Organisations are increasingly focusing on their business processes (BPs) to excel. Since the journey towards process excellence is challenging, various authors have proposed a business process maturity model (BPMM) to gradually improve maturity and capability. Nonetheless, a comprehensive definition for BPMM, maturity and capability is missing. Moreover, the differences between maturity and capability are frequently neglected. Therefore, this study elaborates on the lacking foundation. In particular, a thorough literature study is conducted to address three gaps regarding the BPMM scope, terminology and design. It reveals six basic BPMM components within a BP lifecycle (scope gap): (1) modelling, (2) deployment, (3) optimisation, (4) management, (5) culture and (6) structure. Their overall growth refers to maturity, whereas the growth of an individual component includes capability (terminology gap). To increase its usability, a BPMM gives guidance on both assessing and improving BPs (design gap). The findings allow clear communication about BPMMs, and new models based on the identified components. This unambiguous understanding helps to avoid confusion and inappropriate assumptions in the BP literature. Future research will further validate the definitions by comparing BPMMs.

The article elaborates on business process maturity, which indicates how well an organisation can perform based on its business processes, i.e. on its way of working. This topic is of paramount importance for managers who try to excel in today's competitive world. Hence, business process maturity is an emerging research field. However, no consensus exists on the capability areas (or skills) needed to excel. Moreover, their theoretical foundation and synergies with other fields are frequently neglected. To overcome this gap, our study presents a conceptual framework with six main capability areas and 17 sub areas. It draws on theories regarding the traditional business process lifecycle, which are supplemented by recognised organisation management theories. The comprehensiveness of this framework is validated by mapping 69 business process maturity models (BPMMs) to the identified capability areas, based on content analysis. Nonetheless, as a consensus neither exists among the collected BPMMs, a classification of different maturity types is proposed, based on cluster analysis and discriminant analysis. Consequently, the findings contribute to the grounding of business process literature. Possible future avenues are evaluating existing BPMMs, directing new BPMMs or investigating which combinations of capability areas (i.e. maturity types) contribute more to performance than others.

Prior studies have shown that the behaviours and attitudes of Internet users influence the likelihood of being victimised by phishing attacks. Many scammers design a step-by-step approach to phishing in order to gain the potential victim’s trust and convince them to take the desired actions. It is important to understand which behaviours and attitudes can influence following the attacker in each step of a phishing scam. This will enable us to identify the root causes of phishing and to develop specific mitigation plans for each step of the phishing process and to increase prevention points. This study investigates to what extent people’s risk-taking and decision-making styles influence the likelihood of phishing victimisation in three specific phishing steps. We asked participants to play a risk-taking game and to answer questions related to two psychological scales to measure their behaviours, and then conducted a simulated phishing campaign to assess their phishability throughout the three phishing steps selected. We find that the attitude to risk-taking and gender can predict users’ phishability in the different steps selected. There are however other possible direct and indirect behavioural factors that could be investigated in future studies. The results of this study and the model developed can be used to build a comprehensive framework to prevent the success of phishing attempts, starting from their root causes.