Human behavior in cybersecurity: an opportunity for risk research

In cybersecurity, many serious incidents can be traced back to human behavior, either on the attacker’s or victim’s side. Ransomware attacks are a prime example of a highly effective approach relying on an attacker’s deliberate exploitation of a single human error. Despite decades of research on risk perception and behavior, little has been done to transfer existing insights on human factors to secure individuals and organizations in the digital space. Many foundational concepts central to our research community, such as uncertainty, risk compensation, and risk as affect are still underrepresented in the current cybersecurity discourse. Thus, we shed light on concepts that can address today’s challenges to increase cyber resilience, such as the use of heuristics to detect incidents or mental models to enable target group-oriented risk communication. As a starting point, we formulate research questions that aim to transfer risk frameworks and methodologies to cybersecurity to pave the way for new approaches to cyber risk management, better security tools, and effective security policies.