Scaring and Bullying People into Security Won't Work

Key finding

Argues that people heed reliable, credible risk signals, but high false-positive security mechanisms teach users to ignore them. Instead of scaring, tricking or bullying users, security needs more accurate detection and less obstructive tools.

Why it matters

A direct expert critique of fear- and coercion-based security programs, including punitive phishing-simulation approaches.

Informs

• Does not shame, punish, or publicly name people who click supports

Cite

Sasse, A. (2015). Scaring and Bullying People into Security Won't Work. IEEE Security & Privacy, 13(3), 80-83. https://doi.org/10.1109/MSP.2015.65