Security Culture and Its Boundary Conditions Explain Effective and Accountable Information Security Management in Vietnam
This study of 358 Vietnamese organizations demonstrates that security culture and competency serve as a critical mechanism through which top management commitment and external institutional pressure drive effective information security management, while revealing that resource capability acts directly and that these dynamics vary significantly based on organizational maturity and team size.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
In the modern world, almost every business operates as part of a vast, invisible web. A factory in one country relies on software from another, which in turn depends on data from a third. This digital interconnection means that a security failure in one small company can ripple out to disrupt a global supply chain. For decades, the standard answer to this problem was to build higher digital walls. Organizations bought expensive software, installed firewalls, and checked boxes to prove they met safety standards. But as cyber threats have grown more complex, experts have realized that technology alone is not enough. A fortress with a locked door is useless if the people inside leave the gate open by mistake. The new challenge is not just about buying better tools, but about understanding how organizations actually work, how their leaders behave, and how the people within them think about safety every single day.
A team of researchers from universities in Vietnam set out to understand exactly how these different pieces fit together. They wanted to know what truly makes a company secure. Is it the amount of money spent on technology? Is it the pressure from government regulators? Or is it the attitude of the company's leaders? To find the answer, they surveyed 358 organizations across Vietnam, ranging from small startups to large state-owned enterprises. They asked managers and security staff about their budgets, their leadership's involvement, the pressure they felt from outside, and how well their employees actually followed safety rules. The goal was to see which factors actually led to fewer security breaches and better business performance, and to discover if there was a single formula that worked for everyone.
The study uncovered a surprising truth about how security works. Many people assume that if a company has a large budget and a team of experts, it will naturally develop a strong security culture. The researchers found this to be incorrect. Having money and staff did not automatically change how employees thought or acted. Instead, the study showed that a strong security culture is built primarily by two things: the visible commitment of top leaders and the pressure from outside forces like regulators and business partners. When leaders actively prioritize safety and when companies feel a genuine need to meet external standards, employees begin to internalize security as a shared value. This shift in mindset, which the researchers call security culture and competency, is what actually drives effectiveness. It is the bridge that turns a leader's promise or a regulator's rule into real-world protection.
While money and technology did not build the culture, they were still important, just in a different way. The data showed that having the right resources, such as skilled staff and advanced tools, improved security outcomes directly. A company with excellent technology could stop a threat immediately, even if its employees were not yet fully convinced of the importance of safety. This means there are two distinct paths to security. One path is cultural, where leadership and external pressure shape human behavior to create a resilient organization. The other path is mechanical, where resources provide immediate, tangible protection. The study found that the most effective organizations often used both, but they could not rely on resources alone to fix a broken culture.
The researchers also discovered that there is no single "best" way to be secure. The factors that matter most change depending on the size and age of the organization. In smaller companies with very small security teams, the commitment of the top boss was the most critical driver of culture. In larger organizations with bigger teams, external pressure from the market and regulators became the dominant force. Similarly, younger companies responded more strongly to outside pressure, while older, more established firms relied more on their internal leadership to maintain safety standards. This means that a strategy that works for a massive, decades-old corporation might fail completely for a small, new startup. The study used advanced methods to show that there are multiple, equally valid combinations of leadership, resources, and pressure that can lead to a highly competitive and secure business.
Ultimately, this research suggests that building a secure organization is not about buying the most expensive checklist. It is about understanding that security is a human and organizational capability, not just a technical one. Money can buy the tools, but it cannot buy the mindset. That mindset comes from leaders who care and from a business environment that demands it. For organizations struggling with security, the lesson is clear: do not just throw more money at the problem. Instead, look at how leadership communicates and how the organization responds to the world around it. By focusing on these human and relational elements, companies can build a defense that is as resilient as the digital networks they rely on.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.