There are a lot of ways to think about audiences of information security messages. Your relationship to your audience influences how you communicate with them. Why are they listening to you? Are you part of an internal team - are you communicating with your coworkers - or are you an external entity - a contractor/consultant? Is your audience internal or external - are they employees of the company or are they customers/clients/end-users/etc.? Let's look at the pros and cons o

There are a few more things you might want to consider when you're using benefit framing for infosec. These are slightly more advanced considerations but they're at least worth having on your mind. "Topping out" This is the idea that certain people won't respond to your messaging because they're already doing the recommended behavior. It's also from that sunscreen study I keep talking about (citation below) and I think it might apply to infosec, especially with certain audien

Last time, I introduced the basics of gain-loss framing from health communication. I also discussed how this approach should be applied to infosec issues. Now I'm going to give you more detail on how to actually use gain-loss framing. What needs to be manipulated In order to drive behavior - particularly preventative/protective actions - your audience needs to be in a certain mental space. There are a few measures from scholarship that we can look at and alter in our audience

I've spoken before about the need for infosec communication and persuasion to move in a more positive and proactive direction. (This isn't an original argument. @iMeluny and @jessysaurusrex have been saying this for a long time now, among others.) Fear isn't an effective way to motivate action in infosec. To effectively persuade people to be more secure, we need to move away from dark, scary, sky is falling narratives. In the last post we learned that framing is about focusin

Fear can be a great motivator but it can also be paralyzing. Scholars have examined the use of fear appeals in advertising and public information campaigns quite thoroughly and achieved mixed results. While experimental studies have supported the motivating effect of fear appeals, the limitations of that type of research and the uncertain repercussions of their application do call into question whether fear appeals are worth it. The drawbacks Existing studies of fear appeals