Empirical Investigation of Organisational Cybersecurity Culture and Security Incident Rates in Nigerian Manufacturing Companies

Organisational cybersecurity culture is theorised as a key determinant of security incident frequency, and empirically characterising this relationship in the Nigerian manufacturing sector fills an important gap in both cybersecurity culture and industrial security research. This study empirically investigated the relationship between organisational cybersecurity culture and security incident rates in manufacturing companies in the North Central and South West zones of Nigeria. A correlational survey design was employed, with 30 manufacturing companies from Lagos, Ogun, Plateau, and Niger States participating. The Cybersecurity Culture Assessment Tool was administered to 20 employees per company (n = 600), and IT security managers provided incident log data covering 24 months. Hierarchical regression analysis showed that overall cybersecurity culture score significantly negatively predicted 24-month incident rate (beta = -0.54, p < 0.001), explaining 29.2 percent of incident rate variance. Management support for security was the single strongest culture predictor (beta = -0.47). Security resource allocation showed the strongest moderation effect on the culture-incident relationship. The study provides novel empirical evidence for the culture-incident relationship in Nigerian manufacturing and recommends security culture diagnostic tools as part of Nigerian corporate cyber hygiene assessment, alongside executive security engagement programmes targeting manufacturing sector leadership. Keywords: cybersecurity culture, security incidents, manufacturing companies, Nigeria, organisational security