Abstract

This article presents scenarios designed to support abstract and reflective thinking necessary to inculcate information security awareness among IT service designers. Data for the study was obtained in empirical interventions and through an action research approach in cooperation with an IT company. The findings highlight the need for training that, in combination with traditional contents, also integrates organizational, business, and social aspects into information security awareness. Rethinking a strategy for training to be grounded in scenarios from day-to-day business activities is one implication of the study; another is the suggestion to frame the scenarios as dilemmas, that is, problematic and realistic situations having multiple solutions depending on interpretations and perspectives, and a final conclusion is the importance of enabling structured in-depth dialogues among employees.