Influence of Cumulative Risk Priming on Security Update Decision Making

Abstract

Installing security updates is one of the important security actions individuals can take to prevent potential cybersecurity threats. The cumulative risk of delaying the installation of security updates over an extended period can be substantial, and yet, people often choose to delay such actions. Past research suggests that people neglect to update because the majority overestimate the cost (e.g., time) of an update and underestimate an attack risk. Utilizing the repeated protective decision paradigm, we conducted a laboratory experiment to examine whether priming people about the cumulative risk of not updating could influence their update speed. Results from our experiment show that communicating cumulative risk would only have a momentary effect on peoples’ update decisions and that people would quickly learn from experience to delay or neglect to update. Our findings highlight the importance of augmenting user habits to improve update decision-making.