Cyber Security Awareness Campaigns: Why do they fail to change behaviour?

TL;DR

This paper critically examines why Cyber Security Awareness Campaigns often fail to change user behaviour, emphasizing psychological factors, risk perception, and motivation, and reviews effective components and cultural examples.

Contribution

It provides a psychological perspective on campaign failures and identifies key factors influencing their success or failure, offering insights for designing more effective awareness strategies.

Findings

Understanding risk perception is crucial for effective campaigns.

Motivation and attitude change are necessary for behaviour change.

Cultural context influences campaign effectiveness.

Abstract

The present paper focuses on Cyber Security Awareness Campaigns, and aims to identify key factors regarding security which may lead them to failing to appropriately change people's behaviour. Past and current efforts to improve information-security practices and promote a sustainable society have not had the desired impact. It is important therefore to critically reflect on the challenges involved in improving information-security behaviours for citizens, consumers and employees. In particular, our work considers these challenges from a Psychology perspective, as we believe that understanding how people perceive risks is critical to creating effective awareness campaigns. Changing behaviour requires more than providing information about risks and reactive behaviours - firstly, people must be able to understand and apply the advice, and secondly, they must be motivated and willing to do so - and the latter requires changes to attitudes and intentions. These antecedents of behaviour change are identified in several psychological models of behaviour. We review the suitability of persuasion techniques, including the widely used 'fear appeals'. From this range of literature, we extract essential components for an awareness campaign as well as factors which can lead to a campaign's success or failure. Finally, we present examples of existing awareness campaigns in different cultures (the UK and Africa) and reflect on these.