Effect of information security systems on competitive advantage in private firms in Kenya

Abstract

This study evaluated the effect of information security systems on competitive advantage in private firms in Kenya. Although studies emphasise that organisations should adopt holistic information security management standards (ISMSs), such as ISO/IEC 27001, a concern remains that there is a lack of empirical inquiry on how these systems contribute to a private firm’s competitive advantage. Considering the dearth of studies on the association between these two in Kenya, this study assessed the influence of information security systems on competitive advantage in private firms in Kenya. The study was anchored on the dynamic capability theory and the Information Security Policy Framework. To attain the study’s aim and objectives, the positivism philosophy was adopted. This study also adopted the descriptive research design where quantitative research methods were used to collect and analyse data. The target population comprised all private sector firms in Kenya. Further, 247 questionnaires out of a target sample of 400 were returned from the online survey. Inferential and descriptive analysis were employed to address the research objectives. Findings indicate that deterrence mechanism has a positive significant effect on the competitive advantage of private firms in Kenya. This is by building a security-conscious culture and operational resilience in private organisations in Kenya, increasing stakeholder confidence in the process. Visible disincentives, proactive policies, and continuous training directly support the Dynamic Capability Theory’s emphasis on adaptability. However, defence and detection have non-significant results. This suggests that other dimensions not addressed in this study could explain this association. The inclusion of firm size and firm age as control variables has no significant effect on the interaction between Information Security Systems (ISSs) and competitive advantage in private firms in Kenya. These findings challenge the assumption that older or larger firms potentially leverage ISSs differently to their advantage possibly because of their established market positions or greater resources. This study recommends that private firms and other ICT stakeholders in Kenya should enhance regulatory standards for deterrence-oriented ISSs. It also recommends that private firms should embed security awareness in organisational culture. Finally, the management of private firms in Kenya should balance ISS components while emphasising strategic deterrence. Keywords: Information security, information security system, competitive advantage, dynamic capabilities, and information security management system.