Understanding the inertial forces impeding dynamic cybersecurity learning capabilities

The case of a South African healthcare software services firm

Abstract

Healthcare firms need to develop cybersecurity learning mechanisms to respond faster and more proactively to a rapidly changing cybersecurity threat landscape. Many healthcare firms lack the necessary cybersecurity learning capabilities to address ever-changing and unpredictable cyberthreats effectively. In this case study, we investigate the challenges faced by a major South African healthcare software services firm that offers software as a service (SaaS) solutions. We analyse the inertial forces that impede the firm’s cybersecurity learning capabilities by integrating concepts from dynamic cybersecurity learning capability (DCLC) and IS-enabled organisational learning perspectives. Furthermore, we identify strategic and operational level inertial forces through interviews with the organisation’s experts and examination of cybersecurity documents. We then present actionable recommendations for industry practitioners to overcome these inertial forces and strengthen their cybersecurity learning capabilities. Our suggested interventions include implementing proactive leadership structures, enhancing user learning capabilities, and adopting novel risk management approaches. Additionally, we propose further directions for scholars to research the impact of inertial forces on dynamic cybersecurity learning capabilities in healthcare firms.