Cyber Security is everyone's business

The talk starts from a gap in research: most work on cyber security behaviour looks at organisations, while home users face scams, phishing and hacking with little formal training or support. Drawing on a master's thesis about how security messages are framed, the speaker argues that home users have to be motivated to change their habits, and that communication and education are currently the main tools available.

The main finding is that awareness messages lean heavily on threat and fear appeals, emphasising severity and vulnerability, while encouragement and self-efficacy receive less attention. Too much fear can leave people passive. The speaker explains this using protection motivation theory and a seatbelt analogy, and presents social marketing as a way to offer a concrete reward for adopting a behaviour, such as a password manager that removes the need to remember passwords. A single generic message also fails, since novices need basics while experienced users need more advanced content.

Recommendations include a less fearful, more encouraging tone, targeted content based on audience analysis, practical rewards in campaigns, more skilled communicators, and dropping the idea that people are the weakest link. In the Q&A, the speaker suggests these ideas could also work in workplaces and mentions game-based practice as a way to build confidence. Who should lead home user education remains an open question.