Understanding the role of cybersecurity culture in the gig economy: the case of platform-based food delivery workers in Gauteng

Radebe, Mlungisi

Understanding the role of cybersecurity culture in the gig economy: the case of platform-based food delivery workers in Gauteng

Thesis / Dissertation

2025

Publisher

University of Cape Town

Department

Department of Information Systems

Faculty

Faculty of Commerce

Abstract

The growth of gig economy platforms has coincided with increased cybersecurity threats and attacks. As gig platforms have evolved, so too have cybercriminals, with attacks such as malware, phishing, and social engineering becoming increasingly sophisticated and human centric. However, cybersecurity defence mechanisms are still centred around traditional technical controls. In response to this growing threat landscape, researchers argue that organisations should implement other mechanisms to counter the threat. Embedding a cybersecurity culture in organisations has gained prominence in recent studies. However, studies on the cybersecurity culture in the gig economy, focusing on food delivery workers, are needed, as there is currently limited literature on this phenomenon. This research report explored the nature of cybersecurity culture in the context of platform-based food delivery workers in Gauteng, South Africa. The main research question explored the following: How does the cybersecurity culture influence the cybersecurity behaviours of food delivery gig workers? The Cybersecurity Culture Model (CCM) was used as a sensitizing theoretical device to develop the initial interview guides, observation protocols, and the preliminary coding schemes. A qualitative research strategy was adopted using semi-structured interviews as the primary data source; furthermore, a qualitative research survey and publicly available documents and observations of the context were provided as secondary data sources. Fifteen (N=15) semi-structured interviews were performed with food delivery workers. Secondary data was acquired via online searches (N=11), web articles on the gig economy, three (N=3) online qualitative surveys, and contextual observations by interacting with food delivery workers at their pick-up sites. Data analysis was conducted using established guidelines for inductive data analysis using the NVivo 14 software. The research revealed significant barriers to implementing cybersecurity culture in the food delivery sector of the local gig economy. Workers receive minimal cybersecurity education and training, with limited management communication about security policies and procedures. Gig work apps present additional challenges, contributing to a virtually non-existent cybersecurity culture among food delivery workers in Gauteng, South Africa. Weak management initiatives, inadequate training, and absent security policies drive non-compliance, further complicated by conflicts between financial incentives, personal safety, and cybersecurity requirements. These findings highlight structural gig economy issues, underscoring the need for enhanced cybersecurity governance, comprehensive training programs, and integrated information security policies. Future research should examine platform providers' responsibilities in cybersecurity culture development and methods to align safety priorities with cybersecurity compliance.