Abstract
IS security behavior studies are becoming popular. To date, much of the research has been based on theories such as the Theory of Planned Behavior, Technology Adoption Model, Rational Choice theory and Theory of Reasoned Action. They view users as rational individuals making conscious utilitarian decisions when there is increasing evidence that security breaches are the result of human behavior such as carelessness, malicious intent, bad habits, and hostility. We propose the ego defense mechanism model, taken from the psychoanalytical world. This model makes no assumption of rationality and has been developed to help understand the roots of dysfunctional behavior such as fear, phobias, anger, forgetfulness, indifference and hostility. Our model shows that security threats trigger anxiety among users and the ego react by both functional and dysfunctional behavior. This could be the earliest if not the first paper to explore user behavior in IS security situations using this framework.