Can Threats and Fear Foster Security? Cognitive and Emotive Forces of Fear Appeals on Information Security Behavior

Individual users can create vulnerabilities in an organization’s information security by carelessness, negligence, and/or noncompliance with security policies and procedures, so it is important for organizations to motivate employees’ security behavior. Fear appeals are messages designed to motivate behavioral change by describing a threat associated with a behavior, but existing theories fail to explain how a fear appeal evokes fear and how fear influences behavior. A better understanding of the factors influencing responses to information security fear appeals would help organizations to design security messages in ways that increase their persuasive effectiveness. Therefore, this dissertation offers theoretical and empirical work to expand knowledge about these factors.

This research develops an emotion process model and a behavior process model for fear appeal threats, based on a synthesis of theories from psychology, organizational behavior, and neuroscience. These models were tested in a series of experimental studies to investigate how threat-based message components can drive emotion and cognition to motivate appropriate security behavior. The first study consisted of a lab experiment that manipulated each message component (threat severity, threat vulnerability, and emotional interest) in a separate stimulus to determine its influence on an individual’s feeling state. The second study consisted of a lab experiment that manipulated combinations of fear appeal components to determine the influence of their interactions on an individual’s feeling state. The results of these experiments indicate that fear appeals influence an individual’s feeling state in different ways, depending on the fear appeal’s composition. The third study consisted of a field experiment that investigated the degree to which fear appeals motivate individuals to improve their password behavior. The results of this experiment indicate that feeling state fully mediates the relationship between a fear appeal’s threat verbalization and an individual’s beliefs, where those beliefs subsequently influence attitude, intention, and observed and perceived behavior associated with password use. This dissertation thus provides evidence that security messages can leverage emotion to motivate individuals to perform appropriate security behavior.