{"id":"https://openalex.org/W4387418314","doi":"https://doi.org/10.1108/itp-11-2021-0864","title":"A qualitative study of penetration testers and what they can tell us about information security in organisations","display_name":"A qualitative study of penetration testers and what they can tell us about information security in organisations","publication_year":2023,"publication_date":"2023-10-06","ids":{"openalex":"https://openalex.org/W4387418314","doi":"https://doi.org/10.1108/itp-11-2021-0864"},"language":"en","primary_location":{"id":"doi:10.1108/itp-11-2021-0864","is_oa":false,"landing_page_url":"https://doi.org/10.1108/itp-11-2021-0864","pdf_url":null,"source":{"id":"https://openalex.org/S185256354","display_name":"Information Technology and People","issn_l":"0959-3845","issn":["0959-3845","1758-5813"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319811","host_organization_name":"Emerald Publishing Limited","host_organization_lineage":["https://openalex.org/P4310319811"],"host_organization_lineage_names":["Emerald Publishing Limited"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Information Technology & People","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://rke.abertay.ac.uk/ws/files/84460183/DePaoli_AQualitativeStudyOfPenetrationTesters_Accepted_2023.PDF","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5008737409","display_name":"Stefano De Paoli","orcid":"https://orcid.org/0000-0003-1120-4773"},"institutions":[{"id":"https://openalex.org/I877506347","display_name":"Abertay University","ror":"https://ror.org/04mwwnx67","country_code":"GB","type":"education","lineage":["https://openalex.org/I877506347"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Stefano De Paoli","raw_affiliation_strings":["Division of Sociology, Abertay University, Dundee, UK"],"raw_orcid":"https://orcid.org/0000-0003-1120-4773","affiliations":[{"raw_affiliation_string":"Division of Sociology, Abertay University, Dundee, UK","institution_ids":["https://openalex.org/I877506347"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5060980732","display_name":"Jason Johnstone","orcid":"https://orcid.org/0000-0002-1770-6849"},"institutions":[{"id":"https://openalex.org/I153648349","display_name":"University of Leicester","ror":"https://ror.org/04h699437","country_code":"GB","type":"education","lineage":["https://openalex.org/I153648349"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Jason Johnstone","raw_affiliation_strings":["School of Criminology, University of Leicester, Leicester, UK"],"raw_orcid":"https://orcid.org/0000-0002-1770-6849","affiliations":[{"raw_affiliation_string":"School of Criminology, University of Leicester, Leicester, UK","institution_ids":["https://openalex.org/I153648349"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.4365,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.70314018,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":94},"biblio":{"volume":"38","issue":"1","first_page":"380","last_page":"398"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9983999729156494,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/penetration","display_name":"Penetration (warfare)","score":0.5435779094696045},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.5056512355804443},{"id":"https://openalex.org/keywords/knowledge-management","display_name":"Knowledge management","score":0.5052648186683655},{"id":"https://openalex.org/keywords/originality","display_name":"Originality","score":0.4858655333518982},{"id":"https://openalex.org/keywords/qualitative-research","display_name":"Qualitative research","score":0.47700217366218567},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.4227040708065033},{"id":"https://openalex.org/keywords/thematic-analysis","display_name":"Thematic analysis","score":0.4161062240600586},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.31801092624664307},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.2451411485671997},{"id":"https://openalex.org/keywords/sociology","display_name":"Sociology","score":0.176476389169693},{"id":"https://openalex.org/keywords/operations-research","display_name":"Operations research","score":0.17458707094192505}],"concepts":[{"id":"https://openalex.org/C80107235","wikidata":"https://www.wikidata.org/wiki/Q7162625","display_name":"Penetration (warfare)","level":2,"score":0.5435779094696045},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.5056512355804443},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.5052648186683655},{"id":"https://openalex.org/C2776950860","wikidata":"https://www.wikidata.org/wiki/Q2914681","display_name":"Originality","level":3,"score":0.4858655333518982},{"id":"https://openalex.org/C190248442","wikidata":"https://www.wikidata.org/wiki/Q839486","display_name":"Qualitative research","level":2,"score":0.47700217366218567},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.4227040708065033},{"id":"https://openalex.org/C74196892","wikidata":"https://www.wikidata.org/wiki/Q7781188","display_name":"Thematic analysis","level":3,"score":0.4161062240600586},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.31801092624664307},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.2451411485671997},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.176476389169693},{"id":"https://openalex.org/C42475967","wikidata":"https://www.wikidata.org/wiki/Q194292","display_name":"Operations research","level":1,"score":0.17458707094192505},{"id":"https://openalex.org/C36289849","wikidata":"https://www.wikidata.org/wiki/Q34749","display_name":"Social science","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1108/itp-11-2021-0864","is_oa":false,"landing_page_url":"https://doi.org/10.1108/itp-11-2021-0864","pdf_url":null,"source":{"id":"https://openalex.org/S185256354","display_name":"Information Technology and People","issn_l":"0959-3845","issn":["0959-3845","1758-5813"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319811","host_organization_name":"Emerald Publishing Limited","host_organization_lineage":["https://openalex.org/P4310319811"],"host_organization_lineage_names":["Emerald Publishing Limited"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Information Technology & People","raw_type":"journal-article"},{"id":"pmh:oai:rke.abertay.ac.uk:publications/557767d6-a602-43d4-8180-5a0e27819bdb","is_oa":true,"landing_page_url":"https://rke.abertay.ac.uk/en/publications/557767d6-a602-43d4-8180-5a0e27819bdb","pdf_url":"https://rke.abertay.ac.uk/ws/files/84460183/DePaoli_AQualitativeStudyOfPenetrationTesters_Accepted_2023.PDF","source":{"id":"https://openalex.org/S4306402526","display_name":"Abertay Research Portal (Abertay University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I877506347","host_organization_name":"Abertay University","host_organization_lineage":["https://openalex.org/I877506347"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"De Paoli, S & Johnstone, J 2025, 'A qualitative study of penetration testers and what they can tell us about information security in organisations', Information Technology and People, vol. 38, no. 1, pp. 380-398. https://doi.org/10.1108/ITP-11-2021-0864","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"pmh:oai:rke.abertay.ac.uk:publications/557767d6-a602-43d4-8180-5a0e27819bdb","is_oa":true,"landing_page_url":"https://rke.abertay.ac.uk/en/publications/557767d6-a602-43d4-8180-5a0e27819bdb","pdf_url":"https://rke.abertay.ac.uk/ws/files/84460183/DePaoli_AQualitativeStudyOfPenetrationTesters_Accepted_2023.PDF","source":{"id":"https://openalex.org/S4306402526","display_name":"Abertay Research Portal (Abertay University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I877506347","host_organization_name":"Abertay University","host_organization_lineage":["https://openalex.org/I877506347"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"De Paoli, S & Johnstone, J 2025, 'A qualitative study of penetration testers and what they can tell us about information security in organisations', Information Technology and People, vol. 38, no. 1, pp. 380-398. https://doi.org/10.1108/ITP-11-2021-0864","raw_type":"info:eu-repo/semantics/article"},"sustainable_development_goals":[{"score":0.8100000023841858,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4387418314.pdf","grobid_xml":"https://content.openalex.org/works/W4387418314.grobid-xml"},"referenced_works_count":51,"referenced_works":["https://openalex.org/W146796336","https://openalex.org/W657411145","https://openalex.org/W1591360835","https://openalex.org/W1829634234","https://openalex.org/W1903013269","https://openalex.org/W1979290264","https://openalex.org/W1987426626","https://openalex.org/W2000891179","https://openalex.org/W2001799797","https://openalex.org/W2002356434","https://openalex.org/W2014831132","https://openalex.org/W2025043113","https://openalex.org/W2033742178","https://openalex.org/W2063141940","https://openalex.org/W2080940090","https://openalex.org/W2082348123","https://openalex.org/W2089515120","https://openalex.org/W2093404784","https://openalex.org/W2108070031","https://openalex.org/W2129598873","https://openalex.org/W2138958508","https://openalex.org/W2142652478","https://openalex.org/W2157605623","https://openalex.org/W2170899042","https://openalex.org/W2274083676","https://openalex.org/W2282632211","https://openalex.org/W2304927286","https://openalex.org/W2345976710","https://openalex.org/W2586823173","https://openalex.org/W2587847577","https://openalex.org/W2612721506","https://openalex.org/W2792825686","https://openalex.org/W2801008321","https://openalex.org/W2885376679","https://openalex.org/W2899374977","https://openalex.org/W2911340629","https://openalex.org/W2918776936","https://openalex.org/W2947297481","https://openalex.org/W2949584734","https://openalex.org/W2986072000","https://openalex.org/W2989126648","https://openalex.org/W3001429730","https://openalex.org/W3002643663","https://openalex.org/W3015693615","https://openalex.org/W3023852458","https://openalex.org/W3093532406","https://openalex.org/W3130025725","https://openalex.org/W3133159816","https://openalex.org/W3177310074","https://openalex.org/W4249855545","https://openalex.org/W6814551917"],"related_works":["https://openalex.org/W2041415459","https://openalex.org/W2593155302","https://openalex.org/W2072812638","https://openalex.org/W3126095231","https://openalex.org/W2352855287","https://openalex.org/W4200071106","https://openalex.org/W2378906650","https://openalex.org/W2384288445","https://openalex.org/W2382526412","https://openalex.org/W2347474189"],"abstract_inverted_index":{"Purpose":[0],"This":[1,154,188,213],"paper":[2,27,52,189],"presents":[3],"a":[4,110,141,237],"qualitative":[5,87],"study":[6,206,232],"of":[7,12,25,43,63,70,85,119,148,207,210,229,233,239,248],"penetration":[8,36,91,103,127,165,234],"testing,":[9],"the":[10,51,79,117,149,170,205,226],"practice":[11],"attacking":[13],"information":[14,44,64,211,222,249],"systems":[15,65,156],"to":[16,29,33,107,181,191],"find":[17],"security":[18,45,223,250],"vulnerabilities":[19],"and":[20,32,74,116,198],"fixing":[21],"them.":[22],"The":[23,68,82,98,231],"purpose":[24],"this":[26],"is":[28,101,125,172],"understand":[30],"whether":[31],"what":[34],"extent":[35],"testing":[37,171,235],"can":[38,201],"reveal":[39],"various":[40],"socio-organisational":[41,208,246],"factors":[42,209,247],"in":[46,109,204,251],"organisations.":[47,230,252],"In":[48],"doing":[49],"so,":[50],"innovates":[53],"theory":[54],"by":[55],"using":[56],"Routine":[57,71,195],"Activity":[58,72,196],"Theory":[59,73,197],"together":[60,203],"with":[61,90,94,114],"phenomenology":[62,75],"concepts.":[66],"Design/methodology/approach":[67],"articulation":[69],"emerged":[76],"inductively":[77],"from":[78,146,216],"data":[80,83],"analysis.":[81,96],"consists":[84],"24":[86],"interviews":[88],"conducted":[89],"testers,":[92],"analysed":[93],"thematic":[95],"Findings":[97],"starting":[99],"assumption":[100],"that":[102,126,157,168,218],"testers":[104,128,166],"are":[105,158],"akin":[106],"offenders":[108],"crime":[111],"situation,":[112],"dealing":[113],"targets":[115,131],"absence":[118],"capable":[120],"guardians.":[121],"A":[122],"key":[123],"finding":[124],"described":[129],"their":[130],"as":[132,185,236],"an":[133],"installed":[134],"base,":[135],"highlighting":[136],"how":[137,194],"vulnerabilities,":[138],"which":[139],"make":[140],"target":[142],"suitable,":[143],"often":[144,173,178],"emerge":[145],"properties":[147],"existing":[150],"built":[151],"digital":[152],"environments.":[153],"includes":[155],"forgotten":[159],"or":[160],"lack":[161],"ongoing":[162],"maintenance.":[163],"Moreover,":[164],"highlighted":[167],"although":[169],"predicated":[174],"on":[175,221,225],"planned":[176],"methodologies,":[177],"they":[179],"resort":[180],"serendipitous":[182],"practices":[183],"such":[184],"improvisation.":[186],"Originality/value":[187],"contributes":[190],"theory,":[192],"showing":[193],"phenomenological":[199],"concepts":[200],"work":[202],"security.":[212],"contribution":[214],"stems":[215],"considering":[217],"much":[219],"research":[220],"focuses":[224],"internal":[227],"actions":[228],"proxy":[238],"real":[240],"attacks":[241],"allows":[242],"novel":[243],"insights":[244],"into":[245]},"counts_by_year":[{"year":2024,"cited_by_count":1}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}