Fear might motivate secure password choices in the short term, but at what cost?

Abstract

Fear has been used to convince people to behave securely in a variety of cybersecurity domains. In this study, we tested the use of fear appeals, together with threat and coping appraisal components separately and together, on password hygiene behaviors. Fear did indeed elicit the anticipated response: people had higher levels of behavioral intention to engage in better password hygiene. Unfortunately, we also detected a largely negative affective response to the appeals. Fear, as a short-lived emotion, can indeed be effective in the short term. Snapshot-like studies, like the one reported here, might lead us to conclude that fear is indeed indicated and efficacious. Yet, it may backfire in the long term due to the negative long term affects it can trigger.

Cybersecurity Regrets: I’ve had a few.... Je Ne Regrette

“…Prior research into cybersecurity and the use of fear appeals by Renaud & Dupuis [81] led us to question whether fear was really being triggered. Dupuis et al [23] found that although fear was indeed triggered, so were other negative emotions. We take this challenge a step further to question: are fear appeals perhaps eliciting a sense of anticipated regret, or even dread, rather than fear?…”

“…Challenges: It is difficult to calibrate the extent of the negative emotion that an appeal can trigger, or the other emotions that arise, and the long-term consequences of these appeals [23].…”