Security Training Is Not Enough When Urgency and Convenience Take Over

Cybersecurity has long been based on the assumption that a lack of information is the main problem. Once users understand what is dangerous, they will behave more securely. In practice, however, the relationship between knowledge and behaviour is far more complex.

Public Wi-Fi as a conflict between knowledge and circumstance

Public Wi-Fi provides an ideal setting in which to examine this issue. The risks are well known: open networks, rogue access points, eavesdropping, manipulation of communications and connections through untrusted infrastructure.

Nevertheless, people continue to use public Wi-Fi even when they are aware of the risks. The reason is not necessarily irresponsibility. It is often a matter of decision-making in a particular situation.

Users do not necessarily ignore the risk. They may simply prioritise an immediate goal over an abstract and uncertain threat.

When the need is immediate and the risk is abstract

Consider a common scenario: someone urgently needs to send an important file, their mobile connection is unavailable or limited, and an open network is available nearby.

The security risk is abstract and probabilistic. The need to complete the task is immediate. In such a situation, the user is not necessarily acting “irrationally”. They may simply be seeking a solution that is good enough under the circumstances.

Bounded rationality in cybersecurity

This way of thinking is captured well by the concept of bounded rationality. People do not make decisions like ideal security analysts equipped with complete information, unlimited time and no external pressure.

They make decisions in environments where a task must be completed, attention is limited and a protective measure often requires an additional step.

Why training alone is not enough

Security training can improve knowledge and sensitivity to risk. It may still fail to change behaviour when security competes with an urgent practical objective.

This does not mean that training has no value. It means that its effect is limited unless it is supported by better system design.

What this means for organisations

The secure option should require as little effort as possible. Organisations should therefore not rely solely on users remembering general advice at exactly the right moment.

• VPN protection should be automatic wherever possible rather than dependent on the user remembering to activate it.
• The system should recognise risky contexts and adapt the level of protection accordingly.
• Secure default settings should reduce the need for manual decision-making.
• Recommendations should be specific and actionable rather than limited to general instructions such as “be careful”.

From user responsibility to system responsibility

Public Wi-Fi illustrates a broader truth about cybersecurity. Human behaviour cannot be changed simply by telling people what the correct action is.

Digital environments must be designed so that secure behaviour is realistic, accessible and less dependent on an individual’s discipline at a particular moment.