Cyber Security Awareness Campaigns: Why do they fail to change behaviour?

Key finding

Awareness campaigns fail when they only provide information: people must be able to understand and apply advice and be motivated to act, which requires attitude and intention change. Reviews persuasion techniques, including fear appeals, and lists factors behind campaign success or failure.

Why it matters

Explains why information-only awareness training rarely changes behavior and points to motivation, attitudes and culture as the levers.

Informs

• Builds confidence, not fear, in awareness messages supports

Cite

Bada, M., Sasse, A. M., & Nurse, J. R. C. (2015). Cyber Security Awareness Campaigns: Why do they fail to change behaviour?. International Conference on Cyber Security for Sustainable Society, 2015 (arXiv:1901.02672, posted 2019). https://arxiv.org/abs/1901.02672