An Original Investigation into Human Factors in Cybersecurity Decision-Making Among Nigerian IT Professionals

Human factors in cybersecurity, specifically how cognitive biases, heuristics, and social influences shape security decision-making by IT professionals, are theorised in Western contexts but require original investigation for the Nigerian professional environment where distinct cultural, organisational, and risk perception factors operate. This study conducted an original theoretical and empirical investigation into human factors influencing cybersecurity decision-making among IT security professionals in Nigeria. A mixed-methods theory-building approach was employed: systematic review of cybersecurity human factors literature (71 publications from 2018 to 2024), original experimental study with 120 Nigerian IT security professionals using vignette-based decision scenarios measuring the effects of time pressure, peer opinion, authority framing, and loss-gain framing on security decisions, and grounded theory qualitative research with 40 professionals exploring cultural and organisational factors in security judgement. The experimental study confirmed significant effects of authority framing (decisions more likely to comply with authority-framed directives), social proof (peer endorsement significantly increased risky security behaviour), and loss framing (loss-framed security warnings significantly more effective than gain-framed equivalents, p < 0.001). Qualitative analysis identified three Nigeria-specific cultural factors not captured in existing frameworks: hierarchical deference bias (reluctance to question senior colleagues' security practices), communal accountability diffusion (security responsibility perceived as shared and thus unowned), and compliance performance (performing compliance for supervisors without genuine adoption). The original Nigerian Cybersecurity Decision-Making Model integrates these factors and proposes culturally adapted interventions. Keywords: human factors, cybersecurity decision-making, IT professionals, Nigeria, cognitive bias