Understanding the insider threat: a dyadic organization-employee fit/misfit perspective[Comprendre la menace interne : une perspective dyadique de l'(in)adéquation organisation-employé]

The insider threat remains a central challenge in information security, as technological ubiquity blurs the boundaries between legitimate work, parallel practices, and deviance. In this literature, the theoretical gap lies in the inability of dominant linear approaches primarily based on deterrence to explain the diversity of behaviors enacted by legitimate employees. This article reconceptualizes these security behaviors as an emergent property of the dyadic organization- employee relationship, drawing on stakeholder theory. Its theoretical configurational logic intersects two orthogonal dimensions, value congruence and strategic complementarity, yielding four configurations: proactive protection, benign non-compliance, instrumental abuse, and malicious abuse. The framework distinguishes circumvention, opportunism, and hostility, then proposes three managerial responses: socio-technical redesign, targeted governance, or corrective intervention. By proposing a mid-range IS theory, this research advances the field and invites replacing undifferentiated sanctions with an adjustment of tools, rules and values