To Örebro University

Background: Classifying natural language requirements (NLRs) is challenging, especially with large volumes. Research shows that Large Language Models (LLMs) can assist by categorising NLRs into Functional Requirements (FR) and Non-Functional Requirements (NFR). However, concerns about their consistency have been raised.

Aim: In this work, we aim to investigate the consistency when Generative Pretrained Transformer (GPT) -like models, such as GPT-4.1 and LLAMA3.3-70B, classify NLRs into FRs and NFRs by using the Few-Shot Learning (FSL) approach. We explore how the number of examples used in the FSL approach and the temperature setting affect the consistency of NRL classification results.

Method: For this study, we use the PROMISE NFR dataset. Experimental design is employed to investigate the binary classification of FR versus NFR. To accomplish this goal, we use FSL with GPT-4.1 and LLAMA3.3-70B to classify the requirements.

Results: The results show that GPT-4.1 performs similarly with two and ten examples. However, the results somewhat differ for LLAMA3.3-70B, where FSL is slightly better using FSL with ten examples compared to two. Moreover, both LLM models seem to perform well in identifying FRs but have a more conservative classification behaviour when classifying NFRs. Finally, the temperature parameter does not seem to significantly impact the classification results.

Conclusions: When using FSL, using two versus ten examples slightly impacts the results. Moreover, we experimented with different temperatures (Temp = 0, Temp = 1, Temp = 2), and the temperature parameter does not seem to impact the classification results. Therefore, LLMs do not seem to become more creative even when the temperature increases.

Employee compliance with Information Security Policies (ISPs) depends on communicating clear and comprehensible content. However, existing research has shown that many ISPs are of poor communicative quality. Large Language Models (LLMs) could enhance ISPs if fine-tuned on high-quality data, but to do such fine-tuning requires a conceptual model for classifying the data and evaluating the resulting text. Therefore, as a step in this direction, the aim of this article is to develop a conceptual model of ISPs using Speech Act Theory as a theoretical lens to enable assessments of the communicative quality of ISPs. We used conceptual modeling and document analysis to develop the modelbased on 600 ISP statements from ten British National Health Service ISPs. We used selected parts from the SEQUAL framework to evaluate the model. The evaluation pointed to potential areas for improving the model’s semantic, empirical, physical, and deontic qualities. By incorporating these improvements, the final class diagram contains 21 classes, six of which address ISP statement quality as speech acts.

Purpose: Although existing literature has advanced the understanding of information security policy (ISP) management, it has not examined how artificial intelligence (AI) can support ISP activities across management phases. Moreover, no study has yet mapped the empirical domains studied. The purpose of this paper is to systematically map existing ISP management research to assess to what extent AI has been addressed or used.

Design/methodology/approach: This study follows the five-step scoping review framework proposed by Arksey and O'Malley (2005): identifying the research questions, finding relevant studies, selecting studies, charting the data and reporting the results.

Findings: The review reveals that very few ISP management papers address or use AI. These few papers focused mostly on operational ISPs and addressed different ISP phases and empirical domains. Most existing work focuses on construction or compliance, while no studies have addressed the technical level. Research methods dominated by experiments, with a notable absence of organizational fieldwork. Research on ethical aspects such as fairness, transparency, accountability and data sensitivity is rare in this area.

Research limitations/implications: Given the limited research in this area, there are significant opportunities to explore AI in ISP management and to use AI in studying ISP management. The authors suggest a research agenda divided into three-time horizons: short, medium and long term.

Originality/value: This paper provides the first scoping review of AI in ISP management research, offering a systematic mapping of ISP management phases, ISP levels, research methods and empirical domains. It identifies research gaps, thereby guiding future research.

The purpose of this paper is to investigate how information security managers cope with the challenges in the input stage when developing an information security policy (ISP) in the context of hybrid work in the financial sector. To address this, an empirical study was conducted using semi-structured interviews with eight information security managers in Sweden's financial sector. The data is analyzed through qualitative thematic analysis. The lens of institutional theory was also applied to interpret the results. According to the results, 18 challenges and their associated solutions for five selected inputs (i.e., risk assessment, industry standards and guidelines, regulations, existing policies and organizational business requirements) within the input stage of the ISP development are identified. For example, one recurring challenge at the input stage of an organization's risk assessment is the potential intrusion into employees' privacy when work occurs in their homes. Risks that are easy to identify and evaluate in a controlled office environment often become less visible or more difficult to assess in home-based settings. This creates uncertainty during the input stage because organizations must address these dispersed and varied risks without intruding on employees' private lives. This study advances the understanding of the input stage's challenges in the ISP development process in a hybrid work environment. While previous research has primarily examined the ISP's input stage in traditional office-based contexts, hybrid work introduces additional complexity. According to the results, organizations must balance essential information security requirements with increasing demands for workplace flexibility. They need to ensure that security expectations remain clear and actionable, yet adaptable enough to accommodate employees working remotely. This tension between maintaining operational security and supporting flexibility poses a significant challenge at the input stage related to organizational business requirements when developing effective ISPs for hybrid work. Furthermore, through the lens of institutional theory, the results indicate that some inputs are more strongly affected by isomorphism (i.e., coercive influence), whereas mimetic and normative influences appear less directly associated with specific inputs. Additionally, a primary practical implication is the encapsulated knowledge on the challenges managers may face and the associated solutions in the input phase of ISP development in the context of hybrid work in the financial sector. Managers can adopt and adapt the suggested solutions to further strengthen their work practices in the input stage of the ISP development.

Purpose: This study aims to develop and test a framework to associate learning styles and social influencing vulnerabilities with different personality types in the context of tailoring information security awareness (ISA) methods for people with different personality types.

Design/methodology/approach: The framework was developed following directed content analysis and applied to match distinct personality types with ISA methods identified through a systematic literature search. The directed content analysis was conducted in two parts: a) Describe and identify keywords for the DISC (dominance [D], inducement [I], submission [S] and compliance [C]) personality types, Kolb's learning styles and Cialdini's social influencing principles; b) Identify the relationships between personality types, learning styles and social influencing vulnerabilities and create the PLS (i.e. personality types, learning styles and social influencing vulnerabilities) framework. As a result, four relationships are identified for each distinct personality type in the PLS framework.

Findings: The study has theoretically demonstrated the framework's feasibility of finding best-matched ISA methods for distinct personality types, considering their linked learning style and social influencing vulnerabilities.

Research limitations/implications: The study provides two main theoretical contributions: 1) PLS framework: presenting the relationship of personality types with their linked learning style and their social influencing vulnerabilities; 2) Examples of matching distinct personality types with ISA methods, including suggestions for a theoretically best matched ISA method. Therefore, this study contributes to building a sound theoretical ground for tailoring ISA methods for people with different personality types. In addition, the derived keywords are helpful to capture a good understanding of the different dimensions of the selected theories. Furthermore, following the examples provided in this paper, the developed PLS framework can be used as a base for managers to use ISA methods for people with different personality types in organizations.

Practical implications: Furthermore, following the examples provided in this paper, the developed PLS framework can be used as a base for managers to employ ISA methods for people with different personality types in organizations.

Originality/value: To the best of the authors' knowledge, this study is the first of its kind in developing and testing a framework for matching distinct personality types with information security awareness methods.

Information security awareness (ISA) programs play an important role in enhancing employees' information security knowledge and information security behavior. A variety of delivery methods, such as training, workshops, posters, have been employed in ISA programs. Recently, AI chatbots have appeared as interactive and adaptive educational tools to enhance users' learning experiences, implying their potential use within ISA programs. This study aims to examine potential challenges with the use of AI chatbots within ISA programs from information security managers' perspectives. To address this, a qualitative study through semi structured interviews with eight information security managers was carried out in Sweden. The collected data were analyzed using thematic analysis. The analysis yielded three identified main themes: adoption challenges, deployment challenges, and ethical challenges. The deployment challenges were further divided into two sub themes: organizational and technical. This research contributes to the current literature on the use of AI chatbots within ISA programs. Furthermore, the findings also offer valuable insights for information security managers to understand what factors should be considered when integrating AI chatbots into their current ISA programs.

Employees need clear guidance in order to contribute to their organ-isation’s digital sovereignty. Information security policies (ISPs) should provide employees with this guidance, but existing research show that this is not always the case. Large language models (LLMs) could enhance ISPs if finetuned on high-quality data, but such fine-tuning requires a robust way to distinguish between statements in ISPs. Therefore, and as a first step in this direction, the aim of this paper is to investigate the consistency when a Generative pre-trained transformer-like model classifies information security policy (ISP) statements into speech acts using a zero-shot learning (ZSL) approach. We investigate the consistency of LLAMA3.3-70B when applying ZSL to classify 600 selected ISP statements into speech act classes derived from Speech Act Theory. The findings show that LLAMA3.3-70B achieves high similarity to human classification and demonstrates strong consistency across multiple runs per different temperature settings. Furthermore, changes in the temper-ature setting had a minimal effect, which means that the model produces stable clas-sifications. We conclude that LLAMA3.3-70B is a useful starting point for continued work on improving ISP content using LLMs. 

Purpose: The purpose of this paper is to analyse and compare how congruent keywords are used to convey actionable advice in UK and Swedish information security policies (ISPs).

Design/methodology/approach: The authors conducted a qualitative content analysis of 30 ISPs from higher education institutions, 15 from each country. To support analysis, the authors developed the ISP Keyword Analyzer software, which extracted 2,314 sentences containing analysed keywords. Each sentence was classified as actionable advice or other information. For comparison, the authors used the Keyword Loss of Specificity and Total Keyword Loss of Specificity metrics to measure how congruently keywords were used within each ISP.

Findings: The authors found two main patterns in keyword use. First, certain keywords are more prominent in ISPs from one country than the other, indicating differing importance across languages and national contexts. Second, the congruence in how keywords are used to convey actionable advice also varies. Swedish ISPs use keywords more congruently to guide employees towards action, whereas UK ISPs more often use them to convey other information than actionable advice.

Research limitations/implications: Differences in how ISPs are formulated across countries suggest that previous studies on ISP content and design are contextually bound.

Practical implications: The identified differences highlight how language and national context influence the clarity of ISPs, with implications for organisations operating in multilingual or international environments.

Originality/value: To the best of the authors' knowledge, this is the first study to compare how keywords are used in ISPs in different countries to express actionable advice.

Although much literature has focused on prejudice-based traditional bullying, there are not a lot of studies about prejudice-based cyberbullying. This kind of cyberbullying reflects any form of cyberbullying based on a group affiliation or identity characteristics of the victim, often including historically marginalised and other "protected characteristics" (race, religion, disability, etc.). In this chapter, we focus on seven characteristics that were highlighted in previous research - family origin, skin colour, religion/belief, nationality/ethnicity, disability, poverty, and sexual orientation. We begin by reviewing research into prejudice-based cyberbullying and emphasise the main gaps in the existing knowledge. We then present our empirical findings based on an online study that contributes to filling these gaps: (a) the prevalence of prejudice-based cyberbullying and cybervictimisation at the cross-national level, across 17 countries and including culturally diverse samples (N = 5,215 high school students); and (b) the relationships of belonging to some of the marginalised groups (based on sex, nationality/ethnicity, religion, asylum status, and disability) with both prejudice-based cyberbullying and cybervictimisation. Finally, we refer to some suggestions for future research and conclude with the implications for prevention programmes based on the obtained results.

Context: Despite the widespread adoption of agile software development methods (ASDMs) today, many organizations struggle with effective implementation. One reason for this is that some organizations claim to use an ASDM without fully understanding its core principles, or they adhere to old practices while professing to follow a contemporary software development method. This phenomenon is sometimes referred to by practitioners as “cargo cult” (CC) behavior. However, simply labeling something as CC lacks analytical depth.

Objective: This paper aims to conceptualize and validate an analytical tool for diagnosing CC and non-CC behavior in software development teams’ use of ASDMs.

Method: This study uses a longitudinal ethnographic approach to conceptualize and validate the analytical tool by analyzing four agile practices used by a global industrial manufacturing company.

Results: The analytical tool features eight stereotypes—three representing non-CC behaviors and five representing CC behaviors—designed to aid in the analysis of ASDM usage. The tool draws on Social Action Theory and Work Motivation Theory to capture and interpret the CC phenomenon in ASDM use. Using the stereotypes, 36 actions were categorized as CC behavior deviating from documented ASDM practices, and 23 actions as non-CC behavior because they aligned with the documented ASDM and reflected agile goals and values. The tool thus can help both researchers and practitioners gain a deeper understanding of ASDM use in organizations.

Conclusion: This study advances understanding of ASDM use by moving beyond the simplistic use of the term “cargo cult”. The developed tool enables structured identification and classification of CC behaviors. The stereotypes provide a way of classifying recurring software development actions against the intended ASDM, allowing the identification of specific types of CC behaviors. The analytical tool enables managers to gain deeper insights into the underlying reasons for deviations, thereby supporting more grounded and effective agile practices within organizations.