{"id":"https://openalex.org/W7167573083","doi":"https://doi.org/10.1016/j.cose.2026.105051","title":"Strategic illusion and symbolic oversight: An empirical study of cybersecurity in healthcare boardrooms","display_name":"Strategic illusion and symbolic oversight: An empirical study of cybersecurity in healthcare boardrooms","publication_year":2026,"publication_date":"2026-07-07","ids":{"openalex":"https://openalex.org/W7167573083","doi":"https://doi.org/10.1016/j.cose.2026.105051"},"language":"en","primary_location":{"id":"doi:10.1016/j.cose.2026.105051","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2026.105051","pdf_url":null,"source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1016/j.cose.2026.105051","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5031557739","display_name":"Jostein Jensen","orcid":null},"institutions":[{"id":"https://openalex.org/I2799829267","display_name":"Simula Research Laboratory","ror":"https://ror.org/00vn06n10","country_code":"NO","type":"facility","lineage":["https://openalex.org/I2799829267"]}],"countries":["NO"],"is_corresponding":true,"raw_author_name":"Jostein Jensen","raw_affiliation_strings":["Simula Research Laboratory AS, Oslo, Norway"],"raw_orcid":"https://orcid.org/0009-0003-4212-9638","affiliations":[{"raw_affiliation_string":"Simula Research Laboratory AS, Oslo, Norway","institution_ids":["https://openalex.org/I2799829267"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5091771936","display_name":"Farzana Quayyum","orcid":"https://orcid.org/0000-0002-7143-1348"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Farzana Quayyum","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0000-0002-7143-1348","affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001021705","display_name":"Lillian R\u00f8stad","orcid":null},"institutions":[{"id":"https://openalex.org/I2799829267","display_name":"Simula Research Laboratory","ror":"https://ror.org/00vn06n10","country_code":"NO","type":"facility","lineage":["https://openalex.org/I2799829267"]}],"countries":["NO"],"is_corresponding":false,"raw_author_name":"Lillian R\u00f8stad","raw_affiliation_strings":["Simula Research Laboratory AS, Oslo, Norway"],"raw_orcid":"https://orcid.org/0009-0009-1857-3767","affiliations":[{"raw_affiliation_string":"Simula Research Laboratory AS, Oslo, Norway","institution_ids":["https://openalex.org/I2799829267"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5000542963","display_name":"Olav Lysne","orcid":null},"institutions":[{"id":"https://openalex.org/I2799829267","display_name":"Simula Research Laboratory","ror":"https://ror.org/00vn06n10","country_code":"NO","type":"facility","lineage":["https://openalex.org/I2799829267"]}],"countries":["NO"],"is_corresponding":false,"raw_author_name":"Olav Lysne","raw_affiliation_strings":["Simula Research Laboratory AS, Oslo, Norway"],"raw_orcid":"https://orcid.org/0000-0001-5624-5929","affiliations":[{"raw_affiliation_string":"Simula Research Laboratory AS, Oslo, Norway","institution_ids":["https://openalex.org/I2799829267"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5031557739"],"corresponding_institution_ids":["https://openalex.org/I2799829267"],"apc_list":{"value":3190,"currency":"USD","value_usd":3190},"apc_paid":{"value":3190,"currency":"USD","value_usd":3190},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.88678256,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"170","issue":null,"first_page":"105051","last_page":"105051"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.5834000110626221,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.5834000110626221,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.048700001090765,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12221","display_name":"Cybersecurity and Cyber Warfare Studies","score":0.043699998408555984,"subfield":{"id":"https://openalex.org/subfields/3320","display_name":"Political Science and International Relations"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/accountability","display_name":"Accountability","score":0.7864000201225281},{"id":"https://openalex.org/keywords/corporate-governance","display_name":"Corporate governance","score":0.6470999717712402},{"id":"https://openalex.org/keywords/empirical-research","display_name":"Empirical research","score":0.5210999846458435},{"id":"https://openalex.org/keywords/operationalization","display_name":"Operationalization","score":0.5187000036239624},{"id":"https://openalex.org/keywords/health-care","display_name":"Health care","score":0.5045999884605408},{"id":"https://openalex.org/keywords/secrecy","display_name":"Secrecy","score":0.44440001249313354},{"id":"https://openalex.org/keywords/data-breach","display_name":"Data breach","score":0.4336000084877014},{"id":"https://openalex.org/keywords/divergence","display_name":"Divergence (linguistics)","score":0.39070001244544983},{"id":"https://openalex.org/keywords/qualitative-research","display_name":"Qualitative research","score":0.34610000252723694}],"concepts":[{"id":"https://openalex.org/C2776007630","wikidata":"https://www.wikidata.org/wiki/Q2798912","display_name":"Accountability","level":2,"score":0.7864000201225281},{"id":"https://openalex.org/C39389867","wikidata":"https://www.wikidata.org/wiki/Q380767","display_name":"Corporate governance","level":2,"score":0.6470999717712402},{"id":"https://openalex.org/C39549134","wikidata":"https://www.wikidata.org/wiki/Q133080","display_name":"Public relations","level":1,"score":0.5985999703407288},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.5210999846458435},{"id":"https://openalex.org/C9354725","wikidata":"https://www.wikidata.org/wiki/Q286017","display_name":"Operationalization","level":2,"score":0.5187000036239624},{"id":"https://openalex.org/C160735492","wikidata":"https://www.wikidata.org/wiki/Q31207","display_name":"Health care","level":2,"score":0.5045999884605408},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.45730000734329224},{"id":"https://openalex.org/C2776452267","wikidata":"https://www.wikidata.org/wiki/Q1503443","display_name":"Secrecy","level":2,"score":0.44440001249313354},{"id":"https://openalex.org/C165609540","wikidata":"https://www.wikidata.org/wiki/Q1172486","display_name":"Data breach","level":2,"score":0.4336000084877014},{"id":"https://openalex.org/C207390915","wikidata":"https://www.wikidata.org/wiki/Q1230525","display_name":"Divergence (linguistics)","level":2,"score":0.39070001244544983},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.3840000033378601},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.35519999265670776},{"id":"https://openalex.org/C190248442","wikidata":"https://www.wikidata.org/wiki/Q839486","display_name":"Qualitative research","level":2,"score":0.34610000252723694},{"id":"https://openalex.org/C204434341","wikidata":"https://www.wikidata.org/wiki/Q357789","display_name":"Adjudication","level":2,"score":0.32919999957084656},{"id":"https://openalex.org/C46934059","wikidata":"https://www.wikidata.org/wiki/Q61515","display_name":"Outsourcing","level":2,"score":0.32659998536109924},{"id":"https://openalex.org/C129631789","wikidata":"https://www.wikidata.org/wiki/Q334173","display_name":"Opportunism","level":2,"score":0.32510000467300415},{"id":"https://openalex.org/C166052673","wikidata":"https://www.wikidata.org/wiki/Q83021","display_name":"Empirical evidence","level":2,"score":0.31310001015663147},{"id":"https://openalex.org/C185874996","wikidata":"https://www.wikidata.org/wiki/Q269699","display_name":"Interdependence","level":2,"score":0.3000999987125397},{"id":"https://openalex.org/C2778137410","wikidata":"https://www.wikidata.org/wiki/Q2732820","display_name":"Government (linguistics)","level":2,"score":0.2989000082015991},{"id":"https://openalex.org/C2776697845","wikidata":"https://www.wikidata.org/wiki/Q537098","display_name":"Fiduciary","level":3,"score":0.29649999737739563},{"id":"https://openalex.org/C2780233690","wikidata":"https://www.wikidata.org/wiki/Q535347","display_name":"Transparency (behavior)","level":2,"score":0.28780001401901245},{"id":"https://openalex.org/C3116431","wikidata":"https://www.wikidata.org/wiki/Q31728","display_name":"Public administration","level":1,"score":0.2858000099658966},{"id":"https://openalex.org/C196879817","wikidata":"https://www.wikidata.org/wiki/Q872685","display_name":"Data governance","level":4,"score":0.28189998865127563},{"id":"https://openalex.org/C123403432","wikidata":"https://www.wikidata.org/wiki/Q654068","display_name":"Visibility","level":2,"score":0.27090001106262207},{"id":"https://openalex.org/C2777825026","wikidata":"https://www.wikidata.org/wiki/Q3410431","display_name":"Public trust","level":2,"score":0.2651999890804291},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.26330000162124634},{"id":"https://openalex.org/C198477413","wikidata":"https://www.wikidata.org/wiki/Q7647069","display_name":"Survey data collection","level":2,"score":0.2574999928474426},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.2567000091075897}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.cose.2026.105051","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2026.105051","pdf_url":null,"source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.cose.2026.105051","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2026.105051","pdf_url":null,"source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.6360373497009277,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":9,"referenced_works":["https://openalex.org/W2035546773","https://openalex.org/W3004617639","https://openalex.org/W3123282572","https://openalex.org/W4286509932","https://openalex.org/W4385628467","https://openalex.org/W4390965642","https://openalex.org/W4407074597","https://openalex.org/W4408750168","https://openalex.org/W4411379832"],"related_works":[],"abstract_inverted_index":{"Cybersecurity":[0],"is":[1],"increasingly":[2],"formalized":[3],"as":[4,13,146,176],"a":[5,37,55,73,147,153,219],"board-level":[6],"fiduciary":[7],"responsibility,":[8],"with":[9,54,96,114,178],"regulatory":[10,232],"frameworks":[11],"such":[12],"NIS2":[14],"imposing":[15],"explicit":[16],"accountability":[17,188],"on":[18],"directors.":[19],"Yet":[20],"empirical":[21],"evidence":[22,117],"of":[23,41,58,85,118,168,180],"how":[24,203],"boards":[25,204],"operationalize":[26],"this":[27,144],"responsibility":[28],"within":[29],"safety-critical":[30],"environments":[31],"remains":[32,194],"limited.":[33],"This":[34],"study":[35,40,172,198],"presents":[36],"mixed-methods":[38],"case":[39],"the":[42,165,171,206,228],"Norwegian":[43],"specialist":[44],"healthcare":[45],"sector,":[46],"triangulating":[47],"survey":[48],"responses":[49],"from":[50],"103":[51],"board":[52,60,100,129],"members":[53],"retrospective":[56],"analysis":[57,123,229],"594":[59],"protocols":[61],"comprising":[62],"6441":[63],"agenda":[64,106],"items":[65,107,112],"across":[66],"33":[67],"health":[68],"trusts.":[69],"The":[70,197],"findings":[71,175],"reveal":[72],"divergence":[74,145],"between":[75,208],"perceived":[76,157,209],"and":[77,212,247],"formally":[78,186],"documented":[79,116,161],"cybersecurity":[80,89,225,241],"governance":[81,162,184,214],"activity.":[82],"While":[83],"92.2%":[84],"directors":[86],"reported":[87],"that":[88,126,231],"strategy":[90],"was":[91,131],"at":[92],"least":[93],"somewhat":[94],"aligned":[95],"organizational":[97],"objectives,":[98],"formal":[99],"records":[101],"were":[102],"dominated":[103],"by":[104,134],"informational":[105],"(77.4%)":[108],"rather":[109],"than":[110],"decision":[111],"(22.6%),":[113],"limited":[115],"recurring":[119,244],"evaluative":[120,192,245],"deliberation.":[121],"Qualitative":[122],"further":[124],"indicates":[125],"more":[127],"active":[128],"engagement":[130,193,246],"episodically":[132],"triggered":[133],"audits,":[135],"threat":[136],"assessments,":[137],"or":[138],"tactical":[139],"risk":[140],"decisions.":[141],"We":[142],"conceptualize":[143],"Strategic":[148],"Illusion":[149],",":[150],"referring":[151],"to":[152,238],"condition":[154],"in":[155],"which":[156],"strategic":[158,210],"integration":[159],"exceeds":[160],"intervention.":[163],"Using":[164],"Five":[166],"Lines":[167],"Accountability":[169],"framework,":[170],"interprets":[173],"these":[174],"consistent":[177],"patterns":[179],"\u201costensible":[181],"adoption\u201d,":[182],"where":[183],"structures":[185],"reflect":[187],"expectations":[189],"while":[190],"substantive":[191,224,240],"unevenly":[195],"institutionalized.":[196],"contributes":[199],"mechanism-based":[200],"insights":[201],"into":[202],"navigate":[205],"tension":[207],"involvement":[211],"auditable":[213],"practice.":[215],"It":[216],"also":[217],"proposes":[218],"four-pillar":[220],"framework":[221],"for":[222],"strengthening":[223],"governance.":[226],"Overall,":[227],"suggests":[230],"visibility":[233],"alone":[234],"may":[235],"be":[236],"insufficient":[237],"produce":[239],"oversight":[242],"without":[243],"independent":[248],"inquiry-based":[249],"monitoring.":[250]},"counts_by_year":[],"updated_date":"2026-07-23T05:56:39.545243","created_date":"2026-07-08T00:00:00"}