Employee perspectives on safeguarding information: An exploratory study in a multinational energy corporation

Information security has become a critical organizational and HR priority in an era of escalating cyber threats. Despite extensive technological investments in cybersecurity infrastructure, the human dimension of information safeguarding remains underexplored, creating significant vulnerabilities in organizational defense mechanisms. This exploratory research investigates employees’ reactions, thoughts, and experiences regarding information safeguarding practices within a large multinational energy corporation in Saudi Arabia. Grounded in Protection Motivation Theory (PMT), this study examines how employees perceive threats to organizational information assets and their behavioral responses to safeguarding imperatives. The research employs a unique dual-method qualitative approach, analyzing 87 firsthand computerized employee comments — one comment contributed by each of 87 distinct employees — extracted from an internal electronic system and conducting 24 semi-structured interviews with full-time employees across various organizational levels. Through systematic thematic analysis, the study identifies five major themes: perceived vulnerability and threat awareness, individual responsibility and accountability, organizational security culture, technical versus human factors in information protection, and knowledge gaps and training. Findings reveal a persistent paradox: heightened threat awareness does not automatically translate into consistent protective behaviors, a pattern moderated by organizational culture, variations in self-efficacy, and response-cost barriers. The study extends PMT to an underexplored context of critical infrastructure. It offers actionable insights for practitioners seeking to cultivate security cultures, address self-efficacy gaps, and design human-centered security interventions in high-stakes organizational environments.