A review and analysis of deterrence theory in the IS security literature: making sense of the disparate findings

Deterrence theory is one of the most widely applied theories in information systems (IS) security research, particularly within behavioral IS security studies. Based on the rational choice view of human behavior, the theory predicts that illicit behavior can be controlled by the threat of sanctions that are certain, severe, and swift. IS scholars have used deterrence theory to predict user behaviors that are either supportive or disruptive of IS security, and other IS security-related outcome variables. A review of this literature suggests an uneven and often contradictory picture regarding the influence of sanctions and deterrence theory in general in the IS security context. In this paper, we set out to make sense of the discrepant findings in the IS deterrence literature by drawing upon the more mature body of deterrence literature that spans multiple disciplines. In doing so, we speculate that a set of contingency variables and methodological and theoretical issues can shed light on the inconsistent findings and inform future research in this area. The review and analysis presented in this paper facilitates a deeper understanding of deterrence theory in the IS security domain, which can assist in cumulative theory-building efforts and advance security management strategies rooted in deterrence principles. European Journal of Information Systems (2011) 20, 643-658. doi:10.1057/ejis.2011.23; published online 14 June 2011