Awareness of network security and customer value – The company and customer perspective

2.1. Need as the foundation of customer value

The essence and aim of a company's activity come down to a process aimed at satisfying the needs of such a customer who, as a result of his/her behavior, is able to secure the achievement of the company's needs. In an environment of growing demand barrier that results in an intensification of the struggle for capital, the relationship with the customer is not only the foundation of any business, but also the center of the activities of any enterprise.

The key importance of this relationship in the process of creating company value is confirmed not only by the number and growth dynamics of studies devoted to this very issue, but also by the diversity of approaches. The summary of publications from databases, among others SPRINGER database, confirms this theory (Table 1 ).

The analysis of the research carried out so far and devoted to the process of building relationships with customer clearly shows that the customer relationship is the result of a mutual flow of benefits, the provision of which is integrally linked to costs (Kotler and Bliemel, 2005). Therefore, each party in this relationship, when deciding whether to establish, maintain and develop it, evaluates its utility.

This utility, based on the achievements in the field of utility theory (Bechara et al., 1997), can be evaluated through the prism of: benefit, profit, pleasure, as well as: harm prevention, annoyance, losing the sense of security or prevention of damage, distress to the interested party (Bentham, 1958, Palmroth, 1991). As a result, utility is directly related to perceived values, which must be assessed by the entity making the evaluation in order for it to take action to establish and maintain the relationship that is their carrier.

In the customer-enterprise relationship, the perceived values reflect the perceived utility value, which is related to the necessity of its valuation. The utility value, being one of the basic subjective meanings of values determined by the purpose of the valuation, is inextricably linked with the assessment of the degree of achievement of the evaluator's objective and is the result of the assessment of decision alternatives. From the point of view of an enterprise whose goal is to create value inextricably linked with the process of multiplying capital, the assessment of the perceived utility of the customer comes down mainly to assessing the possibility of using it as a source of generating future economic benefits. This is in direct relation to the evaluation of the customer's contribution to the company's value creation process, so – in essence – the evaluation of the customer's value (customer capital), which is carried out in a specific place and time, taking into account the value of other comparable objects (Klier et al., 2014).

This contribution can take on two forms:

• •

  direct contribution that makes it possible to generate financial resources in the short term which, as the beginning and end of the transformation chain, are considered a priority. This contribution is in direct relation to the market potential of the customer, determined by its income and development potential,

• •

  indirect contribution, being the result of a one- or two-way transfer of information between the customer and the enterprise, as well as in the customer relationship network, the content which can constitute a support for the implementation of operational decisions and strategic decisions that allow the enterprise to achieve the intended operational and capital effects (Stṻker, 2008; Caputa, 2020).

This contribution is determined by the resource potential of the customer, being in relation with their willingness and ability to provide references, information and to engage in cooperation. Its financial effects are being revealed in the long term, by way of a complex chain of cause-and-effect relationships. As a result, the value of a customer from the enterprise point of view is assessed by the sum of the net cash flows that the company can acquire over the likely period of maintaining the relationship with the customer (customer life cycle) (Stṻker, 2008; Rau, 2009; Caputa, 2020).

Obtaining the customer's capital is not possible without providing such value for the customer for which he/she wants to pay the price securing the realization of the company's interests. W. Palmroth suggests that consumers see six benefits when purchasing a product:

• •

  safety - protection from physical danger, financial loss, mental discomfort, or emotional anguish,

• •

  performance - how the object does what it is intended to do,

• •

  appearance - how the product looks to the buyer and how it will make the buyer look to others.

• •

  comfort - physical and mental comfort, ease and convenience

• •

  economy - value for money

• •

  durability - how long the object will provide the desired benefits (Palmroth, 1991).

In Ziethaml's concept, this value for the customer is treated as an assessment of the overall usefulness of the product, resulting from previous and expected experiences (Zeithaml, 1988).

Adopting this concept in the process of defining value for the customer means going beyond the essence of the product itself, and thus its basic functional characteristics. The perceived utility that underlies customer value is now assessed not only in functional terms but also in social, epistemic, conditional and emotional dimensions (Sheth et al., 1991; Sweeney and Soutar, 2001).

In many concepts, this value comes down to the customer's net worth, which is the difference between the perceived benefits and the total effort that the customer has to incur in obtaining it. The perceived benefits are a derivative of the value subjectively assessed by the customer: offer, brand and relationship. On the other hand, the outlays are reflected in the cost of customer satisfaction, which, apart from the price, also includes non-financial outlays, including mental outlays (Kotler and Bliemel, 2005; Xu et al., 2015; Eggert, 2017). A similar approach based on the customer's net value is adopted by N. Meeme and P. Bichang, showing the relationship of value for the customer with the profitability of the relationship. In the cited studies, this value is conceptualized on the basis of four constructs: functional, economic, symbolic, and a distinctive value proposition.

As can be seen from the above, from the customer's perspective, the value of the relationship comes down not only to assessing the attributes of the product itself, but also the process of purchasing it, as well as the experience and expectations of using it, or even liquidating it. A relationship (product), in order to have the feature of utility, should solve multidimensional problems of the customer, and thus complete the tasks set by the customer under the given conditions of exchange. Therefore, it must respond to the challenges associated with the need to use the network to carry out the purchasing process. If the use of the network becomes a condition for “solving the customer's problem”, and from the perspective of the company – producing, delivering and communicating a product on the market and obtaining benefits from it, the usefulness of the network in terms of establishing and developing relationships is subject to assessment by both parties to the relationship.

In view of the deliberations made so far, we assume that at the heart of establishing and developing a relationship are the needs of both parties to the relationship. The needs of the company are mainly of a business-economic nature but their satisfaction requires human activity. The needs of a person are the elements of their personality. They are subjective and meeting these needs is linked with the lack of something that is important to a given individual. This lack in the biocentric approach is linked to the determinants of the survival of an individual and of the species. The sociocentric approach treats a person as a member of a community, a product of historically determined social relations. The needs are, therefore, the derivative of social needs. The psychocentric approach, developed mainly in the field of psychology, defines needs as motivational variables. It identifies human needs with elements of their motivation system, that is, their desires or subjective aspirations. On the other hand, in the approach putting the economy in the center, the need arises when it is expressed through economic behavior, that is when an individual looks for goods and services to compensate for the scarcity he or she feels (Leszczyńska-Rejchert, 2006).

The progressing digitization is creating an information society based on technology and infrastructure used for communication and information creation, satisfying the multidimensional needs of users and society as a whole (Castells, 2008). It is the society that shapes ever-changing organizations and is itself influenced by them. The behavior of people belonging to virtual structures creates a new social and political order.

The universal access to computers and the Internet democratized access to information and its transmission. As a result, any person with specific knowledge can be a sender and receiver of information and – at the same time – a partner in the value creation network, regardless of their current spatial location.

At the same time, technological innovations created a behavioral space in which a coupling between the behavior of value providers and value consumers takes place (Manu, 2012). This space is not only a certain fragment of the virtual space, which the customer treats as their own, but also a space in which value is created by users, consumers of innovation in an individual way. Thus, the personalized experiences become a source of unique value for both parties in the relationship, which, from the perspective of the implementation of corporate interests, means that there is no possibility of value creation in an autonomous process. As a result, relational rent can be achieved not only in the inter-organizational space, but also within customer relations. The ever-present technology opens up a space in which there is no distance, “death of time” takes place, there is information chaos on the one hand, and the possibility of basically unlimited use of networked knowledge resources on the other, everyone can interact with everyone and appear on the market in various roles, private relations are increasingly becoming public.

These changes require a multifaceted view of human needs. Therefore, a person should be treated as an anthroposystem, an integrated whole, and thus, as a unity of interdependent levels of organization. By referring to this approach, we combine the needs with objective conditions of survival and development and relations that make a human being dependent on the environment. This makes us define the need as, on the one hand, human characteristic which causes that people cannot obtain optimal efficiency in preserving themselves and ensuring their own self-development without a given object, and on the other hand as a permanent dependence on the environment.

As a result, the definition of customer value is based on the concepts of J.C. Swenney and G.N., Soutar who – in addition to functional and emotional needs – also pay attention to the social dimension of customer value (Swenney and Soutar, 2001). A similar approach is proposed by A.W. Ulwick, for whom distinctive customer value must fulfill both functional and emotional tasks that – in turn – may be of a personal and social nature. The first result from how people want to feel and the other from how they want to be perceived (Ulwick, 2009). At the same time, taking into account the “new customer” who expects not only a product but also an interaction, we assume that the customer value in the digital space is not only the result of the autonomous action of both parties to the relationship, but the use of knowledge resources created with the cooperation of network users (partners in the value network). As a result, the research assumes that the value for the customer is a complex bundle of: economic, technical, social, symbolic, epistemic and psychological net benefits, the carrier of which is the customer-enterprise relationship established directly and through a network, resulting from the involvement of knowledge resources of the company and its related partners in the value system.

2.2. Technology acceptance and consciousness of network potential as a determinant of customer value

Moving the value creation process to the network does not mean a radical change in the value creation process itself. The process still focuses on building real customer loyalty, by creating a state of customer satisfaction, developing customer relationships, building trust and finally customer engagement (Brodie et al., 2011; Hughes et al., 2019) (Fig. 1 ).

The concept of loyalty in the general sense of the word means a characteristic of entities that is most often associated with such attributes as: honesty, integrity, allegiance or devotion to someone. Therefore, speaking of customer loyalty, this term most often refers to the emotions that determine such customer behavior, the effect of which, among others, is active participation in the purchasing process.

Emotions imply actions. (Hollebeek et al., 2014; Liu et al., 2018; Caputa et al., 2021) Consequently, customer behavior which consists in “renewing purchases of a given brand, purchases from the same point of sale or from the same seller” is considered loyal. (Stṻker, 2008; Rodríguez et al., 2019). The motives and reasons for this behavior may be different, which prompts many authors to highlight:

• •

  apparent (passive) loyalty, which is based on a rational (i.e. conscious and motivated) behavioral reaction in the form of re-using the offer, while being related to the customer's tendency to purchase a given product as one of many available products.

• •

  occasional loyalty, which is forced by: circumstances, situation or individual customer characteristics, and

• •

  real loyalty. Its final objective is to develop in the customer a state of inertia (habit), combined with a tendency to overcome obstacles, and even a commitment to undertake multidimensional activities, that is to purchase the product, support its sale, initiate an information message and co-create (Casalo et al., 2007).

Real loyalty is established on the basis of subjective feelings, sometimes leading to their individual attachment and even utmost loyalty to a “brand”, so it is established on emotional premises and in a conscious state (Kotler and Bliemel, 2005; Xu and Weyer, 2007; Rodríguez et al., 2019).

In the times of progressing digitalization, the process of establishing a relationship has been moved into the virtual space. As a result, a relation is established through technology. It means that, in order to establish it, both parties must accept the use of the technology.

This problem was raised by F.D. Devis, proposing a widely commented model of technology acceptance (Davis, 1989). The basis for this model is the assumption that the use of technology is determined by the intention to use it. As proven by D. Geffen and D. Straub, it can be linked both with looking for information about the product and with the purchase itself (Geffen and Straub, 2000). F.D. Devis sees its sources in the attitude of the customer towards the use of specific solution, determined by perceived usefulness, reflecting the extent to which the user believes that they will benefit from the use of a particular solution. This factor influences both intentions towards information-seeking and purchase intentions and perceived ease of use, which – in turn – reflects the user's assessment of the ease of use of a given tool, while this factor determines only the information-seeking intentions. In the course of further modifications of this model undertaken by D.L. Goodhue and R.L. Thompson (Goodhue and Thompson, 1995), K. Amoako-Gyampah and A.F. Salam (Amoako-Gyampah and Salam, 2004), J.W. Moon and Y.G. Kim (Moon and Kim, 2001), the catalog of factors was expanded to include, among others: perceived enjoyment (Moon and Kim, 2001), which is also related to intrinsic motivation to use the technology, and perceived compatibility of the technology with the goals of its use (Goodhue and Thompson, 1995).

These concepts fill in a gap in the scope of understanding the predictors of human behaviors towards potential acceptance or rejection of technology (Marangunić and Granić, 2015). They link the customer's attitude with the intention to use the technology, but in the purchasing process they link it with the search for product information, the intention to buy the product. They pass over the intentions that may be involved in the very interaction between web users. The perceived usefulness is linked with benefit; therefore, this benefit must be a conscious one. As a result, the user must be able to use the network, but also must be aware of the benefits that come with using the network's potential. This factor is indicated as a determinant of the customer's market and resource potential (Caputa et al., 2021). In the research carried out so far, it is not, however, linked with the benefits. Meanwhile, the activity mediated by technology, including activity in social relational networks, is also linked with the risks (hazards) associated with the use of technology and information transfer^. (Chen et al., 2012).

The threat is directly related to the need for security. Hence, the value of the relationship may also determine the security of the relationship as perceived by both parties to the relationship. As a result, awareness of the network's potential and the ability to use it should also be combined with online security consciousness.

2.3. Being security conscious

The idea of consciousness does not have a uniform definition (Vimal, 2009). In publications on consciousness in the context of customer–business or customer–customer relations, it is used in the sense of the Latin term for consciousness – “conscientia”. The word was coined by combining the words “con” (“co”) and “scientia” (“knowledge”). As a result, consciousness is combined with the ability of recognition (for example, brand awareness, ecological awareness).

In a broader, more metaphorical sense, the term “scientia” is treated as knowledge that a person shares, as it were, only with himself or herself. As a result, in common usage, the terms “consciousness” and “conscious” usually refer to the state of “being aware” understood in two ways: as “being conscious” or as “being aware of something” (Jonkisz, 2012). In the field of social sciences, the concept of consciousness is linked to the second indicated meaning. As a result, consciousness is equated with the intellectual state of individuals or society that results from the degree of knowledge, understanding and rational valuation of facts or events (Pazio and Formanowska, 2002). It is also equated with knowledge and the ability to use it rationally in the context of an emerging problem (Szumlicz, 2006). In a narrow sense, it is also regarded as a measure or indicator of the intellectual level of individuals and social groups (Sułkowska, 2000).

As a result, the concept of consciousness is linked to the ability to generate, process and use information. This skill is largely determined by a person's personality, that is “a set of fixed and variable psychophysical characteristics that are related to all the activities, sensations and needs of a person at the physiological, character, intellectual and spiritual levels” (Horzyk, 2012).

We assume that although consciousness remains related to knowledge, and, therefore, to the intellectual level, it is in fact a mental state (a set of mental states), in which the individual is aware of his or her own thought processes (self-awareness) and of phenomena occurring in the external environment and is able to respond to them (somatically or autonomously). In such an approach, the emphasis is put on the so-called transitive consciousness, that is consciousness which is directed towards “something”. Thanks to this consciousness, a person is able to perceive, for example, a source of risk and therefore he or she can avoid it. It is an intentional consciousness that can be graded. As P. Carruthers states, the degree to which a person “is aware of an object/event is in fact the degree of intensity and accuracy of the perceptions generated by that object/event, resulting from the degree of attention paid” (Carruthers, 2003). Such an approach to consciousness is also linked with the need for security.

Building customer–enterprise relationship in virtual space is inextricably linked to the necessity to satisfy the need for security. In general terms, security means a state in which the individual feels safe and does not identify any threats. It is a subjective state (Williams, 2008). As a result, it can be assumed that security is a function of two main factors of threat and probability of its occurrence.

This need, in a new environment, takes on a new dimension. The threat, as a rule, is not material. Its origins are in the space in which data and information processing and interactions in ICT networks take place (Zhang, 2020). The source of threat can be found at every stage of relationship building, even before the transactional contact is established (Caputa, 2020). These risks can have a negative impact on customer satisfaction, trust and commitment. Therefore, threats must be of interest both for the customer and for the vendor.

We assume that the need for network security is felt by both parties to the relationship (H1). This hypothesis is related to the first link of the triad, i.e. the perception of risk, and its verification is related to the question “do the parties to the relationship perceive the threat?”

If the customer does not identify them, or identifies them but does not take, or is unwilling (consciously) or unable to take, any protective actions, such behavior indicates the existence of a network security consciousness gap. This vulnerability may also occur on the side of the enterprise. Establishing and developing relationships, even if they are an on-line mediated relationship, requires human activity.

As a result, security consciousness should be linked, on the one hand, to the customer's willingness and ability of both parties to the relationship to perceive these risks and, on the other hand, to the tendency to take measures against their negative consequences. This is related to the next links of the triad (activity-knowledge) and other research questions: do both parties to the relationship know the methods and are able to use technology to secure their own resources used in the relationship? And do they actually use these opportunities? These questions relate to the risk of a threat and confidence in protective measures. Many years of experience of enterprises in the field of risk management, including the creation of a security culture, allow us to adopt the hypothesis that the level of awareness of network security is higher on the supply side of the relationship (H2).

The above considerations give rise to the conclusion that the value for the customer, assessed from the perspective of both parties to the relationship, is directly related to the implementation of the purchasing process. This process begins with the realization of the need and ends with its evaluation after the purchase (Pride and Ferrell, 1994), and even with the disposal of the product. (Karders, 1999). Universal access to the Internet and the growing use of mobile devices has created favorable conditions for establishing online relationships. Such relationships are increasingly used by consumers who are also members of online communities, and even initiate their creation. Thus, this market actor is entangled in a network of relationships that allows for multidimensional threat analysis and the assessment of network security awareness. Undertaking research focused on the behavior of key participants in relations throughout the purchasing process, i.e. not only on the execution of transactions, but also on the processing, transmission and use of information and the perception of related risks, broadens the scope of the research conducted so far.

The aim of the research is to show that the awareness of network security is a determinant of the dually perceived and defined customer value that underlies every company-customer relationship.

Subjective perception of the state of security means that the scale of freedom from threats is different for each participant in the relationship who consciously or intuitively determines his or her system of values and needs and whether they are at an acceptable and expected level (Wadeley et al., 2000). It is an invitation to analyze network security awareness in three dimensions: perception, behavior (actions) and knowledge related to counteracting threats.

3.1. Research methodology

Based on the methodology of research conducted in the areas of security consciousness (Pazio and Formanowska, 2002; Szumlicz, 2005) we combine the need to assess the awareness of security of the online shopping process from the perspective of: subjective perception of threats, actual risk-preventive behavior and knowledge of reducing such risk.

The research methodology, presented in Fig. 2 , was subordinated to the adopted research objective.

We analyze the indicated elements of the triad from the perspective of the customer and the bidder, based on the input from the results of the review of international databases.

Empirical research was based on a review of statistical data, research conducted in other entities and the results of own questionnaire research. The methodology of these tests is described in detail in Section 3.2. Although the own research was subjected to statistical analysis, due to its fragmentary use in the analysis of the indicated problem, we refer to its results omitting the detailed presentation of the results of the statistical analysis. As a result, we consider the presented research to be qualitative research, describing a certain fragment of reality that will allow to verify the hypotheses and achieve the research goal, and at the same time will constitute the basis for the development of a methodology that will allow in the future for a comprehensive analysis of the potential of network awareness and the ability to use it by both parties to the relationship.

3.2. Epistemological and empirical research characteristics

When analyzing the role of network security consciousness in the context of customer value assessment, we based the conceptual part of the research on the review of existing research addressing the issue of establishing customer relationships. Our research was based on the resources of major international databases covering the years from 2016 to 2021.

The numerical comparison of publications clearly shows that the interest in the issue of customer relations has been steady for years (Table 1). Along with the increasing process of digitalization, this research is more and more focusing on the multidimensional aspects of building relationships online. It became necessary to narrow them down to those that directly address the issue of customer awareness. (Fig. 3 ). In the end, we have based our epistemological research on publications referring simultaneously to five key words: awareness, customer, network, risk, security.

In the end, eighty-six studies were selected for final review. Exploration of their content made it possible to identify universal factors determining the development of customer relationships (satisfaction, intimacy, trust, commitment) and detailed factors influencing the customer's market and resource value.

In the set of specific factors (revenue power, direction of reference, strength of message, quality of message, etc.), there were also those which, while influencing the potential of network awareness and the ability to use it, are directly related to network security consciousness. These factors are linked with privacy concerns, level of technological readiness, perceived risk of technology use and even security culture (Caputo et al., 2018; Astakhova, 2020).

The review of the studies revealed a lack of a uniform approach when it comes to defining awareness, and the multifaceted nature of the topic of network security consciousness. In order to organize these data, we used the Generic Contingency Principle methodology, which refers to grounded theory assumptions (Lallẻ, 2003). We assumed that an analysis of network security consciousness focused on the enterprise-consumer relationship situates us in the role of observer and witness ordering the facts.

To fulfill this role, it is required to look at the problem of network security consciousness in a broader context. In a networking society, computer and mobile device users are integrated. It is reasonable to conclude that security consciousness is an issue not only for the customer, but also for the company and society as a whole. In this part of the research, by way of referring to the results of, among others, the IQ Digital Report, we demonstrate the importance of digital competences related to cybersecurity and data protection in enterprises. This part of the research indicates not only the type but also the scale of threats faced by the web user.

As the review indicates, creating customer value today involves the need to use not only technology, but also the network of relationships established through it. Online relationships make it possible to obtain a number of benefits, provided that the user is aware of the potential of the network and is able to make use of it (Krajobraz bezpieczeństwa). Although this factor is indicated as a determinant of customer value, it is – nevertheless – defined through the prism of benefits. However, the use of the network is also linked with threats that, by affecting the customer's sense of security, may have a negative impact on the level of his or her satisfaction, on the readiness to establish close relations, trust and commitment, and thus, ultimately, on the customer value.

Safeguarding against the risks arising out of the use of and presence in the network is linked to the possibility of using appropriate technologies. However, this is combined with the ability to use it. It is also linked with the attitude of the user, who may or may not see the need to use security technology or the need to take action of this kind. As a result, network security consciousness can also be a determinant of customer value, which we base on the triad (PAK):

• •

  P (perception) - ability to identify threats resulting from online relationships and to estimate the level of risk of their occurrence,

• •

  A (action) - ability to undertake safeguarding measures and to use safeguarding technology,

• •

  K (knowledge) - knowledge of the use of means (technology) to ensure the security of such relationships.

As indicated by the literature review, consciousness can be learned first-person (subjectively), or third-person (objectively) from the perspective of the subject or the observer (Jonkisz, 2012). By becoming the observer, we explore awareness through the consumers' perception of security of relationships (P) and customer's behavior (A).

In order to achieve the research objective and verify the hypotheses, we used the results of our own survey research. The questionnaire, after the pilot study, was revised and made available online. To ensure adequate representation in each age group, 134 questionnaires were completed directly. The questionnaire was completed by 1245 people. The adopted statistical error of the research sample is at most ±5, with an assumed confidence factor of 0.99. Hypothesis verifications were carried out on a randomly selected sample of Polish residents aged 10 to 70. The sample consisted of 52 % of women and 48 % of men, which corresponds to the population structure of Poland. It is also differentiated by: age, education and status of the respondent, while in each of the distinguished categories the representativeness of the results was preserved.

When analyzing the survey results, we used the basic characteristics of descriptive statistics analysis (for example arithmetic mean, standard deviations), and correlation analysis based on the use of Spearman's rank correlation coefficient or Pearson's linear correlation coefficient, selecting an appropriate measure depending on the correlated variables and the distribution of these variables. The occurrence of normal distribution of the studied variables was verified with the use of the Shapiro-Wilk test.

The main objective of the research was to learn more about consumers' purchasing behaviors, with particular emphasis on those related to the use of the network potential. In this article, we use only the part of the results that deals with network security consciousness.

The referenced studies did not address the third element of the triad - knowledge. When addressing this issue, we used, among others, the results of a report prepared by SW Research (Co Polacy wiedzą), CERT Polska (Krajobraz bezpieczeństwa) and Mbank (Korzystanie z bankowości). This allowed us to extend the scope of the research not only to behavior, but also to the customer ‘self-awareness’.

4.1. The threat to online security in the light of statistics

The perception of risks arising from the use of the network is directly related to the frequency and the financial and non-financial effects of their occurrence. As research shows, in Poland, in 2016, the number of cyberattacks as compared with the previous year increased by 46 %, and the results of these attacks in 33 % translated into financial losses, in 31 % caused the disclosure or modification of data and as much as 16 % influenced the loss of reputation of an enterprise (Koszty cyberprzestępczości).

Back in 2016, it was estimated that financial losses due to the global activity of cybercriminals will increase from USD 3 trillion to USD 6 trillion by 2021. Analysts linked such a high level of losses mainly to costs associated with the destruction of key data, theft of financial resources, intellectual property, personal and operational data, as well as loss of reputation enjoyed among customers. Therefore, they pointed to a key factor in securing not only the sustainability but also the profitability of the relationship with a customer.

These assumptions turned out to be correct but underestimated. In 2020, phishing attacks alone cost an average organization USD 1.4 million (Ninth Annual Cost). Cybersecurity claims have also increased in the relatively new insurance product market. As compared with 2016, it is a 12-time increase. Over the past five years, there has been a 70 % increase in the average cost (up to USD 13 million) of cybercrime to be borne by organizations and a 60 % increase in the average number of security breaches (Managing the Impact).

It is also worth noting that in 2019, CERT Polska registered 6484 incidents (Krajobraz bezpieczeństwa). As compared with previous year, this number increased by 73 %. The most common types of attacks were: phishing (54.2 %), malware notifications (14.9 %), and “offensive and illegal content”, including spam (12.1 %). Numerous cases and variants of e-commerce scams have been reported, from listings on classifieds portals to fake shops. A significant proportion of scams on the Polish Internet use fake payment gateways combined with emails or text messages informing about the need to make a small payment - for shipping, parcel surcharges, etc. An increasingly common problem is the dissemination of false information, for example inducing people to visit a fake website or provide access data. In 2019, emerging malicious applications for Android system impersonated, among others, banks or courier companies and the police (Krajobraz bezpieczeństwa).

The mentioned data provide sufficient confirmation of the existence of such online threats that may also manifest themselves during the shopping process, which is more and more often carried out using mobile devices (E-Commerce w Polsce, 2020; E-Commerce, 2021). Thus, we are dealing with an increase in the risks arising from the use of the network, which both parties to the relationship are exposed to.

4.2. PAK from the perspective of the supply side of the relationship

Basing network awareness on the PAK triad allows it to be considered as a manifestation of digital intelligence, being the sum of competences: technical, mental and social. This factor determines the behavior of both parties in the relationship, all the more so as securing the sustainability of the relationship from the perspective of the vendor is now linked with the need to create trust and commitment on the part of the customer in the network (Hollebeek et al., 2014; Hughes et al., 2019; Obilo et al., 2021). This, from the vendor's perspective, requires widely understood digital competencies, including those that safeguard the security of online relationships.

The results of the research included in the Digital IQ Report - the digital race of companies (Digital IQ Raport) back in 2017 indicated that for both Polish and foreign companies the basic barrier to the progressive digitalization process is the competence barrier. Its existence was indicated respectively by 69 % of respondents in Poland and 63 % worldwide, with one in three respondents believing that this gap would widen in the future. Competences related to cybersecurity and data protection were also identified in the set of key competences from a company development perspective (Fig. 4 ).

This competence was found in the set of three of the least appreciated competences, both by respondents representing foreign and Polish companies. Polish respondents not only rated the role of the indicated competences lower, but also gave a good assessment of the current level of their development.

This situation has changed radically over the last few years, especially in 2020. The most recent Dell Digital Transformation Index research report indicates that Poland ranks 3rd among countries with the highest digital maturity, and the entire digitalization process - both in Poland and around the world - radically accelerated (Digital Transformation Index) (Fig. 5 ).

However, it is worth emphasizing that data collected from a survey addressed to more than 4300 managers representing 13 industries and 18 countries, including Poland, showed that organizations during the pandemic managed to at least partially implement digital transformation plans that, in addition to securing remote working, mainly concerned strengthening the security of ICT infrastructure.

This direction of undertaken activities was indicated by 80 % of the respondents. In the research on the set of main digitalization barriers referred to above, Digital Leaders and Adopters are more likely to cite data privacy and security concerns as a major barrier to transformation – suggesting a level of awareness that others lack.

Adopting this direction is justified not only in the view of the radical increase in the amount of data that will have to be subject to cybersecurity, but also the phenomenon of crime moving online.

The above-mentioned data clearly indicate that there is an increase in the threats faced by enterprises in connection with the use of technology and networks on the one hand, and, on the other, an increase in their awareness when it comes to the implementation of security measures. However, a number of research point to the existence of a security gap, the root cause of which are employee errors. Therefore, a key corporate strategy is now the Zero Trust strategy that encourages companies not only to invest more in technical strengthening of security systems, but also to develop procedures and systematic training.

4.3. PAK from the perspective of the demand side of the relationship

The need for security results from threats to which a person reacts autonomously or intuitively. Having in mind the online purchasing process, these threats may manifest themselves at the stage of identifying the need, searching for information, assessment of possible decision choices, making the decision about the purchase, or feelings after the purchase (Pride and Ferrell, 2007; Caputa, 2020). The assessment of these threats may be done by the customer both when they are shopping online and when they are offline.

The results of the survey indicate that the majority of respondents used the web to make purchases (59 %). The majority of buyers could be found among the youngest group of respondents aged 25–34 (67 %), those with higher education (67 %) and those with the highest income. The least active were consumers aged 55 and older, declaring a primary education (34 %). The wireless network is used by 86 % of respondents. Online purchases are most often made with the use of laptop (76 %), mobile phone (61 %) and personal computer (54 %).

The respondent's profile and their shopping activity is also confirmed by other studies. What is more, representative research conducted already in 2020 indicate an increase in the willingness of the Internet users to carry out the purchasing process online by up to 6 %, as well as an increase in the share of mobile devices in this process (E-Commerce w Polsce, 2020; E-Commerce, 2021).

The perception of threats is directly related to the first element of the triad, which can be analyzed in the context of the image of the relationship perceived by the customer. Overall, this image is positive (Table 2 ). The majority of respondents deems online purchases to be safe, uncomplicated and convenient.

This approach is not significantly differentiated due to age, education or gender. Only 19 % of respondents perceives these relations as risky.

The presented research results are also confirmed in representative E-Commerce research in Poland in 2020, as well as in E-Commerce research conducted in 2021. The positive image of relations in the context of security was confirmed in the research by 60 % of respondents, with 24 % of respondents without their own opinion on it (E-Commerce w Polsce, 2020; E-Commerce, 2021).

When identifying the perceived online threats, we referred to factors that, according to the respondents, could encourage them to use online shopping more often (Fig. 6 ).

The set of factors also included those that directly and indirectly influenced the risk perception of such relationships.

The respondents mainly pointed out to:

• •

  payments security (19 %),

• •

  better product exposure, including better quality pictures (21 %).

Respondents perceive the threats resulting from the use of the network, identifying mainly the risk of choosing the wrong product and the risk of losing financial resources. Due to the implications of online payments for assessing security consciousness, the first factor was of the greatest importance. As a motivating factor encouraging to make more frequent purchases it is indicated more often by women, people with higher education and the youngest respondents (Fig. 7 ).

Consequently, this means that the listed groups identify the risk these payments bear. This attitude can be a factor that discourages the user from purchase, or it can reduce satisfaction.

As shown by the results from Fig. 7, respondents who are not consumers link online shopping with higher risk (20 %). In the set of factors that discourage such respondents from shopping and that are directly related to the need to use the web, the fear of payment security takes first place. This factor was indicated by almost 18 % of respondents.

When looking at the digital skills of the consumer, it is also worth noting that 3 % stated that buying online was simply too complicated and 12 % indicated that they did not know how to do it. Respondents actively use the web not only for social or professional purposes but also for the information and knowledge transfer. Although research shows that men use online services more broadly (64 %) than women (54 %), no statistically significant differences in behavior between these two genders were identified. However, it is the age of the respondent that is the determinant of online behavior. Both Spearman's and Pearson's rank correlation coefficients indicate a strong negative correlation (above 0.9). Respondents' network activity also indicated weak correlation with their education (Spearman's coefficient = 0.4) (Caputa et al., 2021).

By using the network multidimensionally, the respondent supports their decision-making process, for example, when selecting a supplier (Table 3 ).

17 % of the respondents for that purpose uses websites, opinions posted on social media, 14 % uses social media and 16 % follows the recommendations of their friends.

The indicated forms of support for the purchasing process are of significant importance for young people (aged 15–24). Opinions posted on social media, feeds of their friends or posted on websites influenced the first vendor selection for more than 24 % of respondents in this age group. These young respondents are the most active in the network.

The importance of the discussed message should also be considered in the context of building trust. The research indicated that the opinion about the vendor was the most frequently indicated variable (53 %) that the respondents use when selecting a given vendor, regardless of their age, gender or education.

As it results from the research, the respondents use the network in a multidimensional way. It is for them a space used for personal, social and professional purposes, as well as a place where they can share knowledge and information. Such a dynamic use of the network exposes the users to threats but can also be a way to reduce the risks linked with the implementation of the purchasing process. Respondents undertake a range of such activities, such as using other people's knowledge and opinions. However, they most often directly link security with online payments.

The empirical research clearly shows that the online relationship between the respondent and the vendor is – by the majority of respondents – perceived as secure. For a full assessment of security consciousness, the question is whether the subjective perception of the relationship as safe is due to a gap in knowledge about the very dangers of being online or having that knowledge but not undertaking the recommended activities to safeguard this safety. Given the general access to the Internet and the resulting increase in the number of Internet users, it can be assumed that the Polish Internet user is also a consumer, exposed to the risks indicated in Section 3.2.

The mentioned data provide sufficient confirmation of the existence of such online threats that may also manifest themselves during the shopping process, which is more and more often carried out using mobile devices (E-Commerce w Polsce, 2020; E-Commerce, 2021).

In the context of security consciousness, the question of where Internet user store their most important data becomes important. As indicated by the Polish Social Cybersecurity Barometer (2019), 55 % of Internet users store such data on a smartphone or mobile phone, 21 % on a desktop computer, 11 % use flash drive and the rest use cloud computing (8 %) or other devices (Polski Barometr Cyberbezpieczeństwa Społecznego). It is worth emphasizing that the dominant group uses a mobile device for such purposes. At the same time, the data presented in Table 4 show that only 6 % of respondents protect this device with any software.

Paradoxically, the Internet user is better at securing their desktop computer, where they store less data. As indicated in Table 4, 11 % of respondents never change passwords on their computer, smartphone, mailbox or social networks, 28 % do so once a year, 15 % once a quarter and only 9 % once a month. Therefore, the user fails to take the basic security precautions that every bank, the customer of which is an Internet user, makes available on its website.

This inconsistency indicates that most Internet users are unaware of online threats, or underestimate the likelihood of their occurrence, wrongly believing that their mobile phone/smartphone is not an attractive target or ignore this threat at least until they become victims themselves.

The structure of the Internet users' answers to questions that allow to learn more about the awareness of threats unambiguously shows that the Polish Internet user feels safe on the Internet, and at the same time, has a misleading conviction that they know it. This is confirmed by numerous studies. They show that, among others, only demonstrate of the respondents can manage malware and 40 % of technologically advanced users used the support of third-parties in such a situation. This group of users is more likely to update the operating system on their computer and use antivirus software, is more likely to purchase licensed antivirus products and, at the same time, as much as 43 % of the respondents in this group use foreign devices when using the bank's services (Bezpieczeństwo elektoniczne). This is one of the evidences of the gap between knowledge and that part of consciousness which, in addition to knowledge, influences approaches.

5.1. Implications for practice

Relating the presented results to practice may be helpful for enterprises. They constitute a significant supplement to the set of factors determining the dually defined customer value with the awareness of network security. A lack of correspondence was identified between the categories: awareness and knowledge as well as knowledge and its active application in action. From the perspective of practice, this means the need to search for such methods and instruments, the use of which reduces the indicated gaps. As a result, it leads to the creation of a fully aware user of the network. Such a user is able to identify threats, knows how to prevent them and takes such actions. As a result, their conduct allows to significantly reduce the negative consequences of the occurrence of network threats.

Attention was also paid to the necessity to create a risk culture in the customer-enterprise relationship, indicating the need for an active role of the customer, who should become a risk-aware entity and take active measures to effectively reduce it. Such an entity is able to protect its tangible and intangible resources and base its trust in the bidder, not on imagination, but knowledge and conscious action. Basing security awareness on the triad of perception, action and knowledge may point the way to establishing security awareness in the enterprise, which has significant management implications in creating and developing relationships with the customer. Our approach can be a guide to the search for factors determining their formation and measures of the effectiveness of activities undertaken in this area.

This approach is the basis for the entire process of building a safety culture – not only for the enterprise, but also for the entire society.

One of the main challenges of education in the 21st century is increasing awareness of the network potential and identification of network risk factors. Activities in the digital world cannot only focus on creating skills related to using IT infrastructure or developing relationships. Creating a culture of network security among the youngest generation and developing it in the later stages of education is the basis of their future behavior.

The proposed research methodology is another important element that can be used in practice. Research conducted to assess the awareness of network security of Polish residents can be successfully conducted according to a similar scheme used in every other country in the world, which ensures comparability of results.

5.2. Future research directions

The directions of future research can be presented in several dimensions. This study focuses on increasing awareness of the security of establishing, maintaining and developing business-client relationships. Basically, the development of technology and network use increases the cybersecurity problem, which requires identifying risk culture factors and understanding the need for an active customer role. Therefore, this research, in addition to being a new approach, has social utility. An important aspect is also the international dimension, which allows for a more complete understanding of the problem of network security awareness. It is particularly interesting to compare the awareness of network security from the perspective of inhabitants of countries belonging to different cultures.

The general perspective of research focused on the consumer market adopted for the purposes of this analysis may in the future be expanded to include B2C market relations and – at the same time – enriched with a detailed analysis of the impact of network security awareness on other factors determining customer attitudes and behavior.

Another direction of future research can focus on the need to identify the factors determining the links of the proposed triad, which will allow for the creation of mental models of phenomena, events and processes in the surrounding reality, a communication system, and finally a better understanding of the human attitude towards information and related technologies and processes that may manifest itself as technology acceptance.

Another research direction is a comparative perspective. Determining the qualitative and quantitative characteristics of the security awareness of the network potential may be important from the perspective of comparison with other enterprises, regions or countries.