Risk communication in cyberspace: a brief review of the information-processing and mental models approaches

Effective risk communication in cyberspace is critical for users to understand the potential security risks and make secure decisions. Two approaches to risk communication originating from psychology, the human information-processing approach and the mental-models approach, have been widely applied in other research fields of risk communication. The human information-processing approach characterizes the human as a communication system, with risk-communication information from a source delivered to the receiver, who processes the information via various stages. The mental-models approach emphasizes the importance of understanding experts' and non-experts' mental models, comparing these models, and drafting and evaluating risk-communication messages. With an overview of these two approaches and their applications, the goal of this paper is to provide insights for future use of these approaches in cybersecurity.