Surfing the Motivation Wave to Create Security Behavior Change
summary
Argues that training alone fails and behavior needs motivation ability trigger (Fogg model); shows concrete fixes: install a password manager to raise ability, add an email “report” button to spike reports, use mantraps or guards for tailgating. Gives metrics: a Georgia Tech social-proof prompt yields 1.36x installs of MFA, a rollout timed to a breach deploys 40 days across tens of thousands of users, and a LastPass-style influencer nudge produced 28% adoption in 48 hours. Recommends positive rewards and a 5:1 positive:negative feedback ratio.
AI-written summary · about
chapters (9)
- 0:00Introduction and speaker intro
- 2:30Employee as first line of defense
- 5:24Behavioral science in security
- 8:59Simplifying security actions
- 12:13Timing motivation peaks
- 17:59Generating motivation
- 23:12Rewards over punishment
- 27:08Balancing motivation and ability
- 28:11Q&A and closing
related talks
35mHow UX Research and Behavioral Science Can Help to Improve People's Cyber Security Behaviors
01h 07mKeynote Presentation Blinded by “the weakest link” A New Perspective on Human Risk
30mThe Power of Persuasion: Better Security Through... Manipulation?
19mAdvanced Authentication Framework
44m(in)Security is eating the world
38mAnatomy of the Attack: The Rise and Fall of MFA
01h 03mWhy Don't Users Do What They are Supposed to Do? A look at users and security
43mEngagement through Entertainment: How to Make Security Behaviors Stick