This document discusses using behavioral science techniques to improve cybersecurity compliance. It explains that people don't lack understanding but lack motivation, so motivating people is key. Three techniques are discussed: nudging to subtly influence decisions, social proof to highlight what the majority does, and positive reinforcement to encourage desired behaviors. The document provides examples of how these techniques can be applied to cybersecurity, such as frequent personalized communications, sharing anonymous performance comparisons, and rewarding strong performers with badges and time off.

1. Applying behavioral science
to cybersecurity

2. People don't do things because they don't understand.
They don't do things because they're not motivated to.
(PROVEN BY RESEARCH, HARVARD BUSINESS REVIEW 2018)

3. So, in order to get more compliance
in cybersecurity, we just need to
motivate people, right?

4. Sure. But how?
(hint: use behavioral science)
Social Proof Positive motivationNudging

5. Nudging
1) Understand how people make decisions
2) Create environments that nudge them to
do what’s right.

6. It's messy
UNDERSTAND THE
WORLD
Motivation and complexity don't mix
MAKE IT
EASY
Our lives are busy
BE
EMPATHETIC
“It's not that people are stupid,
but that the world is complicated.”
- Richard Thaler, the founder of Behavioral Economics
How do you nudge?

7. How we use nudging
Frequent, personalized communications
For at risk employees
Our nudging helps them slow
down, evaluate their risk, and
take steps to improve
For strong performers
Our nudging validates strong
performance and encourages
continued great work

8. Social Proof
A behavioral science technique that highlights
what the majority is doing.

9. We might think that
we're autonomous
beings navigating
through the world but
in truth... WE'RE CONSTANTLY
MIMICKING THE BEHAVIOR
OF PEOPLE AROUND US.

10. Tie security to
something that your
employees already
care about
The key to using
social proof in
security

11. We score employees and
share performance,
compared to their peers.
How we use social proof

12. Positive Reinforcement
Presenting a pleasant stimulus after a behavior
so the desired behavior continues.

13. The security industry motivates by
fear and uncertainty.
But, when something is too scary, it
leads to numbness and inaction.

14. (PROVEN BY RESEARCH, HARVARD BUSINESS REVIEW 2016)
THE HIGHEST PERFORMING TEAMS
HAVE FIVE OR SIX TIMES MORE
POSITIVE RECOGNITIONS TO EVERY
ONE CRITICISM
Using positive
reinforcement
in security

15. badges
encouragement
time back in their day (no additional training)
high leaderboard status
How we use positive
reinforcement
(WHO DOESN'T LIKE BEING A LEADER?)
We reward high performers with:

16. Check us out
to learn more.
.com