Do Different Mental Models Influence Cybersecurity Behavior? Evaluations via Statistical Reasoning Performance.

Area of Science:

• Cognitive Psychology
• Cybersecurity
• Risk Perception

Background:

• Cybersecurity research frequently uses metaphorical mental models to explain internet security understanding.
• Limited empirical evaluation exists on the accuracy or productivity of these mental models.

Purpose of the Study:

• To assess if alternative mental models (disease risk, physical security, criminal behavior) enhance cybersecurity understanding compared to the cybersecurity context itself.
• To evaluate the impact of numerical formats (percentages vs. natural frequencies) on statistical reasoning within these contexts.

Main Methods:

• Two experiments presented participants with statistical reasoning tasks framed in cybersecurity and three alternative mental models.
• Tasks utilized either percentages or natural frequencies, followed by behavioral likelihood ratings.

Main Results:

• Natural frequencies consistently promoted correct Bayesian reasoning, aligning with prior research.
• Alternative mental models showed minimal improvement in understanding or reasoning over the cybersecurity context.
• Numerical format significantly impacted responses, more so than the tested mental models.

Conclusions:

• Improving the content and clarity of internet security warnings is crucial.
• Efforts should focus on enhancing warning messages rather than attempting to alter users' underlying mental models of security.