Nowadays, information security is a crucial issue in organizations. Security flaws are serious threats to an organization. Every organization has sensitive information that may be threatened by malicious adversaries and even employees (insiders). In order to limit security incidents, each organization must concentrate on employee’s behavior. Indeed, employees of an organization act as a natural safeguard for information. Therefore, predicting the behavior of internal employees against the information assets of the organization is very important. To this end, this paper proposes a game-theoretic modeling approach to capture the interaction between employees and organization to predict malicious employees (insiders) and organizations behavior with incomplete information. The game parameters are some important elements of security culture including influencing and organizational behavior factors, and security related factors. By solving the game model, Nash equilibriums are computed and best possible strategies for the participants are recognized. Quantitative evaluation of the information security of organization can be done according to the probability of performing unacceptable behavior by employees and the probability of organization investment in order to increase the organizational information security.