Cybersecurity has historically been viewed as a technical matter, often associated with tools and tactics such as firewalls, encryption, and threat detection systems. However, the most significant threats often arise not from technical vulnerabilities but from human behavior. Simple actions such as clicking on a phishing link, using weak passwords, or neglecting to update security settings can lead to breaches in even the most secure systems.
Despite advances in technology, human behavior remains a significant factor in cybersecurity threats. As the number of cyberattacks continues to rise globally,1 there is a growing need to understand the human elements at play and design systems that guide users toward secure decisions and reduce the likelihood of human error.
To improve their security posture, enterprises must focus on the human factors involved in decision making, behavior, and execution. By applying principles from psychology, it is possible to design more effective cybersecurity systems that minimize human error, reduce risk, and foster a culture of security awareness.
The most significant threats often arise not from technical vulnerabilities but from human behavior.
The psychological theories of Daniel Kahneman, Robert Cialdini, and B.J. Fogg can be used to conceptualize how human behavior impacts cybersecurity and to develop strategies that incorporate these insights. These theories offer valuable frameworks for understanding user behavior and improving security solutions.
Applying the concepts of cognitive bias, social influence, and behavior change to the design of cybersecurity systems makes them both more effective and easier for users to engage with. This human-centered approach bridges the gap between technical security measures and user behavior, ultimately leading to systems that are not only secure but also more intuitive and user-friendly.
There is much to be gained from exploring how psychological principles can be directly applied to system design, employee training, and leadership modeling to reduce risk and foster a culture of secure behavior.
The Human Element
Despite significant advances in cybersecurity, human error remains the leading cause of security breaches. Psychological factors such as overconfidence, conformity, and a lack of awareness often influence individuals to make poor security decisions.2
One key challenge is the limited integration of psychological insights into the development of cybersecurity solutions. Although current systems can provide robust technical defenses, they often overlook the human element, leading to vulnerabilities that can be exploited by attackers. This disconnect between system design and human behavior creates security gaps, making systems more susceptible to breaches and driving up costs. As such, there is a growing need for cybersecurity strategies that account for human behavior and psychological factors.
Without practical integration of psychological insights, organizations risk reinforcing poor habits instead of preventing them. This gap can be closed through proper system design and behavioral reinforcement.
Incorporating Psychological Knowledge Into Cybersecurity Design
An effective cybersecurity strategy can be built by examining behavioral economics and social psychology. Insights from these domains can enhance user decision making, thereby reducing the security risk associated with human behavior. Here, a conceptual model is presented that adapts cybersecurity controls to align with how users think and make decisions, ultimately leading to more secure and user-friendly systems. Each model offers not only a framework for understanding behavior but also clear strategies for designing secure systems that align with how users truly think and act.
Kahneman’s Cognitive Biases
Biases are an inherent part of decision making, often leading individuals to make irrational choices.
In cybersecurity, two common biases—loss aversion and overconfidence—can significantly impact user behavior. Psychologist Daniel Kahneman’s concept of loss aversion explains why individuals are reluctant to take actions perceived as effortful, such as updating software or changing passwords, even when these actions are necessary for security.3 Similarly, overconfidence can cause users to underestimate the risk of cyberattacks, leading to poor security practices such as choosing weak passwords.4
To design systems that counter these biases, organizations should use friction-reducing tools such as password managers and single sign-on (SSO) platforms. These tools address loss aversion by reducing perceived effort. Simplifying security tasks reduces users’ cognitive load, minimizing errors and making the system more user-friendly.
Security leaders can also apply behavioral framing by presenting security actions in ways that emphasize potential losses rather than gains. Behavioral framing combats overconfidence by reinforcing risk awareness through carefully-worded prompts. For example, instead of stating, “Regular updates improve security,” a more motivating message would be, “Failing to update may lead to a data breach, jeopardizing sensitive information and business continuity.”
Cialdini’s Social Influence
Social proof, authority, and scarcity are powerful tools in shaping behavior, as evidenced by psychologist Robert Cialdini.5 Organizations can leverage these principles by showcasing secure behaviors as the norm.
One example of social proof is using dashboards or email banners that show how many employees in a department have enabled multifactor authentication (MFA), thereby offering subtle encouragement to adopt the same as a best practice. Such techniques can be integrated into collaboration platforms (e.g., Microsoft Teams, Slack) using badges, usage statistics, or peer shoutouts tied to secure behaviors.
Executive participation is equally vital. When leaders with authority actively model secure behaviors, such as reporting phishing attempts, they set a precedent for others to follow.
Last, scarcity creates a sense of urgency. Time-sensitive incentives, such as rewards for completing security training or upgrading passwords, can drive immediate action, boosting compliance and raising security awareness.
Fogg’s Behavioral Model
Social scientist B.J. Fogg’s behavioral model offers valuable insights for improving cybersecurity measures by emphasizing three core elements of behavior change: motivation, ability, and prompts.6
Motivation helps users understand the personal stakes of security, such as safeguarding their own payroll data or avoiding identity theft. System designers can improve ability by removing unnecessary complexity, for example, by using progressive disclosure to show only necessary security steps in context. Prompts, or triggers, should be timely and aligned with natural workflows, such as prompting users to enable MFA when they first sign into a new resource.
Considering these factors in the design of cybersecurity systems can enhance usability and reduce users’ cognitive load. For example, IT departments can create simple, repeatable templates or microlearning modules for departments to use when onboarding new tools or enforcing security policies. Embedding prompts in commonly used tools, offering just-in-time guidance, and making secure behaviors more visible all help scale behavior change.7
Systems that align with Fogg’s model result in cybersecurity solutions that are less prone to user error and more effective in fostering long-term compliance.
Research shows that integrating human factors into cybersecurity improves compliance, reduces risk, and leads to a more cyberresilient enterprise (figure 1).8 When systems align with users' needs and behaviors, they become more engaging and credible, leading to higher adoption rates and better security outcomes.9
Source: World Economic Forum, “Principles for Board Governance of Cyber Risk,” March 2021
Case Studies: Applying Psychological Principles in Practice
Three case studies illustrate how decision making, social influence, and behavior change can inform more effective cybersecurity solutions. These examples help bridge the gap between technical cybersecurity measures and the psychological factors that influence user behavior, with the ultimate aim of reducing human error. Each case connects directly to the behavioral frameworks of Kahneman, Cialdini, or Fogg, demonstrating how theory can be translated into operational success.
Increasing MFA
New America’s initiative to promote MFA reflects Cialdini’s principle of social proof. The organization used behavioral nudging to show users that enabling additional security was the norm. A prompt such as “Join thousands of users who have already secured their accounts” encouraged adoption by presenting the action as common and expected.10 Referencing peer behavior is an effective way to encourage secure practices such as MFA adoption.
Gamified Cybersecurity Training
AmerisourceBergen partnered with Living Security to launch interactive cybersecurity training grounded in real world scenarios. This aligns with Fogg’s model, which emphasizes motivation through relatable content and ability through simplified learning. The gamified format increased employee participation and improved retention of key security concepts.11 Security training becomes more impactful when it builds motivation and reduces complexity using engaging and relevant experiences.
Cyberattack Simulation
PwC Cayman Islands introduced a simulation called “Game of Threats” that placed executives in realistic cyberattack scenarios. This hands-on approach improved decision making by making risk feel more immediate, an application of Kahneman’s work on how people perceive threats. The involvement of senior leaders also reinforced Cialdini’s principle of authority, signaling the importance of cybersecurity from the top.12 Simulations that engage leadership help shift risk perception and set the tone for organization-wide commitment to security.
Each organization saw positive behavioral change by aligning its cybersecurity strategies with how employees make decisions, respond to influence, and engage with technology.
Across these efforts, organizations reported gains in key performance indicators such as:
- Higher adoption rates of MFA
- Increased completion of cybersecurity training
- Reduced user error and security missteps
- Improved leadership engagement in cybersecurity initiatives
Future Directions
Future research should explore the role of artificial intelligence and machine learning in personalizing cybersecurity measures. These technologies could offer tailored security recommendations based on users’ actions, encouraging more diligent security practices among less experienced users.13
Additionally, a deeper understanding of how various psychological models intersect could expand the application of behavioral insights in cybersecurity design. Specifically, integrating Kahneman’s cognitive biases and Fogg’s behavior model could lead to more adaptive, user-friendly systems that are better equipped to mitigate user-related risk.
Conclusion
Security breaches often stem from human actions influenced by psychological factors such as overconfidence, ambiguity avoidance, and loss aversion. To address this, organizations must move beyond technical safeguards and incorporate psychological principles such as cognitive bias awareness, social influence, and behavioral design into their cybersecurity strategies.
This involves providing behavioral training that helps employees recognize and manage biases, designing systems that guide users toward secure choices using thoughtful prompts and defaults, and reinforcing secure behaviors through timely feedback. These steps reduce risky behavior, improve compliance, and strengthen the overall security posture of the organization.
Failing to account for the human element leaves organizations more vulnerable to breaches, regulatory violations, and reputational damage. But by aligning systems with how people think and behave, enterprises can reduce error, increase compliance, and build a culture where secure behavior is a shared responsibility and daily norm.
Endnotes
1 Verizon, 2024 Data Breach Investigations Report, May 2024
2 Stanford University, Tessian, Psychology of Human Error 2022: Understand the Mistakes That Compromise Your Company’s Cybersecurity, March 2022
3 Kahneman, D.; Knetsch, J.; et al.; “Anomalies: The Endowment Effect, Loss Aversion, and Status Quo Bias,” Journal of Economic Perspectives, vol. 5, iss. 1, 1991, p. 193–206, Ceric, A.; Holland, P.; “The Role of Cognitive Biases in Anticipating and Responding to Cyberattacks,” Information Technology & People, vol. 32, iss. 1, 2019, p. 171–188
4 Johnson, C.K.; Gutzwiller, R.S.; et al.; “Decision-Making Biases and Cyber Attackers,” 36th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW), 2021
5 Isabella, G.; “Persuasion and the Six Cialdini Principles Applied in Social Marketing,” in The Palgrave Encyclopedia of Social Marketing, p. 1–8, 12 July 2022
6 Fogg, B.; “Fogg Behavior Model,” Lahcen, R.A.M.; Caulkins, B.; et al.; “Review and Insight on the Behavioral Aspects of Cybersecurity,” Cybersecurity, vol. 3, iss. 10, 2020
7 Addae, J.H.; Sun, X.; et al.; “Exploring User Behavioral Data for Adaptive Cybersecurity,” User Modeling and User-Adapted Interaction, vol. 29, 2019, p. 701–750
8 Pollini, A.; Callari, T.C.; et al.; “Leveraging Human Factors in Cybersecurity: An Integrated Methodological Approach,” Cognition, Technology & Work, vol. 24, iss. 2, 2021
9 Marble, J.L.; Lawless, W.F.; et al.; “The Human Factor in Cybersecurity: Robust & Intelligent Defense,” Advances in Information Security, 2015, p. 173–206
10 New America, “Case Study #2: Offering Two-Factor Authentication
11 Living Security, “Scaling User Engagement With Security Awareness: How AmerisourceBergen Successfully Used the Living Security Platform”
12 PwC, “PwC Uses Innovation to Transform Cybersecurity Training”
13 Ofusori, L.O.; Bokaba, T.; et al.; “Artificial Intelligence in Cybersecurity: A Comprehensive Review and Future Direction,” Applied Artificial Intelligence, vol. 38, iss. 1, 2024
Kelven M. Leverett, CISM, CISSP
Is an information security program manager with more than 15 years of experience in cybersecurity, risk management, and regulatory compliance. He has spent most of his career in the public sector, working in local government and the broader state, local, and educational (SLED) environment, where he specializes in building human-centered security strategies that bridge technical controls with behavioral design.
