An Organizational Learning Perspective on Proactive vs. Reactive investment in Information Security

We present an empirical analysis of security investment in the healthcare sector to explore the impact of learning effects on breach performance. Employing organizational learning theory, we seek to identify how different types of security investment affect subsequent security failures. Our analysis is based on data from 2,386 healthcare organizations and benefits from data that have been gathered in a comparable manner across organizations and time. Using a Cox proportional hazard model for survival analysis, we find that proactive security investments are associated with longer intervals before subsequent breaches than reactive investments. Further, we find that external regulatory pressure can stimulate organizational learning and change. However, the interaction between external pressure and proactive investment reduces the positive effects of the investment. This implies that proactive investments, voluntarily made, have the greatest impact on security performance. Our findings suggest that security managers and policy makers should pay attention to the strategic and regulatory factors influencing security investment decisions. The implications for proactive and reactive learning with external regulatory pressure can be generalized to other industries.