Cybersecurity Practices and Supply Chain Performance: The Case of Jordanian Banks

Abstract

This study explores the impact of cybersecurity practices on supply chain performance in the Jordanian banking sector. A survey was used to obtain data from managers and customers. Data from 40 managers’ and 250 digital banking customers’ surveys were collected, of which 220 were valid to be analyzed using IBM SPSS V26 and PLS-SEM V4; 30 responses were excluded due to invalidity issues such as zero standard deviation and outliers identified using Cook’s distance. This study empirically demonstrates the significant positive impact of cybersecurity practices on Jordanian banking supply chain performance. Specifically, the confidentiality, integrity, and availability dimensions strongly correlate with the banks’ supply chain performance. The results indicate that managers have a high degree of cybersecurity awareness and implementation, emphasizing the significance of regular cybersecurity practice training and discussions. Customers desired improved communication and explanation on cybersecurity issues from their banks despite being generally satisfied with cybersecurity. This study’s significant contribution lies in identifying the actual levels of cybersecurity practices and supply chain performance in the Jordanian banking sector and their interaction from both managers’ and customers’ perspectives. Future investigations into the long-term impacts of cybersecurity investments and the comparative examination of cybersecurity methods across other sectors or locations would benefit greatly from this research’s insightful findings. Practically, the results highlight the value of investing in cutting-edge cybersecurity measures, training staff, and effectively explaining procedures and protocols to clients. All of these measures together improve efficiency, trust, and collaboration throughout the banking supply chain.

1. Introduction

In the digital age, cybersecurity is a critical issue for all sectors as increasing reliance on technology exposes us to cyber threats and attacks. Cyberattacks have become more advanced and persistent, targeting physical, technical, and administrative security systems. Cyberattacks can take many forms, including viruses, worms, Trojan horses, ransomware, denial-of-service attacks, and phishing schemes. These attacks can have severe consequences, such as monetary loss, reputational harm, and sensitive information compromised. The cyberattack theory (CAT) identifies the targeted information that attackers seek to obtain or alter to cause damage. Conventional security systems are no longer sufficient because cybercriminals continually evolve their tactics. The International Telecommunication Union (ITU) defines cybersecurity as a comprehensive set of tools, policies, and best practices that protect the cyber environment, organization, and user assets (ITU, 2023). It aims to maintain security and safeguard against risks in the digital world. Cybersecurity practices protect valuable data and systems, help firms avoid legal penalties, and maintain customer and employee trust. Consequently, organizations have focused on increasing security measures to protect their data and gain customer trust.

Cybersecurity practices are revolutionary and futuristic, with current studies demonstrating their importance in data, networks, and business analysis sciences. The significance of cybersecurity measures lies in their ability to enhance security and respond to cyberattacks. Although cybersecurity can provide a competitive advantage for organizations, various cybersecurity risks can negatively impact supply chain flexibility and customer satisfaction with a product or service quality. Leading firms worldwide are adopting or moving towards adopting these practices. Any disruption in cybersecurity can have a disastrous impact on manufacturing firms because of their revenue-risky nature. While the manufacturing sector is vital, cybersecurity practices are equally important in the digital service industry.

The banking industry faces both new opportunities and difficulties as a result of digital banking. Due to the sensitive nature of financial transactions in digital banking, the literature has shown that cybersecurity breaches can cause monetary losses, damage to a bank’s reputation, and legal repercussions. These effects are especially severe in the banking sector (Saeed & Donkoh, 2024). Also, some research like Cele and Kwenda (2024) illustrates that digital banking increases the attack surface, leaving banks more susceptible to ransomware and phishing attacks. Inadequate authentication procedures, insider threats, and insufficient encryption are among the crucial risks associated with cybersecurity mentioned in the literature (Wang et al., 2024). For example, in 2019, the Capital One data breach affected about 6 million Canadian citizens and 100 million US citizens were vulnerable to firewall misconfiguration and unauthorized access to their cloud-based servers (Novaes Neto et al., 2020). Despite these risks, research is scarce about how banks in developing countries handle these issues and how they affect supply chain efficiency.

The shift toward digital banking creates new opportunities and threats for banks, but recent advancements in digital banking have yet to receive adequate attention. The banking sector, especially in developing countries, faces several cyber challenges and needs more research on the impact of cybersecurity practices. The literature on cybersecurity is emerging and theoretical, highlighting the strategic role of these practices. For example, very few practical studies have investigated the role of cybersecurity practices in banking supply chain performance. This gap leads to the main research question: how do cybersecurity practices impact supply chain performance in the Jordanian banking sector? This knowledge gap can be a significant risk factor for banks interested in cybersecurity practices and their impact on their supply chain performance. This study explores cybersecurity practices, supply chain performance in the Jordanian banking sector, and their key features, levels, and interactions.

2. Theoretical Framework

The term “cyber” refers to anything related to computers or computer networks, including the Internet, whereas “security” refers to protection from potential harm caused by others by limiting their freedom to act. As the digital landscape continues to evolve, the importance of cybersecurity continues to grow, making it an essential aspect of modern life.

2.1. Cybersecurity Practices

Cybersecurity safeguards electronic communication networks and virtual reality (cyberspace) from unauthorized access, use, disclosure, disruption, modification, or destruction. This definition involves a combination of technical, administrative, and physical measures to prevent cyberattacks and to protect sensitive information. As the digital landscape continues to evolve, the importance of cybersecurity will continue to grow. With increasing reliance on technology and the Internet, cybersecurity has become essential to modern life, especially in the banking and financial sectors.

Table 1. Cybersecurity definitions.

#		Practical Application in Jordanian Context	Key Dimensions
1.	ITU (2023)	Improving safeguards for financial banking systems and customer data integrity and security.	Availability; integrity, which may include authenticity and non-repudiation; confidentiality
2.	Alzoubi et al. (2022)	Protecting banking systems from risks such as phishing and malware and confirming data access control.	Confidentiality, integrity, and availability
3.	Yan et al. (2020)	Reducing the unsanctioned penetration into national financial systems.	Confidentiality
4.	Al-Alawi et al. (2020)	Protecting against cyber breaking in organizations and ensuring service continuity.	Confidentiality, integrity, and availability
5.	Merriam-Webster (2024)	Safeguarding sensitive systems against unsanctioned online access.	Confidentiality, integrity, and availability
6.	Craigen et al. (2014)	Putting cybersecurity mechanisms in place to make banking infrastructure resilient.	Confidentiality, integrity, and availability

Source: developed by authors, adopted from mentioned studies.

summarizes the definitions of cybersecurity and its main dimensions.

Cybersecurity is defined as the protection of software, tools, and equipment to protect the privacy and integrity of information from various threats. With the rise of the 4.0 and 5.0 industrial revolutions, cybersecurity has become crucial for individuals, families, businesses, governments, and educational institutions. Therefore, it is essential to protect against online fraud. Cybersecurity breaches range from minor to significant consequences, such as data theft, DDoS attacks, data manipulation, and even control system takeover, resulting in physical harm. Cybersecurity is essential for securing financial information that can impact personal financial status. The widespread use of computer systems, networks, and mobile devices has increased cybersecurity risks. Cybersecurity protects personal information, intellectual property, systems, and data from unauthorized access and damage. Information security and cybersecurity share the common goal of ensuring data confidentiality, integrity, and availability. Confidentiality is a crucial aspect of cybersecurity, and it involves ensuring that only authorized individuals can access data. User IDs, passwords, policy-based security, and access control lists (ACLs) are examples of the methods used to maintain confidentiality. However, these methods are vulnerable to cyberattacks if the underlying system is insecure.

Cybersecurity/confidentiality: Confidentiality ensures that only trusted individuals can access information, which is essential for maintaining the trustworthiness of information. Confidentiality is crucial in the digital age, as it ensures that data are protected and only accessible to trusted individuals (Al-Sarhan & Al-Mashaqbeh, 2020). According to Khidzir et al. (2018), confidentiality involves restrictions on using and storing various data types. Samonas and Coss (2014) defined confidentiality as the ability to trust or rely on information. To protect against unauthorized access and disclosure, organizations must implement measures such as secure communication channels, access controls, and data encryption. Confidentiality protects sensitive information such as financial and personal data, intellectual property, and unauthorized access. Confidentiality is a critical component of information security, ensuring that access to information is limited to those who specifically need it. According to Mullet et al. (2021), threats to confidentiality include accessing or stealing sensitive data. Studies such as Sarratiagham (2008) highlight the importance of confidentiality in establishing trust in online systems such as Internet banking, where an unauthorized person can read and take advantage of information stored on the computer. The intruder only observes the patterns of information use. From these patterns, the intruder can infer information. This category also includes the unauthorized use of a proprietary program (Samonas & Coss, 2014). Finally, Omariba et al. (2012) argue that managers should perform regular security audits and assessments to identify, address, and prevent any vulnerabilities in the supply chain from any attack or risk. Based on these definitions, six items have been used to measure confidentiality (Al-Sarhan & Al-Mashaqbeh, 2020).

Cybersecurity/integrity: According to Omariba et al. (2012), “integrity” refers to the dependability of information resources. It guarantees that information is accurate, authentic, and comprehensive Margaret Rouse (2022) and Al-Sarhan and Al-Mashaqbeh (2020) explained that integrity ensures data is modified only by authorized individuals, and techniques like data encryption, hashing, and confidential computing guarantee trustworthiness. Companies should implement digital signatures and regular monitoring procedures to prevent unauthorized modifications. Mullet et al. (2021) defined integrity as the non-destruction, modification, or loss of data without consent. MITM attacks that target integrity are a common type of assault. Integrity guarantees accurate and consistent data and information with the ability to detect unauthorized alterations, verify system actions, and ensure reliable information. Sarratiagham (2008) reports that integrity is crucial for customer security and trust in e-banking systems; unauthorized information modification sabotages information or systems in which an unauthorized individual can change stored information. In such circumstances, hackers do not always notice that the information has been altered (Samonas & Coss, 2014). Based on these definitions, five items have been used to measure integrity (Rouse, 2022; Al-Sarhan & Al-Mashaqbeh, 2020).

Cybersecurity/availability: Every piece of information has a specific value or objective depending on the end goal and must be accessible to authorized individuals when needed. Availability is the ability to send and receive transactions without interruption when required (Al-Sarhan & Al-Mashaqbeh, 2020). This occurs when authorized organizations can access data resources as needed, use them frequently, or restart use under exceptional conditions. Ensuring availability involves preventing denial-of-service attacks, a critical component of information security that affects consumer perceptions of online banking. Availability refers to unlawful denial of use, where an unauthorized individual can prevent an authorized user from accessing or modifying information, even if they cannot do so themselves (Samonas & Coss, 2014). Omariba et al. (2012) defined availability as the accessibility of information resources. An information system that is inaccessible when needed can be as detrimental as no system at all, especially if it is the sole means of handling a particular issue. To ensure availability, the communication routes used to access information must adhere to information security regulations and be operationally sound (Kim, 2017). Therefore, availability refers to the ability to access data and resources at any time, which means that data must be easily accessible to authorized individuals when needed. Based on these studies, six items have been used to measure the “Availability” (Al-Sarhan & Al-Mashaqbeh, 2020).

Cybersecurity studies: As the name implies, cybersecurity is a defense of cyberspace, an Internet-connected system. In technology, constant evolution has played a vital role in transforming traditional corporate tasks into highly creative and efficient operations. With companies increasingly relying on information and communication technology in their everyday operations, a flourishing economy has been hit hard by cybercrime. Cyberattacks on physical systems are growing due to networking and Internet technology advancements. These attacks can impact other SC partner systems for several reasons, such as software errors and vulnerabilities found in any SC partner through the exchange of information. As the number of electronic systems increases, most commercial and vital operations on Earth have been transferred to the virtual world created by humans through the invention of computers, communication networks, information, and electronic memory. This virtual world, called cyberspace, is a fast, versatile, and pervasive domain with open boundaries and assaults. The increasing demand for new procedures and strategies to maintain informatics resources has resulted in a need for cybersecurity.

The significance of cybersecurity is highlighted by the concept of cyber-physical systems and the protection of shared confidential information. As Humayed et al. (2017) defined, cyber-physical systems involve integrating physical components, network systems, embedded computers, software, and sensors for information sharing. The potential for data breaches and cyberattacks is high for technology-driven firms, making information security a critical aspect of national security in many countries. Governments are implementing comprehensive policies to ensure cybersecurity and cybersecurity measures aim to detect and respond to cyberattacks. Cybersecurity risks can also impact the quality of products and services, affecting customer satisfaction and supply chain flexibility. Cybersecurity protects IT hardware, software, and stored data from theft or damage (Huxtable & Schaefer, 2016). Yip (2015) emphasized the importance of cyber supply chain security in enhancing cybersecurity within supply chain networks. This involves the implementation of firewalls to prevent intruders from stealing sensitive data and addressing malware, cyberterrorism, advanced persistent threats, and data theft. As technology advances, new forms of cybercrime emerge, making it challenging to address them under the existing laws and regulations (Al-Alawi et al., 2020). Cybersecurity has become a priority for any organization as an integral part of its strategy, design, and operations. As a result, cybersecurity plays a significant role in enhancing companies’ competitiveness within the context of Industry 4.0. (Pandey et al., 2020).

2.2. Supply Chain Performance

Performance measurement is crucial for organizations to determine the success or failure of their operations, including productivity and profitability. Baltacioglu et al. (2007) found that service supply chain performance is positively determined by three domains of service supply chain innovation capabilities: flexibility, responsiveness, and customer services. Supply chain management (SCM) plays a significant role in managing the flow of information, finances, and assets across supply networks to achieve partner and business goals. Many organizations have focused on improving their supply chain management’s effectiveness and overall performance.

Digitalization has significantly contributed to supply chain management by enhancing firms’ flexibility, confidence, accuracy, and efficiency. Digitalization in the supply chain has improved supply chain performance and overall organizational performance. The manufacturing industry has transformed to automation due to technologies such as IoT and cloud computing, but this has also introduced new risks, including safety. Cyberattacks on supply chains can result in interrupted or corrupted operations, loss of information, and damage to the organization’s reputation. These attacks consist of internal and external risks depending on the source and location of the information that flows through the supply chain, both upstream and downstream (Pandey et al., 2020).

Supply chain performance (SCP) refers to a company’s ability to meet customer needs quickly, efficiently, and at low cost. SCP is the benefits received from the effectiveness and flexibility of supply chain operations in a changing environment, and it is measured by how well a company satisfies its customers’ expectations of product availability while keeping costs low. Another definition of performance is a firm’s operational success, primarily assessed by flexibility, quality, and delivery. The SCP denotes the supply chain network’s capacity to supply and deliver items and services over time.

A company must consider efficient information exchange to achieve supply chain performance (SCP) while minimizing expenses (Rozhkov, 2022). Supply chain performance assesses the efficiency and effectiveness of a company’s supply chain in meeting customer requirements and achieving corporate goals (Almufleh & Alkhatib, 2023; Chang et al., 2019). Factors like flexibility, service quality, and customer satisfaction affect supply chain success. Flexibility refers to the ability to adapt to changes in demand or supply, such as unexpected fluctuations in client orders or supply chain capabilities (Chowdhury et al., 2019). Organizations utilize Industry 4.0 and Industry 5.0 technologies to enhance operational efficiency, supply chain coordination, responsiveness, quality, and customer experience (Wu et al., 2024). Service quality pertains to the level of service provided to clients, including delivery speed, order accuracy, and customer communication. On-time delivery, precise tracking and reporting, and good customer support are examples of service quality in the supply chain. Customer satisfaction reflects how content and pleased customers are with a company’s products and services.

Flexibility is essential in supply chain competition because it allows organizations to meet client needs and adapt to changing market conditions. Good supply chain integration enhances flexibility and enables quick adaptation to market change. Managing and minimizing supply chain risk involves the development of agile and flexible supply networks. Cybersecurity flexibility in a service supply chain involves quickly implementing security measures and modifying the supply chain process to ensure service security. Companies should invest in robust scalable security infrastructure and a competent and trained cybersecurity workforce. IoT technology applications can increase visibility in the supply chain and streamline the information flow in real-time, whereas IT is critical for practical supply chain management intelligence (Ellis et al., 2015). Flexibility is the organization’s ability to modify its supply mix, fulfill unanticipated demand, and adjust delivery and supply timetables based on the scenario (Beamon & Balcik, 2008).

In terms of service quality, Cenamor et al. (2017) emphasized the potential of data and digital technologies to enhance the service quality of the supply chain. A service provider must prioritize cybersecurity throughout the supply chain to ensure service quality. Effective cybersecurity measures involve securing sensitive data and resources, safeguarding systems, and networks, and ensuring authorized access. Additionally, service providers must deliver services consistently and reliably to maintain service quality. Ensuring cybersecurity and service quality requires technical expertise, process management, and effective communication and collaboration across the supply chain.

Customer satisfaction (CS) measures customer perception and compares expected performance to customer expectations. According to Kant and Jaiswal (2017), customer satisfaction is a critical component of marketing success, as a satisfied customer base is crucial for achieving competitiveness. Companies rely on service innovation to improve services, which involves developing the services provided to customers. Therefore, companies should ask customers about their satisfaction with the service through periodic surveys. Customer satisfaction in a service supply chain refers to how satisfied consumers are with a company’s service offerings and supply chain operations. To increase customer satisfaction, companies should focus on five critical areas: service delivery that is efficient and timely, service quality, communication, value for money, and cybersecurity. Customers want service providers to take initiative-taking measures to prevent cyberthreats and respond quickly in the case of an attack. Effective communication about security threats and preventive measures is crucial for customer satisfaction through secure data storage, encryption, and strict data protection policies. Transparency about security breaches and remedial actions helps build trust. Customers expect comprehensive cybersecurity coverage, such as protection against malware, ransomware, and phishing attempts. Gunasekaran et al. (2004) state that customer satisfaction is a top priority in world-class supply chains. Modern supply chains should promptly address customer queries and provide excellent post-transaction customer service. Timely responses and valuable feedback from after-transaction activities contribute to supply chain improvement.

2.3. Summary of Previous Studies and Research Gap

Cybersecurity and supply chain performance are both crucial areas that have garnered the attention of both managers and academia. Several studies have integrated both dimensions into one model (Arabyat et al., 2023; Fernando et al., 2023; Rouse, 2022; Al-Alawi et al., 2020; Sobb et al., 2020; Seno et al., 2015), while only a few have focused on each dimension individually (Yan et al., 2020; Ferraiuolo et al., 2022; Ramanujapuram & Akkihal, 2014). The definition of cybersecurity must include confidentiality, integrity, and availability, and use measures such as those outlined in this section. Most studies on cybersecurity have been conducted in the service sector (Katzan, 2012; Yip, 2015; Al-Sarhan & Al-Mashaqbeh, 2020; Alzoubi et al., 2022) and few in the banking and financial sectors (Arabyat et al., 2023). Supply chain performance has become a widely studied topic, especially after recent global crises, and factors affecting it are essential for businesses worldwide. The importance of supply chain performance and its factors is a valid issue for all businesses worldwide (Ali et al., 2021), especially after COVID-19, the Ukrainian war, and the global monetary crisis. Several studies have investigated the factors that impact supply chain performance from different perspectives, such as cybersecurity managing risk (Al-Alawi et al., 2020), assessment of national cybersecurity in preventing crisis (Al-Samour & Al-Khazali, 2020), cybersecurity trends in the Jordanian financial sector (Arabyat et al., 2023), and the effect of cyber supply chain security towards lean and agile supply chain performance (Yip, 2015). According to Sleimi (2020), risk management, identification, assessment, monitoring, and analysis positively impact Jordanian banks’ performance. Although some studies investigate factors that affect this performance from different perspectives (Alnadi & Altahat, 2024; Dubey et al., 2018; De Vass et al., 2018; Shukor et al., 2021; Hanaysha & Alzoubi, 2022), the need to investigate the impact of cybersecurity practices, especially within the banking sector, is still valid.

2.4. Research Model and Hypotheses

The use of information and communication technology is not to spread risks that hinder business, and these gaps need to be presented in the literature. This research focuses on electronic services in Jordanian commercial banks and how cybersecurity practices (confidentiality, integrity, and availability) enhance flexibility and service quality and affect customer satisfaction. Therefore, the following model (Figure 1) has been suggested to clarify and describe the relationship between cybersecurity practices as an independent variable and supply chain performance as a dependent variable.

First, cybersecurity and SCP: Al-Alawi et al. (2020) found that the conclusions significantly impacted our understanding of cybersecurity and its effects on financial institutions. Singh et al.’s (2019) study sought to improve performance by identifying cybersecurity threats and attacks in a globalized supply chain (SC) based on the information flow across the SC upstream and downstream. The study concluded that implementing thorough network inspection, process monitoring, risk assessment, and third-party product evaluation can help reduce cybersecurity risks. Standard cybersecurity measures are necessary to address these challenges. Tawfik et al.’s (2021) study on Jordanian banks found that the cybersecurity program significantly impacted the proper use of cloud accounting, cybersecurity governance requirements, cyber risk assessment and management, and cybersecurity information management. The findings demonstrated that the banks’ security procedures would be ineffective without knowledge and training. As a result, the primary hypothesis is:

H1. 

Cybersecurity practices significantly impact the SCP of the Jordanian banking sector.

Based on this hypothesis, the following sub-hypotheses can be developed based on cybersecurity practices:

Second, cybersecurity practices and SCP: Confidentiality ensures that only trusted individuals can view or access information and maintain the confidentiality of the data. Confidentiality involves restrictions on the storage and use of several types of data. Confidentiality is a strong predictor of perceived information security, and a relationship exists between confidentiality and information security. A study by Seno et al. (2015) found that increasing the security level of online banking systems requires a focus on confidentiality. Daud et al. (2011) conducted a study on how customers perceive information security and confidentiality, confirming that confidentiality and privacy have a favorable and significant impact on information security. Consequently, it is possible to suggest the following sub-hypothesis:

H1.1. 

Confidentiality significantly impacts the SCP of the Jordanian banking sector.

Third, cybersecurity integrity: Integrity refers to the accuracy and correctness of data and the prevention of unauthorized modification, destruction, or loss. According to Mullet et al. (2021), secure transfer, sharing, storage, and data processing maintain integrity well. Sarratiagham (2008) found that integrity is crucial to online banking systems. Seno et al. (2015) conducted a study to analyze the effects of integrity on the security level of Isfahan Tejarat Bank’s online banking. The study used structural equation modeling (SEM) and a paired sample T-test to show that conclusions with integrity have a positive and significant impact on information security. Alhassan and Adjei-Quaye (2017) also found that integrity positively affects information security in their research on the connection between integrity and customer perceptions of information security. Database referential integrity differs from data integrity, which prohibits modification without approved access.

H1.2. 

Integrity significantly impacts the SCP of the Jordanian banking sector.

Fourth, cybersecurity availability: It allows an authorized user access to associated assets and information when needed. According to Wu et al. (2019), availability is apparent when data resources can be accessed as needed by authorized entities, utilized often, or restarted in unexpected situations. Daud et al. (2011) examined how customers perceive information security and availability. The availability of information is a significant aspect that influences the perceived security of information that is transacted online via the Web, leading to the following proposal:

H1.3. 

Availability significantly impacts the SCP of the Jordanian banking sector.

3. Methodology

3.1. Research Design

This study uses quantitative and descriptive approaches to gather needed information and understand the impact of cybersecurity practices on the supply chain performance in Jordanian banking sectors. The quantitative approach tests this study’s hypotheses and answers this study’s questions by reviewing previous studies and applying an analytical method to the data collected through a questionnaire distributed to the bank managers and customers. This study uses a cross-sectional method, a snapshot type of data, to investigate the impact of cybersecurity practices on the supply chain performance for electronic services in Jordanian banking sectors.

3.2. Study Population and Sample

This study’s population is the total group of elements from which this study seeks to generalize the results and is related to this study’s problem. Determining this study’s population is essential to clarify this study’s variables and objectives. This study’s population includes all operating banks in Jordan and their managers and customers. According to the CBJ and the Association of Banks in Jordan, there are 23 operating banks with more than 21,000 employees, of whom 35.2% are female. There are more than 2000 managers and 3 million active accounts. A sample of more than 400 respondents was needed, and two samples were selected to obtain accurate results free from bias. The sample of managers was distinguished by adding a particular part for managers to answer to measure their attitudes towards cybersecurity policy, which only managers were aware of. A list of all the banks’ branches was optioned, and a random branch was selected. Then, a sample of 40 managers and 400 customers from each branch was conveniently selected. Questionnaires were distributed by hand to each branch and collected on the same day. Out of the distributed questionnaires, 40 responses from managers and 250 from customers were collected; overall, 290 were collected.

3.3. Respondents’ Profiles

Table 2. Respondents’ profiles for customer sample (n = 220).

	Count	%
Age
Less than 25 years old	20	9.1%
From 25 years old to 35 years old	138	62.73%
From 36 years old to 45 years old	43	19.54%
Over 45 years old	19	8.63%
Gender
Male	107	48.6%
Female	113	51.4%
Academic qualification
High school diploma or less than an intermediate diploma	2	0.9%
Intermediate diploma	9	4.1%
Bachelor	139	63.2%
Postgraduate	70	31.8%

summarizes the demographic items for customers, while

Table 3. Respondents’ profiles for manager sample (n = 40).

	Count	%
Job position
Head of the department	7	17.5%
Assistant head of the department	3	7.5%
Branch manager	20	50.0%
Assistant director	6	15.0%
Director of operations	1	2.5%
Office administrator	2	5.0%
Cashier	1	2.5%
Age
Less than 25 years old	--	--
From 25 years old to 35 years old	10	25.0%
From 36 years old to 45 years old	30	75.0%
Over 45 years old	--	--
Gender
Male	38	95.0%
Female	2	5.0%
Academic qualification
High school diploma or less than an intermediate diploma	--	--
Intermediate diploma	--	--
Bachelor	28	70.0%
Postgraduate	12	30.0%
Years of experience
Less than five years	--	--
From 5 to 10 years	11	27.5%
From 11 to 15 years	27	67.5%
More than 15 years	2	5.0%

summarizes the demographic items for managers.

According to Table 2, the age distribution of surveyed customers reveals that the majority (62.7%) fall within the age range of 25 to 35 years old, while 19.5% are between 36 to 45 years old, 9.1% are under 25 years old, and 8.6% are over 45 years old. The researchers believe that these results reflect the representative nature of the sample, as the largest age group uses electronic banking services. Thus, the data obtained will provide an accurate portrayal of reality.

Table 3 presents the outcomes for the manager sample. The job positions represented diversity, with surveyed positions including 50.0% branch manager, 17.5% head of department, 15.0% assistant director, 7.5% assistant head of department, 5.0% office administrator, 2.5% director of operations, and 2.5% cashier. The researchers believe that the diversity in administrative positions, including managers, assistants, and deputies, is a positive sign. Applying this study’s variables reflects the managers’ lack of bias in setting an ideal image for the bank. The managers surveyed were middle-aged, with 25.0% aged between 25 and 36 years old and 75.0% aged between 36 and 45 years old. Most of the respondents were between 35 and 45 years old, which was expected, as it takes years of experience to reach such positions.

Furthermore, 95.0% of the managers were males, and 5.0% were females. From the researchers’ perspective, this result could be better, and future studies should focus on the reasons for the limited occupation of women in leadership and management positions within banks in northern Jordan. The results showed that 70.0% of the managers held bachelor’s degrees, and 30.0% held postgraduate degrees. Finally, 67.5% had 11–15 years of experience, 27.5% had 5–10 years of experience, and 5.0% had more than 15 years of experience.

3.4. Measurement Scale Items

The current study focused on three critical dimensions of cybersecurity practices: confidentiality, integrity, and availability. These dimensions were chosen based on previous research in the field. Confidentiality, integrity, and availability collectively form the CIA triad, which was used as the independent variable in this study. Confidentiality ensures that only authorized individuals can access data in ICT systems, which can be achieved through user IDs, passwords, policy-based security, and access control lists (ACLs). Integrity ensures that data remain in their original state while at rest and can be edited only by authorized individuals. Measures such as data encryption, hashing algorithms, and confidential computing can help to ensure the trustworthiness of data or information systems. Organizations should implement digital signatures, regular monitoring, and audits to prevent tampering or modification. Availability refers to the accessibility of data and information systems when required. Redundancy, cloud computing, software upgrades, predictive analytics, and hardware maintenance can help ensure availability by ensuring that systems, information, and services are always available. Deviations were calculated according to the three-rank scale to interpret mean levels for the overall sample; this allows for determining the extent to which each dimension is presented in our target context. A high level is assigned for mean values within (3.67–5.00), a moderate level is within (2.34–3.669), and a low level is assigned for mean values within (1–2.339).

3.5. Data Preparation and Screening

Data screening: This research aims to examine the perceptions of customers and managers in the Jordanian banking sector. A total of 40 responses were collected from the manager dataset, and it was found that most responses were at the agree and strongly agree levels, with a few at neutral levels. As the sample size was small, statistical tools such as Cook’s distance to exclude outliers were not used. For the customer sample, 250 responses were coded into SPSS, and after coding, a few blank items were found that accounted for a missing ratio of 0.1318%. Missing data in Likert scale items were replaced with the median of nearby points, and then regular patterns in assessments were examined based on standard deviation. Studies found that any low values scoring zero or around zero had a pattern in assessments, and 23 responses scoring zero standard deviation were dropped from the sample. Finally, outliers were checked based on Cook’s distance, and any observation above the threshold of 0.1 was considered an outlier and removed from the regression model. Based on Cook’s distance, four observations were identified as outliers and removed from the sample. After completing the data screening process for the customer sample, 220 valid responses were analyzed. SPSS [v. 27] was used for data coding and screening, model suitability assessment, and descriptive analysis. PLS-SEM was employed to test the measurement and structural models for the total sample, evaluating the strength of influences between model variables. The analysis included two stages: testing the measurement model for reliability and validity and testing the structural model for the strength of influence between variables. Model suitability was assessed through normality and multicollinearity checks.

Normality and multicollinearity issues: Avoiding extreme kurtosis and skewness issues resulting in estimation bias is crucial to ensure data normality. An examination of data symmetry can be conducted using kurtosis and skewness, and, according to Byrne (2016), a skewness coefficient of ±3 and a kurtosis coefficient of ±7 are suitable criteria. The dataset was free of normality issues, as both skewness and kurtosis coefficients fell within these criteria.

3.6. Instrument Validity and Reliability

Examining the Quality of Measurement Models (Instruments)

The evaluation of the measurement model involved using Smart PLS to assess its quality based on reliability, convergent validity, and discriminant validity criteria. The study followed guidelines by Hair et al. (2021). The specified measurement model was established, and the PLS algorithm focused on factors was applied. The assessments (

Table 4. Results of reliability and convergent validity of the measurement model—total sample (n = 260).

Construct	Item	FL	t-Value	Cronbach Alpha	CR	AVE
Confidentiality	C1	0.808	25.822 ***	0.868	0.902	0.608
	C2	0.847	31.043 ***
	C3	0.803	20.564 ***
	C4	0.826	29.534 ***
	C5	0.577	8.439 ***
	C6	0.786	24.765 ***
Integrity	I1	0.789	26.002 ***	0.870	0.906	0.658
	I2	0.811	15.614 ***
	I3	0.770	14.147 ***
	I4	0.825	30.261 ***
	I5	0.857	38.746 ***
Availability	A1	0.832	33.033 ***	0.814	0.865	0.522
	A2	0.822	42.669 ***
	A3	0.691	18.311 ***
	A4	0.568	10.415 ***
	A5	0.626	11.792 ***
	A6	0.754	17.913 ***
Flexibility	F1	0.780	30.069 ***	0.885	0.913	0.636
	F2	0.702	14.835 ***
	F3	0.833	36.103 ***
	F4	0.830	34.945 ***
	F5	0.796	23.314 ***
	F6	0.837	36.117 ***
Service quality	SQ1	0.849	16.678 ***	0.941	0.953	0.771
	SQ2	0.872	42.629 ***
	SQ3	0.869	46.682 ***
	SQ4	0.903	47.515 ***
	SQ5	0.902	32.915 ***
	SQ6	0.874	53.258 ***
Customer satisfaction	CS1	0.882	45.297 ***	0.918	0.939	0.756
	CS2	0.910	59.661 ***
	CS3	0.897	49.618 ***
	CS4	0.907	63.967 ***
	CS5	0.741	20.062 ***

*** p < 0.001.

) included examining the outer factor loading of the model items, with a minimum threshold of 0.5 and a preferred value of >0.7. All items in the measurement model had FL > 0.5, and the majority had FL > 0.7, with significant t-values at the 0.05 significance level. Convergent validity was achieved with AVE coefficients > 0.5 and composite reliability coefficients > 0.7. All constructs met the requirements for convergent validity, and statistical reliability of constructs was achieved with Cronbach alpha coefficients > 0.7.

Discriminant validity was established through the Fornell and Larcker (1981) approach displayed in

Table 5. Results of discriminant validity (Fornell–Larcker) of the measurement model—total sample (n = 260).

Construct	Availability	Confidentiality	Customer Satisfaction	Flexibility	Integrity	Service Quality
Availability	0.722
Confidentiality	0.672	0.780
Customer satisfaction	0.632	0.574	0.870
Flexibility	0.707	0.646	0.724	0.798
Integrity	0.752	0.672	0.620	0.656	0.811
Service quality	0.686	0.617	0.835	0.791	0.678	0.878

and

Table 6. Results of discriminant validity (heterotrait/monotrait ratio [HTMT]) of the measurement model—total sample (n = 260).

Construct	Availability	Confidentiality	Customer Satisfaction	Flexibility	Integrity	Service Quality
Availability
Confidentiality	0.761
Customer satisfaction	0.712	0.638
Flexibility	0.817	0.728	0.800
Integrity	0.875	0.767	0.691	0.746
Service quality	0.773	0.678	0.897	0.864	0.746

. In Table 5, the square root of AVE coefficients was larger than any construct correlation with other constructs in the model. Additionally, the heterotrait/monotrait ratio [HTMT] in Table 6 showed that all coefficients were less than 1 and most were less than 0.85, indicating that all constructs met the discriminant validity requirements proposed by Henseler et al. (2015).

The first-order measurement model met the reliability, convergent validity, and discriminant validity requirements. The second-order model was validated based on the FL of constructs relative to its total latent variable; all FL of constructs were significant, positive, and >[0.7], supporting the decomposition of model variables. For cybersecurity practices constructs, FL of constructs were as follows: confidentiality [Y = 0.881, t = 46.164], availability [Y = 0.898, t = 46.064], and service quality [Y = 0.955, t = 53.486].

The researchers in this study acknowledge several limitations in the employed methodology. For instance, this study collected data from 40 managers and 250 customers; nevertheless, the sample size may not include a comprehensive perspective across the banking sector. This issue was addressed through random selection and strata sampling. This research studied only Jordanian banks, limiting the applicability of results to other regions; however, the results can still be generalized and have broader implications in a context similar to Jordan’s country as the banking sector’s globalized nature.

4. Analysis

4.1. Respondents’ Profiles

Various information related to cybersecurity in the Jordanian banking sector was collected in the personal information section from the two samples;

Table 7. Customer sample (n = 220).

	Count	%
Use electronic services (internet banking, digital wallet, bank app, etc.)
No	6	2.7%
Yes	208	94.5%
Not sure/do not know	5	2.3%
Did not respond	1	0.5%
Cybersecurity threats, risks, and related issues before
No	188	85.5%
Yes	13	5.9%
Not sure/do not know	19	8.6%
Levels of priority of cybersecurity practices at your bank
Low	12	5.5%
Moderate	102	46.4%
High	89	40.5%
Very high	16	7.3%
Did not respond	1	0.3%
Discuss the topic of cybersecurity with the bank before
No	191	86.8%
Yes	24	10.9%
Not sure/do not know	5	2.3%
Have a security incident, attack, or data breach due to a malicious or negligent employee
No	150	68.2%
Yes	8	3.6%
Not sure/do not know	62	28.2%
Levels of awareness of employees about banks’ security risks
Very knowledgeable	53	24.1%
Somewhat knowledgeable	122	55.4%
Not knowledgeable/not sure/do not know	45	20.5%

represents the responses by customers to cybersecurity-related information in the Jordanian banking sector.

Most surveyed customers, 94.5%, had used electronic services such as Internet banking, digital wallets, and bank apps, indicating the suitability of the sample for this study. Only 2.7% did not use electronic services, and 2.3% were unsure. In total, 85.5% of the customers did not experience any cybersecurity threat, risk, or issue, while 5.9% did, and 8.6% were unsure. In total, 46.4% of respondents reported moderate priority for cybersecurity practices at banks, while 40.5% reported high priority, 7.3% reported very high priority, and 5.5% reported low priority. In total, 86.8% of customers had not discussed cybersecurity with banks before, while 10.9% had discussed it, and 2.3% were unsure. In total, 68.2% of customers answered no to experiencing a security incident due to a malicious or negligent employee, while 3.6% answered yes, and 28.2% were unsure. Customers assessed the level of employee awareness of banks’ security risks as very knowledgeable (24.1%), somewhat knowledgeable (55.5%), and not knowledgeable or unsure (20.5%).

Managers’ responses: 

Table 8. Cybersecurity-related information in the Jordanian banking sector—manager sample (n = 40).

	Count	%
Level of priority of cybersecurity practices at your bank
High	40	100%
Often discuss the topic of cybersecurity issues with executive leadership
Monthly	10	25%
Each period	30	75%
Have a security incident, attack, or data breach due to a malicious or negligent employee
No	38	95%
Not sure/do not know	2	5%
Levels of awareness of employees about banks’ security risks
Very knowledgeable	24	60%
Knowledgeable	16	40%

represents the responses by customers to cybersecurity-related information in the Jordanian banking sectors:

From managers’ points of view, levels of priority of cybersecurity practices at their bank were highly reported by all samples (100%). Further, for discussing cybersecurity issues with executive leadership, 25% reported monthly, and 75% reported each period. For experiencing a security incident, attack, or data breach due to a malicious or negligent employee, 95% answered no, and 5% were not sure/did not know. Finally, levels of awareness of employees about banks’ security risks were assessed as very knowledgeable at 60% and knowledgeable at 40%.

Levels of Cybersecurity Practices and SCP in the Jordanian Banking Sectors

Table 9. Mean and STD for levels of cybersecurity practices as perceived by the sample.

No.	Construct	Total Sample (n = 260)
		Mean	Std.	Rank	Order
1	Cybersecurity policy (manager sample only)	4.74	0.47	High	//
2	Confidentiality	4.60	0.53	High	1
3	Integrity	4.46	0.50	High	2
4	Availability	4.35	0.48	High	3
Total cybersecurity practices (cybersecurity policy excluded)		4.47		High

presents a summarized ratio and statistical analysis of mean and STD for levels of cybersecurity practices as perceived by the two samples.

The cybersecurity practices in banks received high scores, with an overall mean value of 4.47. All practices were evaluated highly; the mean scores ranged between 4.60 and 4.35. The standard deviation values were between 0.48 and 0.53, indicating that responses were clustered around their mean values, suggesting homogeneity in the assessment levels. For the cybersecurity policy, the overall mean value was 4.74, indicating high-level implementation in banks. All items in this construct were evaluated highly, with mean scores between 4.90 and 4.68. The highest score was given to the item “The bank defines the objectives, responsibilities, and work procedures related to the cybersecurity policy”, and the lowest score was for the item “The bank is committed to cybersecurity rules and regulations defined by the Central Bank”. Homogeneity in assessments was evident based on the standard deviation. For the confidentiality dimension, the overall mean value was 4.60, indicating high-level assessments for all items. The item “My bank checks the customer’s identity before any traditional or electronic action” received the highest mean score of 4.70. In contrast, the item “My bank educates customers on verifying the company’s identity on the Internet and mobile applications while using them” received the lowest mean score of 4.43. The standard deviation values were below 1, indicating homogeneity in the assessments.

For the integrity dimension, the entire sample gave a high assessment for the integrity construct, with an overall mean value of 4.46. The following construct had the highest ranking item: “I am sure that transactions with my bank are safe”, and the least ranking item was “My bank employees are trained and qualified in data processing safety procedures”. The level of assessments demonstrated homogeneity based on the standard deviation.

Table 10. Mean and STD for levels of SCP as perceived by the sample.

No.	Construct	Total Sample (n = 260)
		Mean	Std.	Rank	Order
1	Flexibility	4.36	0.53	High	3
2	Service quality	4.41	0.59	High	1
3	Customer satisfaction	4.37	0.59	High	2
Total SCP		4.38		High

summarizes the constructs’ mean and standard deviation values for the supply chain performance.

The flexibility construct received a high mean value of 4.36, with all items receiving strong agreement. The top three items were “The electronic bank systems provide several services and options”, “The service delivered through the bank’s website/app is adaptable to customer/employee needs”, and “The bank can quickly modify our product/service in response to customer requests”. The overall level of agreement was high, with mean values ranging from 4.44 to 4.35. The item “Compared with other banks, this bank provides excellent services” received the highest agreement level. In contrast, “The services provided by this bank web/app are monitored and updated frequently” received the lowest. The total sample had a high assessment of the customer satisfaction construct, with a mean value of 4.37, and high agreement levels for all items. The item “I made the correct decision to use the E-Banking services” had the highest recorded mean value of 4.48.

4.2. Measurement Model

This study’s main findings were delivered through hypotheses testing results. The structural model was tested using path analysis, and the evolution of the model was based on the variance coefficient R². The hypothesis decision was provided based on the path coefficient and t-statistic value. The central hypothesis H1 showed a high influence of cybersecurity practices on the dependent variable SCP, with a high amount of explained variance at 60.4% (Figure 2). The path estimate for cybersecurity practices and SCP was 0.777, and the influence was significant with a t-statistic of 27.919 and p = 0.000, supporting H1. The structural model estimates for sub-hypotheses showed a high variance of 61.1 (Figure 3).

Path estimates for confidentiality and SCP recorded 0.225, showing a positive influence, as confidentiality increased by 1%, SCP increased by 22.5%; the influence was significant, having a t-statistic of 3.489 and p = 0.000, thereby supporting H1.1. Path estimates for integrity and SCP recorded 0.275, showing a positive influence, as integrity increased by 1% and SCP increased by 27.5%; the influence was significant, having a t-statistic of 3.617 and p = 0.000, thereby supporting H1.2. Path estimates for availability and SCP recorded 0.370, showing a positive influence, as availability increased by 1% and SCP increased by 37%; the influence was significant, having a t-statistic of 5.426 and p = 0.000, thereby supporting H1.3.

Table 11. Hypotheses’ estimated results (n = 260).

H	Path	Beta	t-Value	p-Value	Result
H1	Cybersecurity practices—SCP	0.777	27.919	0.000 *	Supported
H1.1	Confidentiality—SCP	0.225	3.489	0.000 *	Supported
H1.2	Integrity—SCP	0.275	3.617	0.000 *	Supported
H1.3	Availability—SCP	0.370	5.426	0.000 *	Supported

* p < 0.05.

summarizes the hypotheses and estimates the total sample results.

4.3. Structural Measurement

In this section, we analyzed the differences in cybersecurity practices and SCP levels according to personal information such as age, gender, academic qualification, and sample size. We assessed these differences by using independent samples, t-tests, and ANOVA test results. The following are the results of these tests:

Age: The ANOVA statistic for cybersecurity practices was [F = 4.291], and for SCP, it was [F = 4.262], with significance values below the 0.05 cutoff, indicating significant differences according to age. The LSD–Fisher post-test comparisons revealed that the differences were from the age group 36–45 years. Therefore, respondents aged 36–45 reported higher cybersecurity practices and SCP levels. This could be because this age group has more experience with banks or the labor market and can evaluate the sample without bias or admiration for information technology capabilities. Additionally, they are more confident in information technology, such as those aged less than 30 or greater than 45.

Gender: The t-test statistic for cybersecurity practices was [T = 3.067], with a significance value below 0.05, indicating significant differences in cybersecurity practices according to gender. Male respondents scored a mean value of 4.54, which was higher than the mean value of females, indicating that male respondents provided higher levels of agreement toward cybersecurity than females. The t-test statistic for SCP levels according to gender showed no significant differences [T = 1.739, p > 0.05]. However, there were differences in evaluating cybersecurity practices, with a higher arithmetic mean in the male category. To better understand the female perspective, it is essential to investigate the reasons for the differences. The t-test statistic for cybersecurity practices and SCP levels according to sample type showed significant differences [T = 5.684, p < 0.05 and T = 5.339, p < 0.05], with higher mean values for the manager sample. Therefore, managers reported higher levels of cybersecurity practices and SCP. Finally, ANOVA statistics for cybersecurity practices [F = 0.624, p > 0.05] and SCP [F = 0.426, p > 0.05] showed no significant differences according to academic qualifications.

5. Discussion

This study examines the influence of cybersecurity practices on the performance of supply chains in the northern region of Jordan’s banking sector. The analytical/descriptive method was used, along with a tailor-made questionnaire, to collect data related to the study variables. The data were analyzed statistically, leading to several results that helped answer the research questions. The following points summarize the main findings of this research:

• Q1: what is the level of awareness of managers and customers regarding the significance of SCS in the service sector of Jordanian banks?

The customers’ responses were positive regarding the level of cybersecurity practices. This is because most of the sample consisted of users of electronic services provided by banks, indicating their suitability for the study. Additionally, many respondents reported having no security incidents in the banks they dealt with. However, negative results emerged as customers felt that banks needed to encourage dialogue with them to clarify cybersecurity-related matters. This result indicates that most of the customer sample stated that employees had only some knowledge about cybersecurity, which highlighted the need for more courses and conferences on these subjects and for establishing communication channels between clients and employees to enhance awareness on both sides regarding cybersecurity. Similarly, previous studies in the literature confirm that a lack of clear communication about cybersecurity procedures leads to some issues in compliance and security risks (Bada et al., 2019), in that a lack of awareness and understanding of cybersecurity policies from customers makes them more vulnerable to risks. The managers’ responses indicated strong indicators of the application of cybersecurity practices within banks in the northern region of Jordan. Most answers showed that these banks give a 100% priority level and high support for regularly discussing cybersecurity. Similarly, Haupert et al. (2017) emphasizes how critical it is to give security issues first priority, particularly for financial institutions. However, 95% of managers reported never experiencing a security incident due to an employee, suggesting high employee awareness. These positive indicators reflect top management awareness of these banks. This is consistent with a study that found positive improvements in staff awareness led to a decrease in security incidents (Hammour et al., 2019). Despite that, it is important to study employees’ readiness across different attack routes. Overall, the results show a difference between customer and managerial perspectives on a cybersecurity awareness level, which implies a need for enhanced communication to fill this gap and ensure unified understanding of cybersecurity measures across all perspectives.

• Q2: what are the primary cybersecurity practices applied to the service sector in Jordanian banks?

To answer this question, the researchers conducted a descriptive analysis of sample responses to investigate the level of implementation of cybersecurity practices and policies. This study found that both samples had a high level of implementation, reflecting the efforts made by banks to integrate cybersecurity practices into their work system. In a similar manner, previous studies underscore the increasing attention on cybersecurity within financial organizations. For example, a study by Puhakainen and Siponen (2010) shows a high level of cybersecurity implementation occurred in banks steered to protect sensitive financial data and increase trust in banking operations.

This study also found that the level of approval for implementing cybersecurity practices was high among managers in Jordanian banks in the north of the region. This is in line with research by Alotaibi et al. (2016), who found that managers at Middle Eastern financial institutions had positive attitudes towards cybersecurity measures. The high degree of support from managers indicates a clear understanding of how critical cybersecurity is to preserving both consumer confidence and operational resilience. Additionally, the study measured managers’ attitudes towards applying the cybersecurity policy, with all results being highly positive and indicating tangible efforts to adopt and implement the policy within Islamic and commercial banks in the north of the region.

This study found that the level of confidentiality and integrity in cybersecurity practices at Jordanian banks is high. This result aligns with previous research by Mullet et al. (2021), Alhassan and Adjei-Quaye (2017), and Seno et al. (2015). The banks are taking necessary measures to ensure the safety of customer information and provide electronic services with protection against cyber hacking. As found by Abu AlKhair (2023), internal auditing effectively ensures cybersecurity risks. The results also indicate a high level of integrity in the data stored in the banks, as supported by Wu et al. (2019), Alhassan and Adjei-Quaye (2017), and Seno et al. (2015).

This study found that the banks in Jordan have high integrity, which is crucial for maintaining confidence between banks and their customers. As a result, customers are more likely to open an account with these banks due to their integrity. This finding aligns with other studies such as Seno et al. (2015), Alhassan and Adjei-Quaye (2017), and Wu et al. (2019). Cybersecurity is an essential factor in supply chain management, but most studies do not provide further explanation. This study also found that studies need to go into detail about the importance of cybersecurity in supply chain management. The results suggest that Jordanian banks should improve their digital services with backup protection to enhance their platform’s stability. Moreover, practitioners can go beyond platform stability, they can conduct continuous investment in advanced technology, arrange training programs regularly for employees to keep them updated with evolving threats, and ensure strong protection of customers’ data. This study also found that the respondents in the total sample had a result of STD less than 1, indicating that banks are interested in aspects that would raise their performance, such as flexibility, quality of service, and customer satisfaction. Upon conducting a thorough statistical analysis, it was discovered that the Jordanian commercial and Islamic banks in the northern region received a high level of flexibility from our sample. This result is in line with earlier studies that highlighted how important these factors are to improving overall bank performance. For example, Oke et al. (2007) contend that flexibility and quality of service are essential to reaching high customer satisfaction, which in turn leads to performance increases.

Senior management is actively focusing on the flexibility aspect, as it is a significant indicator of performance. Our findings align with this, as banks with a higher level of flexibility can more effectively adapt to the changing requirements of their customers. Similarly, a study by Goldsby and Stank (2000) also demonstrates how banks with greater flexibility have greater capacity to satisfy changing client demands and market demands. Our results support this idea by showing that flexibility is a crucial operational priority for Jordanian banks and is a worldwide best practice. This flexibility is crucial in an ever-evolving market and allows banks to stay ahead. Furthermore, research conducted by Del Giorgio Solfa (2022) found that improvements in supply chain management, such as implementing digital services with enhanced security, can significantly enhance a company’s risk management and address cybersecurity concerns.

• Level of Service Quality

Statistical analysis found that both the quality of service and customer satisfaction with electronic services provided by Jordanian commercial and Islamic banks in the north of the kingdom received high evaluations from samples. Therefore, senior management has made tangible efforts to meet customer needs and preferences. These findings align with previous studies by Dam and Dam (2021) and Ali et al. (2021), who suggest that service quality and customer satisfaction positively impact customer loyalty and performance evaluation. Banks should focus on fulfilling customer requirements and providing high-quality services to maintain a competitive edge.

• Q3: what is the expected impact of cybersecurity practices on the SCP of the service sector in Jordanian banks?

According to the results in Table 11, all hypotheses were supported by the total sample, which indicates the importance of cybersecurity practices in enhancing supply chain performance. This aligns with previous research by Sawangwong and Chaopaisarn (2023), who found that technological changes improve supply chain efficiency, particularly in delivery and employee performance. The study’s findings on Jordanian commercial and Islamic banks in the northern region revealed that these practices effectively improve performance levels, reflecting the success of applying cybersecurity practices. According to the analysis, supply chain flexibility is improved by cybersecurity practices that decrease risks and ensure continuous services. To illustrate this effect, measures including data integrity scores and incident reaction time were analyzed. To maintain these positive outcomes, it is essential to continue efforts with the same approach. The second dimension was gender, measured by a t-test in male and female groups, showing differences in male respondents’ agreement toward cybersecurity compared with females and no significant differences in SCP. This result is consistent with research by Venkatesh et al. (2000), who indicate that men are more likely than women to feel confident in and agree with technology-related activities, such as cybersecurity. Differences in familiarity and comfort with technical tools and activities may be the cause of this gender gap in attitudes on cybersecurity. There were no significant differences in academic qualifications in cybersecurity practices or SCP at different educational levels. The t-test result for managers and customers showed significant differences in cybersecurity practices and SCP, attributed to experience in the bank. This is in line with research by Herath and Rao (2009), who show that exposure to cybersecurity concerns and managerial experience improve both understanding and implementation of cybersecurity procedures. Managers are more likely to understand the significance of strong cybersecurity measures and their influence on SCP due to their strategic oversight and experience.

5.1. Theoretical Implications

This study contributes to the literature by highlighting the positive impact of the confidentiality, integrity, and availability (CIA) dimensions on supply chain performance in the banking sector. It demonstrates that these dimensions, when integrated to represent the CIA triad, can influence cybersecurity practices. Moreover, this study adds to the literature on supply chain performance by highlighting the vital role of cybersecurity practices, which are considered essential for supply chains. In addition, this study focuses specifically on the Jordanian banking sector, providing valuable insights into cybersecurity practices and supply chain performance within this circumstance. This emphasis on a specific country and sector can guide future research studying similar dynamics in other countries and sectors, which can expand the applicability and generalization of theoretical models in different contexts. Furthermore, using partial least squares structural equation modeling (PLS-SEM) as a methodological approach to analyze the data can be useful for other researchers who are concerned with researching complex relationships between cybersecurity practices and supply chain performance. This adopted methodological approach can help in determining the applicability and effectiveness of cybersecurity measures in enhancing supply chain performance across various sectors. Moreover, collecting and analyzing data from dual perspectives, from both managers and customers, offers a comprehensive understanding that highlights the need for effective communication and customer engagement about cybersecurity measures.

5.2. Practical Implications

This study can provide practitioners and decision makers with various implications since it investigates the impact of cybersecurity practices on supply chain performance in the Jordanian bank sector. Banks should allocate more resources to invest in cybersecurity measures; thus, this can improve cybersecurity measures, including confidentiality, integrity, and availability.

Conducting regular training programs for employees to raise their awareness about the best cybersecurity practices helps reduce human mistakes that can lead to security incidents. For instance, investment and training help protect against cyberattacks, which improves supply chain performance. In addition, customers’ satisfaction and loyalty can be enhanced through strong cybersecurity practices, which can increase customer trust in digital banking services, and effective communication with customers by letting them know the cybersecurity measures used can boost confidence and loyalty to the bank, since this study’s findings indicate that customers can be more satisfied if they know the cybersecurity protocols in place.

Moreover, implementing cybersecurity measures can improve trust among supply chain stakeholders that can enhance the supply chain efficiency, and prevent disruptions through effective collaborations. By boosting the level of collaboration and trust among stakeholders, banks can efficiently reach the desired stability in their supply chains. Therefore, leaders are urged to allocate resources to investment in modern technology; we encourage them to integrate and incorporate AI power solutions and tools for effective real-time monitoring and predictive analytics. For example, supply chain resilience is a multi-dimensional, multi-perspective, and complex system need a special approach to handle (Alkhatib, 2024). To reach elevated levels of supply chain resilience, legislators can think about enacting laws requiring recurring cybersecurity audit. These actions enhance consumer trust by reinforcing the institutions’ defenses against cyberattacks and creating a stable operating environment.

Policy makers in the central bank of Jordan should be involved in boosting a secure financial environment. By implementing robust cybersecurity regulations, all banks hold high standards of security, which protects the entire financial system. This study’s findings on the high priority given to cybersecurity by managers highlight the need for regulatory support and monitoring. Moreover, managers in the banks should cooperate with expert organizations that can update banks with the latest knowledge and tools of cybersecurity. This collaboration can be useful in establishing vigorous cybersecurity strategies and staying ahead of possible threats. Banks’ overall security postures can be improved by incorporating cutting-edge technologies like artificial intelligence (AI) and machine learning (ML) into cybersecurity frameworks. These technologies can aid in early threat detection, real-time monitoring, and automated response to potential cyberattacks.

6. Conclusions

This study underscores the crucial role of cybersecurity practices in enhancing supply chain performance in the Jordanian bank sector. By employing an analytical/descriptive method and a customized questionnaire, we collected and analyzed data to address key questions related to cybersecurity awareness, implementation, service quality, and supply chain performance. The results of this study not only provide valuable insights but also pave the way for further exploration and advancement in this vital field. They also serve to heighten our understanding of the pivotal role of cybersecurity in the banking sector. Future research should focus more carefully on the cybersecurity practices that have the most effects on supply chain efficiency. Investigating the long-term impacts of regular cybersecurity training initiatives and investments on overall organizational resilience and consumer trust would also be beneficial. Studies comparing countries or industries may also point out best practices and potential improvement areas. In addition, future studies can increase the number of samples from northern Jordan and other regions, explicitly targeting managers to generalize the findings to all bank branches. Additionally, studying the impact of cybersecurity practices on supply chain performance, with customer satisfaction as a mediating variable, and examining the effects of cybersecurity practices on employee performance within Jordanian banks would be valuable areas for future research.