Empirical Analysis of Cybersecurity Culture and Its Influence on Insider Threat Behaviour in Nigerian Commercial Banks

Insider threats represent one of the most damaging cybersecurity risks facing Nigerian commercial banks, and the relationship between organisational cybersecurity culture and insider threat behaviour requires rigorous empirical investigation. This study empirically analyses the dimensions of cybersecurity culture and their influence on insider threat behaviour propensity in Nigerian commercial banks. A cross-sectional survey was applied to 420 banking employees across four first-tier and three second-tier banks in Lagos, Abuja, and Kano, selected through stratified cluster sampling. A validated cybersecurity culture scale measuring leadership commitment, security awareness, security norms, reporting culture, and accountability, alongside the Insider Threat Behaviour Index measuring negligent, accidental, and malicious behaviour tendencies, was administered. Structural equation modelling in AMOS tested path relationships and moderation effects by organisational tenure and access privilege level. Available insider threat literature from Nigerian banking contexts identifies peer norm violation and low perceived detection risk as the strongest predictors of malicious insider behaviour, while inadequate security training predicts negligent insider threat. The Organisational Culture Theory of Schein and the Rational Choice Theory provide the analytical framework. Findings confirm that security norms and accountability culture dimensions have the strongest direct effects on reducing insider threat propensity. This study fills a gap in empirical insider threat-culture research from Nigerian banking sector data. Recommendations address security culture measurement as a standing management KPI and privilege access management investment. Keywords: cybersecurity culture, insider threat, commercial banks, Nigeria, information security behaviour.