Why People Click, lessons from qualitative research" with David Shipley & Michael Joyce

Key Concepts

• Cybernetics: The study of command and control in living organisms and machines.
• Kernetes: The Greek word for "helmsman" or "steersman," the root of "cyber."
• Human as Weakest Link: The traditional cybersecurity approach viewing humans as the primary vulnerability.
• Fishing: A social engineering tactic used to trick individuals into revealing sensitive information or performing actions that compromise security.
• Fishing Simulations: Simulated phishing attacks used for training and testing employee awareness.
• Hawthorne Effect: The phenomenon where individuals modify their behavior in response to being observed.
• Security Fatigue: The phenomenon where individuals become desensitized or overwhelmed by constant security alerts and training, leading to reduced effectiveness.
• Protection Motivation Theory (PMT): A theory explaining how individuals are motivated to protect themselves from threats based on perceived severity, probability, and their ability to mitigate the threat.
• Self-Efficacy: An individual's belief in their own ability to succeed in specific situations or accomplish a task.
• Technological Utopianism: The belief that technology, particularly advanced AI, can solve all problems, including cybersecurity.
• System 1 Thinking (Thinking Fast): Intuitive, automatic, and emotional decision-making.
• System 2 Thinking (Thinking Slow): Deliberate, analytical, and logical decision-making.
• Aggressive Mimicry: A predatory strategy where an organism imitates something benign to lure prey.
• Post-Click Report Rate: The rate at which individuals report a phishing attempt after they have already clicked on it.
• Cybersecurity Alignment: An individual's perception of how well their organization's security practices align with their own actions and beliefs.
• Optimism Bias: The tendency to believe that negative events are less likely to happen to oneself than to others.

Understanding "Cyber" and the Human Element in Cybersecurity

The discussion begins by clarifying the etymology of "cyber," tracing it back to the Greek word "kernetes" (helmsman), emphasizing the core concepts of human, technology, and control. This sets the stage for a critique of the traditional cybersecurity paradigm, which has historically focused on using technology to control humans, often viewing them as the "weakest link." Despite significant investment (over $250 billion annually), this approach has yielded worsening results. The speakers argue that this strategy fails to leverage the rich knowledge available in the social sciences, which are crucial for understanding human behavior in the digital realm. Bosron's mission is to empower people to control technology, recognizing that a holistic approach combining human and technological understanding is necessary for individuals to make good choices, reduce risk, and thrive online.

The Persistent Threat of Phishing and the Limitations of Traditional Training

Phishing remains the most prevalent tactic for compromising organizations, highlighting the ineffectiveness of solely relying on technical controls like phishing filters. Phishing exploits deeply ingrained human psychological and neurological vulnerabilities, making it a fast, cheap, and highly effective attack vector. The speakers assert that no one is "fishing proof" and that under the right circumstances, anyone can be compromised.

Recent headlines questioning the efficacy of security awareness training are addressed. While acknowledging that some training methods, particularly those delivering education after a click and where users quickly panic and close the material, are ineffective, the claim that all training fails is refuted. Research from institutions like the University of California, San Diego, shows mixed results, with some approaches proving more effective than others. The Hawthorne effect is introduced as a potential factor in the effectiveness of phishing simulations, where the act of observation can lead to behavioral changes.

Data-Driven Insights into Training Decay and Reporting vs. Clicking

Michael Joyce presents data from Bosron's extensive dataset (over 1300 organizations, 170,000 individuals, 15 million simulations) to illustrate the decay of security awareness over time. Key findings include:

• Low Initial Engagement: 69% of people do not interact with phishing simulation emails.
• Click vs. Report: Only 3.6% clicked, and 28% reported. Crucially, clicking and reporting are not opposite ends of the same spectrum; they are distinct behaviors with different motivations.
• Training Decay:
  • Immediately after training (Day 0), the click probability is 3.5%.
  • After 30 days, click probability rises to 5.7%.
  • After 90 days, it reaches 14.8%.
  • After 360 days, it climbs to 95%.
  • Reporting rates also decay, dropping from 98.4% on Day 0 to 3.6% after 360 days.
• Implications for Training Frequency: The data suggests that annual training is insufficient. The rate of training delivery should align with an organization's risk appetite, as skills degrade significantly over time.

Rethinking Security Awareness: Vigilance and Marketing

David Shipley emphasizes that security awareness has two components:

1. Stateful Awareness: Knowing that a threat exists (e.g., phishing). This knowledge is generally retained.
2. Vigilance: The continuous, willing expenditure of mental energy to practice safe behaviors. This requires ongoing effort due to competing mental demands.

This understanding shifts the focus from a one-time "check the box" annual training to a continuous marketing effort that motivates employees to buy into security. Effective security awareness requires a sharp message and the right frequency, suggesting interventions every 90 days as a potential new default.

Unpacking the "Why": Attitudes, Fatigue, and Cognitive Biases

The discussion delves into the qualitative data to understand why people click.

• Monday Morning Hypothesis (and its Demise): An initial hypothesis that specific reasons for clicking would emerge on Monday mornings (e.g., rushing) was not supported by statistical analysis (chi-squared tests). The only significant finding was a higher percentage of users reporting "no feeling" when clicking on Mondays between 8-10 am.
• Security Fatigue: Data indicates that increased phishing frequency beyond monthly simulations (e.g., weekly, bi-weekly) leads to diminishing returns in click rate reduction and a statistically significant drop in report rates. This supports the concept of security fatigue, where oversaturation leads to tune-out.
• Cognitive Biases and Attitudes:
  • "I'm not a target" attitude: Individuals who strongly disagreed with being a target clicked on phishing 37% more. This highlights the importance of addressing optimism bias and making people realize they can be targeted.
  • Technological Utopianism: Believing that security tools (including AI) are perfect leads to a 140% higher click rate compared to those who disagree. This misplaced trust in technology overlooks its human-made flaws.
• Protection Motivation Theory (PMT): This framework explains motivation to protect oneself based on:
  • Severity and Probability of Harm: Perceived threat.
  • Self-Efficacy: Belief in one's ability to mitigate the threat.
  • Response Efficacy: Belief that the mitigation strategy works.
  • Cost of Mitigation: Resources required. Early indications suggest PMT is a valuable framework for understanding and influencing behavior.

Mimicry, Fear, and the Nuances of Human Response

The concept of aggressive mimicry from biology is applied to phishing, distinguishing between:

• Benign Mimics: Phishing emails that look like legitimate, everyday communications, encouraging interaction.
• Direct Lures: Phishing attempts that are overtly suspicious (e.g., "Nigerian prince" scams).

The psychological processes involved in responding to these different types of lures are likely distinct.

Regarding emotions and motivations for clicking:

• Fear: Surprisingly, fear of consequences was the lowest reported emotion. However, fear-based clicks had the highest click rate and the lowest report rate (including post-click reports). This suggests fear can drive impulsive clicks and discourage reporting mistakes.
• Curiosity and Expectation: These emotions were associated with higher report rates and a greater comfort level in reporting.
• Emotional Engagement: A significant portion (67%) of respondents reported feeling nothing or not remembering their emotional response to phishing emails, indicating low emotional engagement.
• Timeliness of Response: Responding to surveys within 24 hours of an incident led to better learning and a higher likelihood of remembering feelings, suggesting the importance of immediate feedback.

The Role of Fear vs. Empowerment and the Future of Cybersecurity

The discussion strongly advocates for moving away from fear-based awareness campaigns. Research suggests fear has a short lifespan and can lead to negative outcomes like increased clicking and decreased reporting. Instead, an empowerment-based approach is recommended, focusing on:

• Boosting Self-Efficacy: Helping individuals feel confident in their ability to identify and report threats.
• Leveraging PMT: Clearly communicating the threat and empowering individuals with effective mitigation strategies.
• Psychological Safety: Creating an environment where employees feel safe to report mistakes without severe repercussions.

The data indicates that when employees feel their actions matter and that their employer cares about them, their click rates decrease and report rates increase.

Conclusion and Future Directions

The session concludes by reiterating that cybersecurity is a multidisciplinary issue requiring knowledge from social sciences, behavioral economics, psychology, and more. The speakers emphasize that AI is not a silver bullet and that human understanding is paramount. The effectiveness of phishing simulations is supported by data, with a vast majority of employees finding them beneficial and learning from the experience. The importance of timely feedback, addressing cognitive biases, and fostering a culture of vigilance and empowerment are key takeaways. The speakers encourage a continued exploration of these human-centric approaches to build more resilient cybersecurity postures.