This study investigates the impact of cybersecurity readiness on organizational security performance within Malaysia's National Critical Information Infrastructure (NCII) organisations, through the lens of Dynamic Capabilities Theory.
A qualitative approach was employed, involving semi-structured interview with representatives from fifteen public and private NCII organizations. Data were analysed thematically to assess how cybersecurity readiness influences organizational performance.
The study found that cybersecurity readiness impacts three key areas: security controls, individual behaviour and organizational performance. It strengthens security controls, enhances incident response through improved network visibility and threat detection, and mitigates risks to asset and data protection. Awareness programmes were instrumental in fostering proactive behaviours, such as reporting suspicious activities and securing workstations. Despite some employee frustration with increased security protocols, the long-term benefits, including improved operational continuity and reduced cyber risks, outweighed these challenges. Furthermore, cybersecurity readiness enhances organisational reputation, offering a competitive advantage amidst growing data privacy concerns.
The small sample size limits generalisability. Future research should expand the sample or compare sectors to enhance external validity. The qualitative approach, while context-rich, limits quantitative measurement of security performance.
The findings provide actionable insights for policymakers and cybersecurity leaders to improve and invest in cybersecurity measures to safeguard organisational assets.
This study extends dynamic capabilities theory by applying it to cybersecurity readiness, framing it as a dynamic capability that enables organisations to continuously adapt and realign resources to address evolving cyber threats.
