Cultivating cybersecurity learning: An integration of self-determination and flow

Because there is a critical shortage of cybersecurity talent, information security professionals and researchers should cultivate cybersecurity skills by encouraging individuals to pursue cybersecurity learning. However, some aspects of cybersecurity require substantial effort and perseverance for conceptual understanding to be gained. We propose motivation as the key to ensuring continuous engagement with and successful learning of such cybersecurity concepts. With a lab-based training program that taught participants about SQL injection attacks, we tested a research model that integrated flow theory and self-determination theory. Within the training program, we captured participants' persistence in attempting and successfully completing the training exercises while also measuring their perceptions of motivation and flow. We found that flow facilitated motivation and its key antecedents. Flow and task significance had the strongest effects on motivation, while motivation fostered learning persistence and performance. We recommend training programs that maximize flow and task significance. (C) 2020 Elsevier Ltd. All rights reserved.