IT assimilation: construct, measurement, and implications in cybersecurity

ABSTRACT Unintentional employee behaviours can be a major cause of security breaches. To mitigate the risk, employees need to habituate their new behaviours, implying a transfer of learning that may occur at ‘work’ to ‘personal’ contexts. Against this backdrop, we examine a new construct – IT Assimilation – grounded in situated learning theory by its definition as the incorporation of enterprise IT into an individual’s IT repertoire. We use a multi-phase methodological approach to conceptualise the construct and develop a validated scale to measure it. Our findings offer valuable insights for researchers and practitioners about transferring IT behaviours, particularly in the cybersecurity context..