Paper on Security Behaviour Change Curve accepted @ SCP 2026 🎉
Our paper Applying Behaviour Change Knowledge to Foster Secure Employee Behaviour: An Exploratory Study with Security and Security Awareness Practitioners by Rebecca Panskus, Angela Sasse and Karola Marky was accepted as full paper at the Conference on Sociotechnical Cybersecurity and Privacy (SCP2026), which will take place in Belval, Luxembourg.
🠶 Abstract: Most organisations provide security awareness and training for their employees, through face-to-face sessions or online modules that explain risks and secure behaviours to mitigate them. In 2016, Beyer et al. pointed out that the transmission of knowledge about risks and behaviours is not enough to establish secure behaviour. They proposed an awareness maturity curve as a theoretical framework consisting of seven stages of behaviour change to establish secure behaviour, and measures that organisations need to deploy in order to support their employees in the transition. In 2022, Sasse et al. proposed a revised version, the security behaviour change curve (SBCC) with 9 stages. We briefly introduce the SBCC and explain the psychological and behavioural science concepts from which it is derived. We then describe an exploratory study with 25 experienced security and security awareness practitioners who we asked to apply the SBCC in order to design interventions in nine ideation workshops. Guided by a set of questions, they were asked to propose interventions for each stage for four hypothetical scenarios based on documented security behaviour issues. We found that practitioners overwhelmingly propose interventions they currently use – even if they have been shown to be ineffective – and try to fit them in the stages; creating suitable interventions on the stages of the SBCC guided by the concepts was a challenge. We provide a dataset of expert-ideated interventions for the four real-world security-critical behaviours, and supplementary guidelines for practitioners.
