Cyberattacks do not necessarily target only weaknesses in software and networks. In some cases, human judgment and behavior—getting users to open a link, ignore a warning, or choose an insecure setting—determine whether an attack succeeds.

This problem cannot be reduced to users’ knowledge or attentiveness alone. The circumstances in which people make decisions, when and how warnings are presented, and whether the design makes secure options easy to choose also affect security behavior.

Human Judgment Is Also a Target

Users read the information displayed to them, judge the level of danger, and choose actions such as opening a link, stopping a process, checking the content, or reporting to an administrator. Attackers may exploit this decision-making process.

For example, if a message made to look like a legitimate notice pressures users to act quickly, they may proceed without adequately checking the sender or the link destination. Likewise, even when a warning appears before a dangerous action, it may be overlooked if it is hard to distinguish from an ordinary notification.

For this reason, the human side of cybersecurity cannot be completed by user effort alone, such as “being careful” or “learning more.” It is necessary to consider both the situation users are in and how the system supports their decisions.

Knowledge and Behavior Are Not the Same

Knowing about a danger is not the same as being able to choose a safe action in a real situation. Even if users understand a threat, they may not act according to their knowledge when they are pressed for time or do not want to interrupt what they are doing.

When evaluating security behavior, it is important not only to ask about knowledge and intentions but also to look at what users actually chose when they received a warning. Research on warnings has also mainly evaluated observable behavior, such as clicks, choices, response times, and accuracy in identifying dangerous items.

However, even if safe choices increase on the spot, this does not mean users have understood the nature of the danger. Short-term responses alone cannot show whether the behavior continues after the warning is gone or whether the same judgment can be made in other situations.

The Role of Security Warnings

Security warnings are displayed to inform users of potential dangers and prompt protective actions such as checking, stopping, avoiding, and reporting. They include browser warning screens, phishing warnings, and notifications from internal organizational systems.

A warning is not just a display that conveys the existence of a danger. The content of the warning, the timing of its display, how the options are presented, and the feedback given after an action can all change the actions users choose.

On the other hand, displaying a warning does not guarantee safety. Warnings that make it unclear what to avoid, or that are hard to distinguish from ordinary notifications, are less effective as information that helps users choose appropriate actions.

Three Perspectives for Evaluating Warnings

Security warnings can be viewed not only in terms of whether users complied on the spot, but also from the perspectives of behavioral adaptation, trust calibration, and risk-based adjustment of behavior.

Behavioral Adaptation

Behavioral adaptation looks at whether users who receive a warning change their behavior according to the situation, such as stopping a dangerous action, checking the target, or reporting a problem. The focus is not on whether they simply read the warning, but on whether their actual choices changed.

Trust Calibration

Trust calibration considers whether users can make judgments according to the reliability of warnings, rather than always accepting them as correct or ignoring them all. Depending on the accuracy of warnings and on experience and feedback, including false positives and misses, not only appropriate trust but also distrust or overreliance may arise.

Risk-Based Adjustment of Behavior

Risk-based adjustment of behavior looks at how warnings intervene at the moment a technical system makes a threat visible, guiding users’ decisions. Warnings change the effort and burden associated with actions and the cues available, influencing the likelihood that protective actions—such as checking, blocking, reporting, postponing, or choosing a safe alternative—are selected.

However, these three perspectives have not been examined to the same extent in research. Research on warnings has frequently measured short-term behavior, whereas few studies have addressed comprehension or corrective feedback, and studies that formally measured trust calibration are also limited.

Supporting Behavior with Nudges

A nudge is a way of encouraging behavior by adjusting the salience of information, the timing of its presentation, default settings, the effort required for an action, and so on, without prohibiting options or adding explicit rewards or penalties.

In security, even when a secure option is available, users may choose a less secure method if the secure option takes time or effort. The decision environment itself is therefore adjusted—for example, by presenting information just before a dangerous action, making secure settings the default, or giving immediate feedback on the result of a choice.

Nudges do not take choices away from users. Their defining feature is that they make safe actions easier to choose while leaving users free to choose.

Nudges Used in Cybersecurity

The nudges addressed in cybersecurity research can be organized into information and feedback, defaults and interface design, the way information is framed, and ways of showing what others do.

Table 1 Examples of nudges used in cybersecurity

Type	Concept	Example
Information / feedback	Show the information needed for a decision, or the result of a choice, on the spot	Display the impact on security immediately after a setting is changed
Defaults / design	Make the secure option the default, or add confirmation to dangerous actions	Set limited visibility as the default
Framing	Present the same information in a way that conveys its relationship to danger or loss	Clearly state the impact that may result from continuing an action
Social information	Present the behavior or standards chosen by others as input for decisions	Show that the security settings recommended by the organization are being chosen

These are not necessarily used on their own. Several methods can be combined—for example, displaying a warning just before an action, placing the secure option where it is easy to find, and giving feedback after the choice.

Short-Term Effects and Persistence

Research on nudges has reported many short-term effects on directly observable behavior, such as password strength, clicks, and configuration choices. In particular, relatively consistent effects are seen for designs that give feedback at the moment of action and for those that use secure defaults.

However, these effects do not necessarily last. Studies that have followed whether safe behavior is maintained after the nudge or on-screen support is removed are limited, and whether the behavior carries over to other situations has not been sufficiently examined.

For warnings as well, most studies have evaluated immediate responses such as clicks and choices, and studies that evaluated maintenance over time or transfer to other situations are limited.

It is therefore necessary to evaluate separately the fact that users followed a warning on the spot and whether they have understood the danger and can continue making safe judgments on their own in the future. Long-term learning effects cannot be concluded from short-term changes in behavior alone.

Design That Supports Safe Behavior

In measures concerning people, it is important not only to ask users to pay attention but also to create an environment in which safe actions are easy to carry out.

Warnings should be shown at the point where a decision is needed, not at a time removed from the dangerous action. They should make it possible to distinguish what is dangerous and which action to choose, and after the action, they should return the result or how to correct it. Safe options should be easy to find, and unnecessary effort should not be added.

At the same time, measures should not be evaluated by on-the-spot responses alone. By also checking understanding of the warning, the correspondence between warnings and actual dangers, behavior after time has passed, and judgment in other situations, it becomes possible to distinguish mechanisms that make users comply with a display from mechanisms that support safe judgment.

Security behavior is not determined by individual users’ abilities alone. Safe choices need to be supported by the design of the entire system, including warnings, interface design, default settings, and feedback.

Summary

In cyberattacks, not only technical weaknesses but also the process by which users read information, judge danger, and choose actions may be exploited.

Security warnings can be viewed from the perspectives of behavioral adaptation, trust calibration, and risk-based adjustment of behavior. Nudges are a way of making safe actions easier to choose by adjusting how information is presented, default settings, the effort required for actions, and so on, while leaving options open.

Warnings and nudges have been reported to change short-term behavior, but evidence on whether these effects are maintained over time and carry over to other situations is limited. Rather than relying solely on users’ attentiveness, it is important to design systems that support safe judgment and to evaluate their effects continuously.

About This Article

References

• Eleonora Chiantera, Lorenzo Arciulo, Francesco Di Nocera, “Cybersecurity Warnings as Safety-Relevant Learning Mechanisms: A Scoping Review of Behavioral Adaptation, Trust Calibration, and Risk Regulation”
• Lorenzo Arciulo, Francesco Di Nocera, “The Nudging Paradigm in Cybersecurity Research: A PRISMA-Based Systematic Review”

(Last accessed: October 17, 2026)


*This article was compiled based on the author’s understanding, with reference to the literature listed above.