Individual's Response to Security Messages: A Decision-Making Perspective

Individual decision making determines critical outcomes for organizations in various domains including information security, where the increase of security incidents is causing great concern to organizations. Information security awareness programs are an important approach towards educating users to prevent such incidents. However, it is unclear how to effectively design security programs and messages such that they can inform and change user behavior. This paper attempts to investigate this problem by studying the effects of security message characteristics on users, using the decision-making theory of elaboration likelihood. A 2×2 factorial design experiment was conducted to determine the influence of message repetition and message comprehensibility on user’s elaboration likelihood towards a security message. Our findings indicate that message repetition enhances elaboration likelihood of users. Message comprehensibility interacts with message repetition in determining elaboration likelihood. The results have implications for designing effective security messages and for decision support systems for this purpose.