Research / Principles
Principle 4 of 8
Fear raises defenses without raising recognition. Humor disarms, sticks, and lets people notice the lesson without bracing for a verdict.
Argues that people heed reliable, credible risk signals, but high false-positive security mechanisms teach users to ignore them. Instead of scaring, tricking or bullying users, security needs more accurate detection and less obstructive tools.
A review of the wider fear-appeal literature finds real disagreement over whether fear appeals are helpful or advisable, and wide variation in how cyber security fear-appeal experiments are designed. The authors propose a standard protocol for such studies.
Fear appeals did increase people's intentions to adopt recommended security actions, but the effect varied across people and depended partly on self-efficacy, response efficacy, perceived threat severity and social influence.
Treats clicks as data about the Program, not as verdicts on people.
Pairs every warning with a clear, doable action people believe they can take.