It is not as simple as that: Playing out password security trainings in order to nudge password changes

The COVID-19 pandemic forced a number of companies to place their staff into home office. In terms of security awareness measures, this means that content or training can only be played out remotely. Within this work, we report about a security awareness campaign focusing on password security that was carried out at a German mid-size company (2000 employees). We compare the effect of remotely played out training content on user behavior, i.e, on getting employees to change their password. The first content was directly embedded into an e-mail, the second was compiled on an intranet web page, and the third content was embedded into a video. Password changes were observed solely within the IT backend on the basis of events and timestamps generated by the company’s Active Directory service. For the campaign four representative samples (140 employees per sample) among the staff were selected and assigned to the different training contents. A fourth group served as a control group. During a period of 6 weeks, the content was played out two times. Unexpectedly, the measured password change rate observed was very low. Further, compared to the control group’s behavior, none of the different content formats played out led to significant more password changes. Clearly, the campaign failed according to its aim. Based on our observations, we provide several possible explanations for which there is some evidence from the literature.