Stop scaring people into security. Fear makes them freeze.

You know the picture. A figure in a hoodie, face in shadow, green code falling behind them. Underneath, a statistic in large type about how many businesses close after an attack. My industry has been selling with that picture for as long as I’ve worked in it, and I think it has done real harm. Fear-based cyber security messaging gets attention. It’s very poor at getting people to do anything.

Why the industry reaches for fear

I understand how it happens. Security is an odd thing to sell, because when it works nothing happens. There’s no before-and-after photo. So the easiest way to make the case is to describe the disaster, as vividly as possible, and let the customer’s imagination do the rest.

It also works, in the narrow sense that people click on it. Frightening headlines get opened. Alarming statistics get shared. A sales call that begins with “did you see what happened to that retailer?” has an easy first five minutes.

The trouble is what happens after the attention. A frightened owner hasn’t been told what to do. They’ve been told to be frightened.

The statistic that won’t die

You’ll have seen the claim that 60% of smaller companies close within six months of a cyber attack. It’s on websites, in slide decks and in a steady stream of sales emails. It’s usually credited to a US body called the National Cyber Security Alliance.

That organisation has said publicly that the figure didn’t come from its research and that it can’t stand behind it. People who’ve tried to trace it have ended up going round in circles of articles quoting each other. Yet it’s still doing the rounds, because it’s frightening and it fits on a slide.

I mention it because it shows where fear-led selling ends up. Once the aim is to alarm, accuracy stops mattering. And an industry that asks for trust can’t afford to be casual with facts. The real numbers are sobering enough. The government’s own survey finds that a large share of UK businesses spot an attack or a breach every year. There’s no need to make anything up.

What the research says about fear

Public health has studied this for decades, because it has the same problem: how do you get people to act on a risk they’d rather not think about? The broad finding is consistent. Fear on its own doesn’t reliably change behaviour. Fear combined with a clear, achievable action does.

Researchers call the second ingredient efficacy. People need to believe the recommended step works, and that they personally can do it. A large review of the evidence published in 2015, covering more than a hundred studies, found that fear-based messages were more effective when they included that kind of message. An influential model from the 1990s explains what happens when they don’t. If the threat feels huge and the fix feels out of reach, people stop trying to control the danger and start controlling the fear instead. They avoid the subject, play it down, or decide it won’t happen to them.

Now read a typical security advert with that in mind. The threat is a faceless criminal gang. The fix is a product you don’t understand at a price you haven’t been told. It’s close to a recipe for avoidance.

Scare someone without showing them what to do and you haven’t made them safer. You’ve made them stop listening.

Ashley Adkins, fromIT

What fear does inside a business

I see three effects, over and over.

It makes owners freeze. If everything is a catastrophe and everyone is a target, where would you even start? So the quote sits unanswered, the meeting gets moved, and nothing changes. I’ve spoken to plenty of owners who knew for years that they should do something and were put off by how overwhelming it had been made to sound.

It makes staff hide things. Training built on fear teaches people that a mistake is a disaster and that they’re the likely cause. So when someone does click the wrong link, the frightened response is to close the laptop and say nothing. Every hour that passes before somebody speaks up makes the clean-up harder.

It wears off. You can only be told the sky is falling so many times. Researchers at the US standards body NIST gave this a name in 2016: security fatigue. People bombarded with warnings become weary and resigned, and start making worse choices. Every overblown alert spends a little of the attention you’ll need for the one that matters.

It also sells the wrong things

There’s a commercial side to this that I think customers deserve to hear. Fear sells whatever is nearest. A frightened buyer wants the feeling to stop, and the quickest way to stop it is to buy something. That might be a tool with an impressive name. It’s much less likely to be an afternoon spent switching on multi-factor authentication, removing old accounts and testing a backup, because nobody makes much money advertising those.

Yet those dull jobs are what stop most attacks. The National Cyber Security Centre has spent years saying that the basics, done consistently, deal with the great majority of what businesses face. That message is calm, specific and achievable. It doesn’t get a tenth of the airtime of the hoodie.

What works instead

The risk is real, and I spend a good part of my working life helping businesses through cyber incidents. So be honest about it, briefly, and then spend most of the time on what to do.

1. Lead with the action. “Turn this on and a stolen password stops being enough” does more than any amount of scene-setting. Here’s how to turn on MFA, since I’ve mentioned it.
2. Make the first step small. One thing that can be done this week, by a named person. Confidence builds from finishing things.
3. Use true numbers and say where they came from. If a supplier quotes a statistic at you, ask for the source. It’s a fair question and the answer is revealing.
4. Talk about what’s been prevented. Tell your team when a report from one of them stopped something. People repeat what they’re thanked for.
5. Take the drama out of mistakes. “Thanks for telling me, let’s sort it” should be the standard reply to “I think I clicked something”.
6. Be wary of anyone whose pitch leaves you more scared than informed. After a good conversation about security you should know what to do next.

When I write a guide or a news story for this site I try to hold to one rule: every piece ends with something you can do. If I can’t offer an action, I haven’t finished the piece. I’d encourage you to hold everyone who talks to you about security to the same standard, me included.

The businesses I see doing well at this have made security ordinary: a short list, a name against each item, and a quiet check that it’s still being done. That’s much less exciting than a hoodie. It works a great deal better.