throughout the assessment. The study employed multiple data sources: we interviewed RA practitioners, collected questionnaire responses from a workshop conducted with Netsecurity and the OT organisation, and interviewed our co-researchers on their experience as RA facilitators. Our findings revealed that communication challenges were a symptom of divergent mental models, leading to misinterpretations of terminology, misaligned documentation, and time lost re-establishing contextual alignment throughout the process. We developed a framework comprising four SMMs, namely Context, System, Task, and Team. Each of these models incorporates an Expert Model, providing an evaluation dimension and a set of behavioural cues that facilitators can use to assess cognitive alignment during the RA. The framework combines conceptual grounding with concrete activities and artefacts. Netsecurity has incorporated the framework and insights generated through the research process into their RA practice, and we argue the framework can be applied beyond this specific context. Keywords: Operational Technology, Industry 4.0, Cybersecurity, Risk Assessment, Communication, Shared Mental Model Theory

Denne masteroppgaven undersøker hvordan ansatte opplever at spillbaserte digitale læringssystemer påvirker deres motivasjon for arbeidsrelatert læring i organisasjoner. Spillbaserte og gamifiserte læringssystemer brukes i økende grad for å støtte kompetanseutvikling og engasjement blant ansatte, men det finnes begrenset kunnskap om hvordan slike systemer oppleves fra et brukerperspektiv. Studien benytter en kvalitativ forskningsmetode med semistrukturerte intervjuer av ansatte som har erfaring med bruk av spillbaserte digitale læringssystemer i arbeidshverdagen.

Organisations increasingly respond to cybersecurity threats by implementing stricter controls, stronger authentication, and expanded security procedures. While prior research has examined cybersecurity fatigue, less is known about how excessive security demands contribute to employee circumvention and how this affects organisational security posture. Using an interpretive qualitative approach, this study analyses fifteen semi-structured interviews with employees from Norwegian workplaces through Braun and Clarke’s reflexive thematic analysis. The study applies Reeves et al.’s (2021) four-component model of cybersecurity fatigue as its primary analytical framework. The findings show that accumulated security demands can contribute to fatigue, disengagement, and security circumvention. However, the results indicate that fatigue is influenced less by strict controls alone than by insufficient organisational support, including poor communication, inadequate tooling, inconsistent leadership, and weak adaptation of controls to employee workflows. The study also finds that some forms of circumvention emerge independently of fatigue as deliberate and rational workarounds. The thesis proposes a complementary framework for understanding circumvention alongside the four-component model. It argues that effective organisational security depends not on continuously increasing controls, but on balancing security demands with sustainable organisational support.

In industrial environments, the people who detect a cyber incident and the people who can act on it usually have different expertise. An operational technology (OT) security operation center (SOC) holds the cyber knowledge, while OT personnel hold the process knowledge. Research recognizes that these two groups must coordinate during an incident, but it says little about how that coordination works, especially when the OT-SOC is outsourced. This thesis asks how practitioners working across OT and cybersecurity describe how cyber incident information is interpreted, shared, and acted upon between an OT-SOC and OT personnel. The study is qualitative and abductive. It draws on eleven semi-structured interviews with professionals from both the cybersecurity and the operational side, and analyzes them through Transactive Memory Theory along three dimensions, specialization, credibility, and coordination, together with antecedents and outcomes. The relationship works as a differentiated transactive memory system that the OT-SOC and the customer build together over time. Neither side can handle an incident alone. Interpretation depends on locating the knowledge the other side holds. Sharing depends on credibility, which is earned through familiarity rather than assumed from SOC’s security expertise. Action runs through a coordinated process which the SOC advises and the customer decides. The thesis grounds these patterns in the outsourced OT-SOC and shows how four elements hold together as one developing system, shaped by conditions inside the customers organization.

IT professionals in modern organizations are facing an increasing volume of Information Security Policies (ISPs) that they must continuously navigate. Out of all the administrative and operational controls an IT professional encounters, a significant portion acts as hindrances that disrupt their work responsibilities. Because of these regulatory demands, they are prone to be affected by Security-Related Stress (SRS), a condition where an individual suffers from chronic cognitive exhaustion. This issue could lead to violation of ISP, causing security vulnerabilities that exposes an organization to cyber threats. This thesis investigates how SRS influence IT professionals, to add insight into how we can understand this strain to circumvent it. This is done by answering the following research questions: “How do IT professionals perceive and appraise security-related stress arising from information security policies?” and “How do IT professionals describe the emergence of problem-focused versus emotion-focused coping in response to ISP-related stressors?”. An interpretive qualitative approach was implemented to answer these questions, conducting semi-structured interviews with eight IT professionals in ISO/IEC 27001 certified organizations. This study utilized both the Challenge-Hindrance Stressor Framework (CHSF) and the Transactional Model of Stress and Coping (TMSC) as a theoretical lens, since these models captures real-time cognitive transactions and resource evaluations occurring between IT professionals and SRS. The main theoretical implication is the perceiving of SRS through a dual role lens, which explains how IT professionals intrinsically navigate ISP demands. This thesis provides an interesting concept known as automaticity, another coping response to SRS.

Generativ kunstig intelligens (KI) har på kort tid blitt et utbredt verktøy i programvareutvikling, der utviklere bruker teknologien til blant annet kodegenerering, feilsøking, testing og dokumentasjon. Samtidig utvikles feltet i et tempo som gjør det vanskelig for fagfellevurdert forskning å holde tritt med praksisen i bransjen. Det er derfor behov for empiriske studier av hvilke utfordringer utviklere faktisk møter, og hvordan de håndterer dem. Denne studien undersøker følgende forskningsspørsmål: Hvilke utfordringer står utviklingsmiljøer overfor ved bruk av generativ kunstig intelligens, og hvordan kan man overkomme dem? Studien har et kvalitativt og interpretivistisk forskningsdesign, med en pragmatisk orientering. Datamaterialet ble samlet inn gjennom ti semi-strukturerte intervjuer med utviklere, konsulenter og ledere i norske virksomheter, med erfaring fra under ett til nærmere tretti år i bransjen. Materialet ble analysert med refleksiv tematisk analyse. Funnene er organisert i tre områder. De tekniske utfordringene handler om at økt tempo ikke gir bedre kode, at både inputkvalitet og modellenes egne begrensninger påvirker resultatet, og at autonome agenter mister oversikten når systemet vokser. De organisatoriske utfordringene viser at KI hever kompetansekravet snarere enn å senke det, at omfattende bruk kan svekke og skjule kompetanse, og at manglende felles retningslinjer gjør bruken personavhengig. Innen sikkerhet og personvern trekkes datadeling og leverandøravhengighet, KI som mulig trussel, og det høye utviklingstempoet frem som sentrale utfordringer. For hvert område beskriver deltakerne strategier, der et gjennomgående prinsipp er at KI skal fungere som et støtteverktøy under menneskelig styring, som "copilot, ikke kaptein".

Generativ kunstig intelligens (KI) har på kort tid blitt et utbredt verktøy i programvareutvikling, der utviklere bruker teknologien til blant annet kodegenerering, feilsøking, testing og dokumentasjon. Samtidig utvikles feltet i et tempo som gjør det vanskelig for fagfellevurdert forskning å holde tritt med praksisen i bransjen. Det er derfor behov for empiriske studier av hvilke utfordringer utviklere faktisk møter, og hvordan de håndterer dem. Denne studien undersøker følgende forskningsspørsmål: Hvilke utfordringer står utviklingsmiljøer overfor ved bruk av generativ kunstig intelligens, og hvordan kan man overkomme dem? Studien har et kvalitativt og interpretivistisk forskningsdesign, med en pragmatisk orientering. Datamaterialet ble samlet inn gjennom ti semi-strukturerte intervjuer med utviklere, konsulenter og ledere i norske virksomheter, med erfaring fra under ett til nærmere tretti år i bransjen. Materialet ble analysert med refleksiv tematisk analyse. Funnene er organisert i tre områder. De tekniske utfordringene handler om at økt tempo ikke gir bedre kode, at både inputkvalitet og modellenes egne begrensninger påvirker resultatet, og at autonome agenter mister oversikten når systemet vokser. De organisatoriske utfordringene viser at KI hever kompetansekravet snarere enn å senke det, at omfattende bruk kan svekke og skjule kompetanse, og at manglende felles retningslinjer gjør bruken personavhengig. Innen sikkerhet og personvern trekkes datadeling og leverandøravhengighet, KI som mulig trussel, og det høye utviklingstempoet frem som sentrale utfordringer. For hvert område beskriver deltakerne strategier, der et gjennomgående prinsipp er at KI skal fungere som et støtteverktøy under menneskelig styring, som "copilot, ikke kaptein".

Organizations are moving more of their critical operations to the cloud, but governing security there is harder than most existing frameworks assume. Regulation is tightening at the same time, not least through the NIS2 Directive, which leaves organizations pulled between proving they meet formal requirements and actually building security that holds up when something goes wrong. This thesis asks how organizations can build resilient cloud security governance under that pressure. It combines a structured review of fifteen studies with seven expert interviews spanning technical, governance, compliance, and leadership roles. The main finding is that effective governance depends less on how sophisticated the formal frameworks are, and more on whether they are lived out in everyday practice, backed by engaged leadership, and built on the assumption that disruption will happen. Accountability is shaped as much by culture and leadership as by formal roles. The central point is that compliance and resilience follow different logics: organizations that treat compliance as the finish line rather than the starting point risk building governance that looks solid on paper but is weaker when it is actually tested.

The global civil aviation industry faces an urgent challenge as it transitions from legacy and unencrypted analog radio networks to secure digital communication platforms. Traditional communication and surveillance systems, including very high frequency (VHF) voice radios, the aircraft communications addressing and reporting system (ACARS), and automatic dependent surveillance-broadcast (ADS-B) protocols, operate on an inherently open architecture that lacks digital encryption, source authentication, and data integrity checks. This structural vulnerability exposes global airspace infrastructure to electronic warfare capabilities, such as signal jamming, global positioning system spoofing, and ghost target flooding. To investigate why cryptographically secure alternatives like the L-band digital aeronautical communications system (LDACS) have faced extensive deployment delays, this thesis applies the Technology-Organization-Environment (TOE) framework integrated with cognitive load theory. Utilizing a qualitative research design, primary empirical data was gathered through semi-structured interviews with active commercial pilots, flight instructors, and representatives from national and international aviation authorities, including the International Civil Aviation Organization. The empirical findings show eighteen factors across the technological, organizational, and environmental contexts that collectively determine the industry's digital transformation path. Technological constraints center heavily on radio frequency compatibility within the congested L-band spectrum, processing latency introduced by post-quantum cryptographic suites, and the security risks associated with parallel digital-analog operations. Organizationally, the transition to discrete and point-to-point digital text clearings increases pilot cognitive load and introduces visual bottlenecks during high-pressure flight phases, a friction point worsened by systemic cybersecurity training gaps and the loss of the historical party-line effect. Environmentally, while the escalating threat landscape serves as a powerful catalyst for change, implementation is stalled by infrastructure bottleneck and an investment gridlock between airlines and airport operators. To address these challenges, this study proposes an aviation-specific adoption framework and a maturity estimate model to contribute a path for implementation that prioritizes an architecture that protects global transportation networks without compromising flight safety.

Participating in public bids is complex and resource intensive. Vendors must navigate strict regulations and demanding documentation requirements in a competitive market. The thesis explores how the vendor can reduce time consumption and improve information flow in the outsourcing process with information systems support and task distribution. This thesis presents the Outsourcing Knowledge Hub as a proposed solution to the identified challenges. The artefact consists of two elements: a dashboard and an AI prompt guide. Following a Design Science Research approach and drawing on frameworks on information flow and supply chain integration, three rounds of data collection were conducted. A total of 19 participants were engaged in semi-structured interviews and focus groups. The last round evaluated the feasibility of the artefact, as well as if it has the potential to solve the solution requirements. The findings are not only relevant for the case organization, but also for organizations in similar contexts. The artefact has potential to address challenges regarding time consumption and information flow by structuring existing organizational information and laying the grounds for AI-support. Keywords: Design Science Research, Public Procurement, Outsourcing, Information Flow, Task Distribution, Decision Support, Intelligence Augmentation

IT professionals in modern organizations are facing an increasing volume of Information Security Policies (ISPs) that they must continuously navigate. Out of all the administrative and operational controls an IT professional encounters, a significant portion acts as hindrances that disrupt their work responsibilities. Because of these regulatory demands, they are prone to be affected by Security-Related Stress (SRS), a condition where an individual suffers from chronic cognitive exhaustion. This issue could lead to violation of ISP, causing security vulnerabilities that exposes an organization to cyber threats. This thesis investigates how SRS influence IT professionals, to add insight into how we can understand this strain to circumvent it. This is done by answering the following research questions: “How do IT professionals perceive and appraise security-related stress arising from information security policies?” and “How do IT professionals describe the emergence of problem-focused versus emotion-focused coping in response to ISP-related stressors?”. An interpretive qualitative approach was implemented to answer these questions, conducting semi-structured interviews with eight IT professionals in ISO/IEC 27001 certified organizations. This study utilized both the Challenge-Hindrance Stressor Framework (CHSF) and the Transactional Model of Stress and Coping (TMSC) as a theoretical lens, since these models captures real-time cognitive transactions and resource evaluations occurring between IT professionals and SRS. The main theoretical implication is the perceiving of SRS through a dual role lens, which explains how IT professionals intrinsically navigate ISP demands. This thesis provides an interesting concept known as automaticity, another coping response to SRS.

Digital technologies are evolving rapidly and are affecting how public services are organised and delivered. In Norway, municipalities are expected to adopt digital technologies to improve efficiency, service quality, and citizen-oriented services. However, municipalities differ significantly in size, resources, organisational capacity, and digital maturity, which influence how technology adoption is addressed. This thesis is guided by the following research question: “How do Norwegian municipalities construct and address technology adoption in their digitalisation strategies?” To answer this question, the study conducts a qualitative document analysis of strategy and planning documents from three municipalities: Oslo, Gjøvik, and Lom. These municipalities were selected to represent different municipal contexts, a large urban municipality, a medium sized municipality, and a small rural municipality. The analysis is based on a narrative analysis, supported by the Technology-Organisation-Environment (TOE) framework as a theoretical lens. The findings show that technology adoption is constructed differently across the three municipalities. Oslo frames digitalisation around data, collaboration, and smarter service delivery, reflecting the complexity of a large municipal organisation. Gjøvik constructs digitalisation as a response to external pressure. Lom constructs digitalisation as a response to societal challenges, with the necessity of an inter-municipal collaboration to sustain service delivery. The thesis concludes that municipal digitalisation strategies do more than describe technological initiatives. They also legitimize why digitalisation is necessary, how it should be organised, and what it is expected to achieve. The study contributes by showing that technology adoption in municipalities is highly context dependent, and digitalisation strategies should be adapted to local municipal conditions, regardless of national and sectoral pressures.

As cyber threats continue to grow in sophistication and scale, organisations must increasingly adopt proactive approaches to cybersecurity. Open Source Intelligence (OSINT) has emerged as a valuable capability for identifying threats, monitoring the cyber landscape, and supporting informed security decision-making through the collection and analysis of publicly available information. Despite the growing body of research on OSINT tools, technologies and applications, limited attention has been given to how organisations can systematically assess and improve their OSINT capabilities. This thesis investigates the role of OSINT in proactive cybersecurity and addresses the research question: How can Norwegian organisations assess their OSINT practices for cybersecurity to maintain continuous improvements? To answer this question, a Design Science Research (DSR) approach was employed to develop an OSINT Maturity Model. A systematic literature review was conducted to identify existing knowledge regarding OSINT processes, applications, challenges, and organisational adoption. Based on these findings from the literature, an initial OSINT Maturity Model was developed following established maturity model development principles. The model was subsequently evaluated and refined through eight semi-structured interviews with cybersecurity practitioners from Norwegian organisations. The findings indicate that OSINT is widely recognised as a valuable source of cyber threat intelligence and supports a broad range of cybersecurity activities, including threat hunting, incident response, vulnerability management, penetration testing, and strategic decision-making. However, organisations demonstrate varying levels of maturity in their utilisation of OSINT. Key factors influencing maturity include governance and strategy, process formalisation, tool adoption and automation, integration with existing security functions, analyst competence, and the ability to address challenges related to information quality, legal and ethical considerations, and information overload. The primary contribution of this thesis is the development of an OSINT Maturity Model designed to help organisations assess their current capabilities and identify areas for improvement. The model provides a structured framework for advancing OSINT practices in organisations and strengthening proactive cybersecurity. Furthermore, the study contributes to the limited academic literature on organisational OSINT maturity and offers practical guidance for organisations seeking to enhance their intelligence-driven cybersecurity capabilities.

Norsk sammendrag under. As developers produce software, they need to be productive enough to where software is being released at an acceptable rate. At the same time, cybersecurity must be considered to ensure that the finalized software does not have vulnerabilities and potential for compromise. These two contradicting elements shape software development through how they are balanced, which we investigate through insights of effects on developers, and consequences of those effects for the finalized software. To conduct this study, we followed a qualitative approach and carried out a comparative case study of two IT-consultant companies of different sizes. We interviewed developers, managers and security-oriented architects from both companies, and compared themes that inductively emerged through our interpretation of their insights. We frame our key findings through a theoretical lens of organizational paradox to discuss the different phenomena at play. We find that the effects on developers depend on how successful different kinds of balancing approaches are in terms of their reception. Balancing approaches typically depend on the business goals of either companies themselves or their customers. Developers can be frustrated by balances that excessively lean into security or feel directionless in their security goals. These kinds may consequently cause slower and more costly development. On the other hand, if a balance is well-received by developers, it can make them more positive towards security. Additionally, frameworks that handle security for developers may encourage productivity through perceptions of feeling comfortable in experimenting with software. By highlighting these sorts of findings, which reflect both positive and negative aspects, we aim to make stakeholders of software development more aware of how different balances determine how developers are affected and what the potential consequences for the finalized software could be. Norsk sammendrag: Når utviklere lager programvare, må de være produktive nok til at programvaren blir lansert i et akseptabelt tempo. Samtidig må cybersikkerhet vurderes for å sikre at den ferdigstilte programvaren ikke har sårbarheter og potensial for kompromittering. Disse to motstridende elementene former programvareutvikling gjennom hvordan de balanseres, noe vi undersøker gjennom innsikt i effektene på utviklere, og konsekvensene av disse effektene for den ferdigstilte programvaren. For å gjennomføre denne studien fulgte vi en kvalitativ tilnærming og gjennomførte en sammenlignende casestudie av to IT-konsulentselskaper av ulik størrelse. Vi intervjuet utviklere, ledere og sikkerhetsorienterte arkitekter fra begge selskapene, og sammenlignet temaer som induktivt kom frem gjennom vår tolkning av deres innsikter. Vi rammer inn våre hovedfunn gjennom et teoretisk perspektiv av organisatorisk paradoks for å diskutere de ulike fenomenene som er i spill. Vi finner at effektene på utviklere avhenger av hvor vellykkede ulike typer balanseringsmetoder er når det gjelder mottakelsen. Balanseringsmetoder avhenger vanligvis av forretningsmålene til enten selskapene selv eller deres kunder. Utviklere kan være frustrert over balanser som lener seg altfor mye mot sikkerhet eller føles retningsløse i sine sikkerhetsmål. Disse typene kan følgelig føre til langsommere og dyrere utvikling. På den andre siden, hvis en balanse blir godt mottatt av utviklere, kan det gjøre dem mer positive til sikkerhet. I tillegg kan rammeverk som håndterer sikkerhet for utviklere oppmuntre produktivitet gjennom oppfatninger av å føle seg komfortabel med å eksperimentere med programvare. Ved å fremheve slike funn, som reflekterer både positive og negative sider, ønsker vi å gjøre interessenter i programvareutvikling mer bevisste på hvordan ulike balanser avgjør hvordan utviklere påvirkes og hvilke potensielle konsekvenser det kan ha for den ferdige programvaren.

Norsk sammendrag under. As developers produce software, they need to be productive enough to where software is being released at an acceptable rate. At the same time, cybersecurity must be considered to ensure that the finalized software does not have vulnerabilities and potential for compromise. These two contradicting elements shape software development through how they are balanced, which we investigate through insights of effects on developers, and consequences of those effects for the finalized software. To conduct this study, we followed a qualitative approach and carried out a comparative case study of two IT-consultant companies of different sizes. We interviewed developers, managers and security-oriented architects from both companies, and compared themes that inductively emerged through our interpretation of their insights. We frame our key findings through a theoretical lens of organizational paradox to discuss the different phenomena at play. We find that the effects on developers depend on how successful different kinds of balancing approaches are in terms of their reception. Balancing approaches typically depend on the business goals of either companies themselves or their customers. Developers can be frustrated by balances that excessively lean into security or feel directionless in their security goals. These kinds may consequently cause slower and more costly development. On the other hand, if a balance is well-received by developers, it can make them more positive towards security. Additionally, frameworks that handle security for developers may encourage productivity through perceptions of feeling comfortable in experimenting with software. By highlighting these sorts of findings, which reflect both positive and negative aspects, we aim to make stakeholders of software development more aware of how different balances determine how developers are affected and what the potential consequences for the finalized software could be. Norsk sammendrag: Når utviklere lager programvare, må de være produktive nok til at programvaren blir lansert i et akseptabelt tempo. Samtidig må cybersikkerhet vurderes for å sikre at den ferdigstilte programvaren ikke har sårbarheter og potensial for kompromittering. Disse to motstridende elementene former programvareutvikling gjennom hvordan de balanseres, noe vi undersøker gjennom innsikt i effektene på utviklere, og konsekvensene av disse effektene for den ferdigstilte programvaren. For å gjennomføre denne studien fulgte vi en kvalitativ tilnærming og gjennomførte en sammenlignende casestudie av to IT-konsulentselskaper av ulik størrelse. Vi intervjuet utviklere, ledere og sikkerhetsorienterte arkitekter fra begge selskapene, og sammenlignet temaer som induktivt kom frem gjennom vår tolkning av deres innsikter. Vi rammer inn våre hovedfunn gjennom et teoretisk perspektiv av organisatorisk paradoks for å diskutere de ulike fenomenene som er i spill. Vi finner at effektene på utviklere avhenger av hvor vellykkede ulike typer balanseringsmetoder er når det gjelder mottakelsen. Balanseringsmetoder avhenger vanligvis av forretningsmålene til enten selskapene selv eller deres kunder. Utviklere kan være frustrert over balanser som lener seg altfor mye mot sikkerhet eller føles retningsløse i sine sikkerhetsmål. Disse typene kan følgelig føre til langsommere og dyrere utvikling. På den andre siden, hvis en balanse blir godt mottatt av utviklere, kan det gjøre dem mer positive til sikkerhet. I tillegg kan rammeverk som håndterer sikkerhet for utviklere oppmuntre produktivitet gjennom oppfatninger av å føle seg komfortabel med å eksperimentere med programvare. Ved å fremheve slike funn, som reflekterer både positive og negative sider, ønsker vi å gjøre interessenter i programvareutvikling mer bevisste på hvordan ulike balanser avgjør hvordan utviklere påvirkes og hvilke potensielle konsekvenser det kan ha for den ferdige programvaren.

Many objects that were once “offline” are now connected to the internet, introducing cybersecurity risks that extend beyond the IT function. This thesis uses data from seven semi-structured interviews with procurement managers, procurement advisors, and IT managers in Norwegian municipalities and county municipalities. The analysis follows an abductive qualitative approach using an integrated framework drawing on information asymmetry, principal–agent theory, and institutional theory, with coping mechanisms as procurers’ responses and Knightian uncertainty as a boundary condition. The findings show that public procurers assess cybersecurity under persistent information asymmetry, where formal signals provide weak indicators of security quality and verification is limited. Institutional rules constrain action, while also shaping how information can be used, and procurers respond through mechanisms to reduce informational, relational, and institutional constraints within legal limits. A residual category of risk nevertheless remains, partly in the form of irreducible uncertainty, and must be accepted in procurement decision-making. The thesis contributes an integrated framework showing how informational, relational, and institutional mechanisms interact as a self-reinforcing decision environment rather than independent constraints. It further suggests that the institutional framework can directly generate information asymmetry by preventing procurers from acting on knowledge they already hold.

Many objects that were once “offline” are now connected to the internet, introducing cybersecurity risks that extend beyond the IT function. This thesis uses data from seven semi-structured interviews with procurement managers, procurement advisors, and IT managers in Norwegian municipalities and county municipalities. The analysis follows an abductive qualitative approach using an integrated framework drawing on information asymmetry, principal–agent theory, and institutional theory, with coping mechanisms as procurers’ responses and Knightian uncertainty as a boundary condition. The findings show that public procurers assess cybersecurity under persistent information asymmetry, where formal signals provide weak indicators of security quality and verification is limited. Institutional rules constrain action, while also shaping how information can be used, and procurers respond through mechanisms to reduce informational, relational, and institutional constraints within legal limits. A residual category of risk nevertheless remains, partly in the form of irreducible uncertainty, and must be accepted in procurement decision-making. The thesis contributes an integrated framework showing how informational, relational, and institutional mechanisms interact as a self-reinforcing decision environment rather than independent constraints. It further suggests that the institutional framework can directly generate information asymmetry by preventing procurers from acting on knowledge they already hold.

Introduction: In 2015 every member of the United Nations adopted the 17 integrated sustainability development goals (SDGs). Technology is considered an important resource in regards to the SDGs. However, technology and sustainability has to be balanced to not introduce new sustainability challenges. In efforts to regulate our sustainability risks, new directives have been enacted, namely the Corporate Sustainability Reporting Directive (CSRD). This is crucial as new evidence from the Norway government disclose the environmental impact of digital infrastructure. As of 2024, digital infrastructure produced 1.1 Million tonnes of CO2 emission. Therefore, this research delves into prior research on digital infrastructure and sustainability to further investigate this dilemma. Theoretical background: For the theoretical concepts we introduce digital sustainability and digital infrastructure. This led to our understanding of the topic and the different factors included. Further, in our literature review, digital technologies (AI, Cloud, IoT, etc.) were suggested to support sustainability through e.g decisions making, resource reduction and optimization. However, the literature currently seems to indicate that digital technologies also further expand our digital infrastructure and could possibly result in increased environmental impact. Because this causes a paradox in sustainability we ask the research question: How do organizations frame digital infrastructure decisions as sustainable decisions in organizational documents? Research approach and method: To conduct the research on how large Norwegian IT organizations frame digital infrastructure decisions as sustainable decisions we applied a qualitative approach with a narrative analysis. Discussion: We discuss the findings from the organizational documents in relation to the literature. First we argue how digital infrastructure is posed as a sustainability solution, whether cloud services are sustainable and how energy efficiency is framed in the literature contra findings. Further, we discuss how and if AI is framed as an enabler for sustainability. Then we discuss how circular economy is framed and the actions that are taken for achieving a circular economy. Lastly, we discuss how sustainability is framed through different roles of responsibility. Conclusion: This research found that digital infrastructure is framed sustainable mainly in four different narratives, which is deeply dependent on context.

Introduction: In 2015 every member of the United Nations adopted the 17 integrated sustainability development goals (SDGs). Technology is considered an important resource in regards to the SDGs. However, technology and sustainability has to be balanced to not introduce new sustainability challenges. In efforts to regulate our sustainability risks, new directives have been enacted, namely the Corporate Sustainability Reporting Directive (CSRD). This is crucial as new evidence from the Norway government disclose the environmental impact of digital infrastructure. As of 2024, digital infrastructure produced 1.1 Million tonnes of CO2 emission. Therefore, this research delves into prior research on digital infrastructure and sustainability to further investigate this dilemma. Theoretical background: For the theoretical concepts we introduce digital sustainability and digital infrastructure. This led to our understanding of the topic and the different factors included. Further, in our literature review, digital technologies (AI, Cloud, IoT, etc.) were suggested to support sustainability through e.g decisions making, resource reduction and optimization. However, the literature currently seems to indicate that digital technologies also further expand our digital infrastructure and could possibly result in increased environmental impact. Because this causes a paradox in sustainability we ask the research question: How do organizations frame digital infrastructure decisions as sustainable decisions in organizational documents? Research approach and method: To conduct the research on how large Norwegian IT organizations frame digital infrastructure decisions as sustainable decisions we applied a qualitative approach with a narrative analysis. Discussion: We discuss the findings from the organizational documents in relation to the literature. First we argue how digital infrastructure is posed as a sustainability solution, whether cloud services are sustainable and how energy efficiency is framed in the literature contra findings. Further, we discuss how and if AI is framed as an enabler for sustainability. Then we discuss how circular economy is framed and the actions that are taken for achieving a circular economy. Lastly, we discuss how sustainability is framed through different roles of responsibility. Conclusion: This research found that digital infrastructure is framed sustainable mainly in four different narratives, which is deeply dependent on context.

Digital transformation has become one of the defining organizational challenges of the contemporary era, yet the gap between what these initiatives promise and what they deliver persists across industries. While both leadership and employee behavior have been studied in this context, the mechanisms linking the two remain fragmented across the information systems literature. A systematic literature review of 22 empirical studies drawn from nine leading information systems journals was conducted. A conceptual framework organizing leadership approaches, cognitive, motivational, and structural mechanisms, employee behavior, and project outcomes guided the analysis. Studies were identified through structured database searching and backward searching, screened against predefined criteria, and coded systematically. The findings show that leadership operates through three interacting mechanisms rather than through direct behavioral control. Cognitively, leadership shapes how employees interpret change and perceive organizational demands, determining whether they engage constructively or retreat toward self-protection. Motivationally, different leadership approaches activate distinct goal orientations and self-efficacy beliefs, producing behavioral patterns ranging from exploratory system use to avoidance. Structurally, informal peer networks consistently outperform formal support structures in building competence and sustaining engagement. A consistent asymmetry runs across all three mechanisms: constraining leadership conditions suppress constructive behavior more reliably than enabling conditions generate it. The mechanisms also function as mutually constitutive rather than independent pathways, meaning single-level interventions underestimate what deeper engagement requires. Implementation success and transformation success are not the same thing, and the gap between utilization and realized value may be partly self-concealing in ways standard metrics cannot detect. Theoretically, the thesis contributes an integrated account of how leadership influence operates through interacting and mutually constitutive mechanisms, revealing an asymmetry between constraining and enabling conditions that helps explain why the gap between transformation intention and realized value persists despite continued organizational investment. For practice, the findings suggest that the governance frameworks and evaluation metrics most organizations bring to digital transformation may be poorly calibrated to detect whether deeper value realization is being reached. Sustained leadership attention beyond implementation is a condition that deserves more attention than implementation practice typically affords it.

This thesis investigates how AI-based tools reshape audit routines, examined from the two perspectives involved in an audit: the auditors conducting the review and the auditee organisation preparing for it. Audit routines face growing pressure from data volumes, regulatory complexity, and time constraints, and AI-based tools are increasingly introduced as part of these routines. However, limited empirical work has investigated how AI-based tools reshape the recurring routines through which audit is actually enacted across both perspectives. The study draws on organisational routine theory as its analytical lens, complemented by the addition/subtraction distinction and the three orders of effect to see where, whether and how deeply routines change as a result of AI-based tools being implemented. The thesis adopts a qualitative research approach and uses nine semi-structured interviews and two organisational documents, mapping eight routines across four lifecycle phases: orientation, preparation, execution and continuity. The findings show that AI-based tools reshape audit routines primarily through addition rather than subtraction: they enter the routines as new artifacts without replacing existing ones. The change happens mainly in the performative aspect, how the work gets done, rather than the ostensive aspect, what the routine is understood to be. Most of the changes are first-order, making tasks and activities more efficient and timesaving without transforming the work and happens unevenly across the lifecycle. Across both perspectives, AI-based tools behave as a generative, additive artifact, something audit routines draw on to get the work done, not something that redefines them.

With increasing digitalization efforts in organizations, two previously largely isolated environments are becoming more interconnected.The need for more production data from operational environments in Operational Technology (OT) has resulted in the increased adoption of modern technologies from Information Technology (IT) to maximize efficiency, lower costs and enhance decision making. This phenomenon is commonly known as IT/OT convergence. As the interconnectivity increases, cybersecurity risks that were once specific to one domain are now extending into both domains, increasing the attack surface. As systems are becoming more interconnected between IT and OT, the need for a strong cybersecurity culture between the two domains becomes more important. The thesis focuses on the cybersecurity risks that could be present when two cultures with vastly different ideas of priorities, work practices, technological understanding meet together to collaborate in the defence against modern cybersecurity threats. The thesis investigates the needs and cybersecurity risks associated with IT/OT convergence, as well as how the cybersecurity culture is affected. At the same time, the thesis explores how organizations can strengthen the cybersecurity culture between IT and OT today. This is done by answering the following research questions: “What are the organisational needs and cybersecurity risks associated with IT/OT convergence?”, “What cultural differences between IT and OT environments affect the cybersecurity culture?”, “How can the cybersecurity culture among IT and OT environments be strengthened?”. The thesis has conducted a systematic literature review and a multiple case study with 11 semi-structured interviews with professionals within IT and OT domain from seven Norwegian and International organisations to answer the research questions. By adopting an extended socio technical systems framework, each factor that was discovered in empirical findings, were mapped to its respective dimension. We identified 27 factors in total that have an influence on cybersecurity in IT/OT convergence. The relationships between each dimension are described to address how different dimensions are related to each other in the effort to address cybersecurity culture and risks during IT/OT convergence. Through the analysis of literature and empirical data, the study provides implications that were discovered throughout the study and future directions for researchers and organisations on the convergence of IT and OT. We hope that the study can help raise awareness of the cybersecurity risks in IT/OT convergence by providing insights from the literature and participants that have experienced increased interconnectivity between IT and OT.

This Master’s thesis aims to understand how software developer employees perceive the impact of using Generative Artificial Intelligence (GenAI), which has become increasingly adopted by organizations. It examines how the implementation of generative tools influences software developers’ ability to maintain organizational security policies. Given the rise of GenAI and the associated information security policy challenges, this study addresses the following research question: How do software developers perceive and comply with organizational information security policies when using Generative AI tools? Software developers interact with GenAI tools in their work, from daily to weekly use. In many modern development environments, GenAI tools are increasingly used to support tasks such as code generation, debugging, and documentation. Since AI tools can assist with complex technical tasks, they’re also likely to influence how developers interact with and approach information security policies when integrating GenAI into the organization. This makes software developers a particularly interesting and highly relevant group to examine in the context of the interaction between GenAI usage and information security policy compliance. To address the research question effectively, this study employs a quantitative research design and a survey-based methodology, applying various constructs from the neutralization theory to examine how employees justify compliance and non-compliance with security policies. The data sample specifically targets software developers from various IT companies in software development and related technical roles, as these groups are more likely to interact with GenAI tools in their daily work. Therefore, it provides a more relevant empirical context for the study than targeting generic employees. The survey enables the study to collect data on software developers’ perceptions, attitudes, and behaviors regarding the use of GenAI tools within the organizational environment. Applying the established constructs of Neutralization Theory examines how software developers rationalize their actions when security policies potentially conflict with use of GenAI. The findings provide an overview of software developers' perceptions of GenAI tools and their relationship to security policies and policy compliance. Seeking to determine whether software developers’ neutralization theory techniques are applicable when interacting with GenAI tools, such as justifying policy violations based on perceived gains, pressure, or the belief that the shared information does not pose a security risk. The study contributes to existing body of knowledge research on GenAI in organizational settings by offering an software developers’ perspective that is directly relevant to organizational security policy compliance. These insights may help organizations design more effective security policies, initiatives, and governance frameworks that acknowledge the realities of GenAI use in modern software development.

In industrial environments, the people who detect a cyber incident and the people who can act on it usually have different expertise. An operational technology (OT) security operation center (SOC) holds the cyber knowledge, while OT personnel hold the process knowledge. Research recognizes that these two groups must coordinate during an incident, but it says little about how that coordination works, especially when the OT-SOC is outsourced. This thesis asks how practitioners working across OT and cybersecurity describe how cyber incident information is interpreted, shared, and acted upon between an OT-SOC and OT personnel. The study is qualitative and abductive. It draws on eleven semi-structured interviews with professionals from both the cybersecurity and the operational side, and analyzes them through Transactive Memory Theory along three dimensions, specialization, credibility, and coordination, together with antecedents and outcomes. The relationship works as a differentiated transactive memory system that the OT-SOC and the customer build together over time. Neither side can handle an incident alone. Interpretation depends on locating the knowledge the other side holds. Sharing depends on credibility, which is earned through familiarity rather than assumed from SOC’s security expertise. Action runs through a coordinated process which the SOC advises and the customer decides. The thesis grounds these patterns in the outsourced OT-SOC and shows how four elements hold together as one developing system, shaped by conditions inside the customers organization.

With increasing digitalization efforts in organizations, two previously largely isolated environments are becoming more interconnected. The need for more production data from operational environments in Operational Technology (OT) has resulted in the increased adoption of modern technologies from Information Technology (IT) to maximize efficiency, lower costs and enhance decision making. This phenomenon is commonly known as IT/OT convergence. As the interconnectivity increases, cybersecurity risks that were once specific to one domain are now extending into both domains, increasing the attack surface. As systems are becoming more interconnected between IT and OT, the need for a strong cybersecurity culture between the two domains becomes more important. The thesis focuses on the cybersecurity risks that could be present when two cultures with vastly different ideas of priorities, work practices, technological understanding meet together to collaborate in the defence against modern cybersecurity threats. The thesis investigates the needs and cybersecurity risks associated with IT/OT convergence, as well as how the cybersecurity culture is affected. At the same time, the thesis explores how organizations can strengthen the cybersecurity culture between IT and OT today. This is done by answering the following research questions: “What are the organisational needs and cybersecurity risks associated with IT/OT convergence?”, “What cultural differences between IT and OT environments affect the cybersecurity culture?”, “How can the cybersecurity culture among IT and OT environments be strengthened?”. The thesis has conducted a systematic literature review and a multiple case study with 11 semi-structured interviews with professionals within IT and OT domain from seven Norwegian and International organisations to answer the research questions. By adopting an extended socio technical systems framework, each factor that was discovered in empirical findings, were mapped to its respective dimension. We identified 27 factors in total that have an influence on cybersecurity in IT/OT convergence. The relationships between each dimension are described to address how different dimensions are related to each other in the effort to address cybersecurity culture and risks during IT/OT convergence. Through the analysis of literature and empirical data, the study provides implications that were discovered throughout the study and future directions for researchers and organisations on the convergence of IT and OT. We hope that the study can help raise awareness of the cybersecurity risks in IT/OT convergence by providing insights from the literature and participants that have experienced increased interconnectivity between IT and OT.

This thesis examines how organisations govern cloud and hybrid cloud environments after migration. Using a qualitative multi-case study across seven organisations, the study explores how decision rights, accountability, and cost control are managed once cloud services become part of daily operations. The findings show that post-migration governance is more demanding than organisations typically expect. Decision rights become distributed, accountability is harder to trace, and costs accumulate without clear ownership. Organisations that managed this well treated governance as ongoing work rather than something settled during migration. The thesis argues that migration is not the end of a governance project. It is where the real governance work begins.

Background - Although the General Data Protection Regulation has been in force since 2018, incomplete data deletion remains a recurring compliance gap in large and complex organizations. The conditions that allow such gaps to persist after an initial implementation programme are not well understood in the information systems literature. Aim - This study aims to identify the organizational conditions associated with the persistence of incomplete data deletion in a case organization several years after its GDPR implementation deadline. Research question - Why do incomplete data retention and deletion practices persist under the GDPR in a large organization that possesses the resources, knowledge, and strategic intent to address them? Method - A qualitative single-case study was conducted in a large multinational organization in a regulated sector. Six semi-structured interviews with operational, risk-governance, and strategic participants were analyzed inductively through the Gioia methodology, with parallel failure-side and success-side coding. Findings were discussed in relation to the Institutional Cybersecurity Regulations Model (Proudfoot, Cram & Madnick, 2025). Findings - The analysis identified five conditions associated with the persistence: a legal interpretive bottleneck, knowledge discontinuity, governance cascade discontinuity, insufficient documentation standards, and a registration disincentive. The interpretive bottleneck appears as the central condition on the operational evidence, with the four others contributing to the persistence in their own ways. Conclusion - The persistence of incomplete data retention and deletion practices in this case is shaped by the complexity of the regulatory translation work GDPR requires in a large multi-market organization. Four other conditions contribute to keeping the interpretive bottleneck from being resolved. The findings are bounded by the operational vantage point of the data and the single-case design.

Security Operation Centres (SOCs) face increasing pressure to integrate Artificial Intelligence (AI) into their workflows to address persistent challenges such as alert fatigue, staffing shortages and an expanding threat landscape. While the technical and operational benefits of AI in SOCs have been well documented, considerably less is known about how AI affects individual analysts. This thesis investigates how analysts use AI and how this affects their cognitive engagement. This is done by answering the following research questions: “How do security analysts use AI in SOC” ,“ How does the use of AI affect the mindful conduction of SOC analysts?” and finally “What are the consequences of using AI in SOC?”. We conducted semi-structured interviews with 10 security analysts working in SOCs and used the concept of mindful conduction as a theoretical lens. Mindful conduction captures how analysts navigate between mindful and mindless modes of action during their work. The findings reveal that analysts primarily use AI as a support and augmentation tool for tasks such as summarisation, research assistance and log analysis. Additionally, AI is used as a “Sparring partner” to give support to the analyst during the investigations. However, we found that the degree to which analysts conduct mindfully with AI is shaped by four key modulators: trust, experience and responsibility, severity and contextual limitations. In addition to shaping how analysts conduct mindfully, the use of AI in SOC carried border consequences for the analyst. Extensive reliance on AI was associated with skill erosion, cognitive disuse atrophy and learning inhibition. Furthermore, AI adoption contributed to a transformation of SOC roles, as analysts increasingly shifted from direct incident handling towards supervisory and orchestration focused responsibilities. This thesis contributes to the research field by providing an empirical account of how SOC analysts use AI. Furthermore, It extends the theoretical understanding of mindful conduction by identifying modulators that influence how analysts navigate between mindful and mindless modes of working with AI. The findings also offer practical consequences and insights for organisations seeking to integrate AI into SOC environments.

Organizations increasingly operate in environments marked by uncertainty, change and disruption. These conditions have made organizational resilience essential. Organizations need to anticipate change, respond effectively, reconfigure resources, and learn from disruption. Simultaneously, artificial intelligence has become a driver of digital transformation by supporting information processing, automation and optimization, decision support, collaboration and innovation. Research on how AI-enabled digital transformation contributes to organizational resilience remains fragmented. The research question guiding this thesis is: How can AI-enabled digital transformation enhance organizational resilience? The thesis applies an integrative literature review of 30 articles. The literature was analyzed through thematic coding and synthesis. The coding process produced five umbrella categories from which the conceptual framework was derived. The 12 synthesis themes provide detailed literature-based support for the framework components. The findings suggest that AI-enabled digital transformation does not enhance resilience through mere technology adoption. AI becomes resilience-enhancing when embedded in organizational processes. AI-enabled dynamic capabilities are identified as the main link between AI-enabled digital transformation and organizational resilience. AI-enabled sensing supports organizations in detecting weak signals, opportunities, and environmental change. AI-empowered operationalization translates AI-generated insights into decisions, coordination, and action. AI-enabled reconstruction supports resource reconfigurations, and redesign of routines and processes. These capabilities are supported by organizational learning, innovation, and resource allocation efficiency. The relationship is also shaped by boundary conditions such as data-driven culture, leadership and governance, digital maturity and infrastructure, environmental turbulence, institutional support, and ethical use of AI. The thesis concludes that organizational resilience should be understood as a capability-based outcome. AI-enabled digital transformation can enhance resilience through strengthening anticipation, absorption and coping, adaptation and recovery, and learning and renewal over time. The conceptual implication is a framework linking AI-enabled digital transformation, dynamic capabilities, and organizational resilience. The practical implication is that organizations should treat AI as an enabler of dynamic capabilities that must be embedded in organizational processes.

Artificial intelligence has established a clear presence in human resource management and are reshaping tasks that HR professionals treat as central to their work, but little research has been done to understand how they experience this through their professional identity. The thesis adopts an interpretivist paradigm, a qualitative design and draws on semi structured interviews with eleven HR professionals who have experience with AI in their work. Each interview was examined through narrative analysis. Following an abductive approach, the analysis moved between the data and two existing concepts from Sveningsson and Alvesson's view of identity work as struggle with Pratt et al.'s typology of identity customisation. As these concepts did not fully map onto our data, a third identity strategy was identified as positioning work. The findings show that HR professionals construct a composed professional self to prepare for the upcoming disruption of AI technology. This composure is achieved through three strategies, one of which are conditional. The maintaining a relational core, positioning a line around where AI is allowed to act, and the conditional enriching of their repertoire with integrated knowledge and technology. Holding the frame together is the anticipatory work done before the full force of AI hits their workplace.

Artificial intelligence has established a clear presence in human resource management and are reshaping tasks that HR professionals treat as central to their work, but little research has been done to understand how they experience this through their professional identity. The thesis adopts an interpretivist paradigm, a qualitative design and draws on semi structured interviews with eleven HR professionals who have experience with AI in their work. Each interview was examined through narrative analysis. Following an abductive approach, the analysis moved between the data and two existing concepts from Sveningsson and Alvesson's view of identity work as struggle with Pratt et al.'s typology of identity customisation. As these concepts did not fully map onto our data, a third identity strategy was identified as positioning work. The findings show that HR professionals construct a composed professional self to prepare for the upcoming disruption of AI technology. This composure is achieved through three strategies, one of which are conditional. The maintaining a relational core, positioning a line around where AI is allowed to act, and the conditional enriching of their repertoire with integrated knowledge and technology. Holding the frame together is the anticipatory work done before the full force of AI hits their workplace.

Security Operation Centres (SOCs) face increasing pressure to integrate Artificial Intelligence (AI) into their workflows to address persistent challenges such as alert fatigue, staffing shortages and an expanding threat landscape. While the technical and operational benefits of AI in SOCs have been well documented, considerably less is known about how AI affects individual analysts. This thesis investigates how analysts use AI and how this affects their cognitive engagement. This is done by answering the following research questions: “How do security analysts use AI in SOC” ,“ How does the use of AI affect the mindful conduction of SOC analysts?” and finally “What are the consequences of using AI in SOC?”. We conducted semi-structured interviews with 10 security analysts working in SOCs and used the concept of mindful conduction as a theoretical lens. Mindful conduction captures how analysts navigate between mindful and mindless modes of action during their work. The findings reveal that analysts primarily use AI as a support and augmentation tool for tasks such as summarisation, research assistance and log analysis. Additionally, AI is used as a “Sparring partner” to give support to the analyst during the investigations. However, we found that the degree to which analysts conduct mindfully with AI is shaped by four key modulators: trust, experience and responsibility, severity and contextual limitations. In addition to shaping how analysts conduct mindfully, the use of AI in SOC carried border consequences for the analyst. Extensive reliance on AI was associated with skill erosion, cognitive disuse atrophy and learning inhibition. Furthermore, AI adoption contributed to a transformation of SOC roles, as analysts increasingly shifted from direct incident handling towards supervisory and orchestration focused responsibilities. This thesis contributes to the research field by providing an empirical account of how SOC analysts use AI. Furthermore, It extends the theoretical understanding of mindful conduction by identifying modulators that influence how analysts navigate between mindful and mindless modes of working with AI. The findings also offer practical consequences and insights for organisations seeking to integrate AI into SOC environments.