Pathways to Trust: A Model of Information Security and Trust Formation in Socio-Technical Environments Structured Abstract

1 Purpose The purpose of this research is to fill a gap in the existing literature for new models that deal with computational trust, for example in developing trust protocols, trust metrics and the place of trust in cybersecurity strategies [1]. Many models of trust and cybersecurity are based on cognitive assessments of risk prior to delegation of tasks, although it is known that trust and risk are associated [2]. Where delegation takes place without trust it is actions that influence the formation of trust, not the other way around. We argue that action shapes trust and is not merely a product of a process. It is known that consumers may delegate action to organisations as long as the perceived risks are lowered, and the inverted-U theory of trust [3] demonstrates that low trust marketplaces are regulated by guarantees that reduce the need for trust. Conversely, highly regulated marketplaces manage the rules of conduct to reduce the role of social trust. Therefore, trust is only necessary where the transaction types fall between these two poles and eliciting this trust can lead to competitive advantage [6]. This work utilises a model to operationalise the concepts in the Theory of Planned Behaviour (TPB) [7,8] to measure how information security and task delegation drive consumers to trusting behaviour by increasing their perceived control and lowering perceived risks.