Purpose: The purpose of this paper is to broaden the understanding about security behaviour bydeveloping a security behavior typology based on the concepts of discipline and agility.Design/methodology/approach: A case study was designed to analyze security behaviours in onepublic nursing centre. The inquiry was organized around the themes discipline and agility, culture,and security processes in order to get an in-depth understanding of the complex relationship betweensecurity management, referred to as discipline, and security in use, referred to as agility.Findings: The paper shows that security behaviour can be shaped by discipline and agility and thatboth can exist collectively if organizations consider the constitutional and existential aspects ofinformation security management.Practical implications: This research makes a pivotal stand for the issue how security behavioursnarrate a broad picture to enhance information security management. In particular, this will improvedesign of information security training and awareness programs.Originality/value: This research is relevant to information security management in organizations,particularly as behavioural and cultural aspects are becoming increasingly significant for maintainingand also designing systemic information security management.