Investigating industry norms of cyber security: a critical content analysis of PwC's annual reports

Abstract

Industry reports are the cornerstone of the cyber security landscape, providing relevant implicit insight into the current cyber security norms and expectations. Analysis of these reports from a critical perspective is missing, meaning the role that they play and the implicit insights they contain are unexplored. In our study, we address this research gap through studying the annual PwC industry reports relating to cyber security using a content analysis approach. We identify that PwC reports have continually emphasised strategy and leadership, contrasting with the more recent inclusion of strategy in cyber security. Furthermore, we observed that though norms have changed, cyber security and what it encompasses have not fully changed despite tools and threats evolving. Cyber security is also positioned as a benchmarkable concept, which can be both motivating and demotivating considering the inevitable occurrence of cyber incidents. Our study demonstrates the value of industry reports by showing the difference in industry and research perspectives. Future research can then use and incorporate these reports to supplement analysis. In addition, our description of how cyber security's norms and beliefs have changed over time provides researchers with a context when analysing historical and current practices extending their analysis. Our study contributes to practice by identifying patterns useful for providing guidance to organisations. Furthermore, our study demonstrates the importance of industry encouraging their involvement. Studies incorporating industry reports with such analysis are novel, at the time of writing.