How feedback bias can turn simple nudges into stronger security habits

Have you ever noticed the colored bar when creating a new password?
It shows how well your password complies with the rules. The bar’s color shifts from bright red to green as you type, signaling your progress.
That small change can spark a sense of satisfaction, making the task of finding a cryptic, complex, yet memorable password feel less overwhelming.

This password strength indicator is a perfect example of feedback bias influencing secure behavior.

Feedback bias refers to the way people tend to interpret and respond to information in a way that reinforces their preexisting beliefs or attitudes.
Whether it's receiving feedback on performance, processing media content, or engaging in conversations, feedback bias can shape how we perceive information.

In cybersecurity, understanding and working with feedback bias is crucial.
People naturally want to know how they are doing, and a well-crafted feedback mechanism can positively influence both their own and others’ behavior.

Take the example of the Danish blood donor organization:
After donating blood, a donor might receive an SMS saying, "The blood you donated on this date was just used to help a patient."
This type of message not only provides useful feedback but also encourages donors to continue giving.

Practical examples of using feedback bias

• If a user reports a suspicious email, send a follow-up message that says: "Great news! Your report from last week helped remove a malicious email from 10 of your colleagues’ inboxes, minimizing the threat to our company."

• When responding to users, offer meaningful responses instead of generic thank-you notes.

• If possible, implement a password strength indicator to guide users in creating strong passwords.

• If a user successfully identifies a phishing email, acknowledge it with a positive message like, "Well done! You caught our 'phish."
  If they click the link by mistake, send a message saying, "Oops! You accidentally clicked on our phishing email. Here’s an example of the warning signs you missed."

By using feedback bias effectively, we can not only strengthen cybersecurity behaviors but also create a more engaged and informed user base