Implementing information security controls: now or later? Delay discounting of losses and gains

Delay discounting is a behavioral process, which explains certain peculiarities of human decision-making when choices and their consequences are separated from each other in time. The concept has been used in psychology and behavioral economics to explain how individuals make suboptimal choices with undesirable individual and societal consequences. Existing research shows that individuals can be characterized by several discounting parameters (k) across contexts, capturing the rate at which future gains and losses decrease in value as seen from the present. This present paper investigates how the concept of delay discounting can be utilized to better understand human choices regarding the implementation of information security controls in organizational settings. The study relies on a validated psychometric instrument (MCQ-21) to collect gold-standard k parameters with monetary outcomes. Furthermore, two novel variants are developed to estimate individuals' k parameters with outcomes specific to the information security context. Within the framework of a nonexperimental correlational research design, an online survey was distributed among the employees ($n = 135$) of three Norwegian organizations. Contrary to expectations, none of the k parameters provided predictive power as predictors of real-world behavior in organizational settings. Nevertheless, the same behaviors were predicted by an attitude-based measure with an accuracy (adjusted $R<^>2=0.22$), which is observed generally in the literature of behavior prediction using attitudes as predictors. This paper contributes the first results on assessing the effectiveness of delay discounting parameters for behavior prediction within the context of information security.