Social Proof

Why people can knowingly behave wrongly…

A man sits at a table together with three others and a “gamemaster” supervising the study. His task is simple. Name the colour of the card being held up by the supervisor, when asked.
He is content in the knowledge that he is being paid to participate and the task being stupidly simple.

The first few rounds are going fluently, when suddenly one of the other participants are saying “yellow” when the card is clearly red. The next participant says the same and our fellow is being confused, can’t they see that the card is red?

As the study goes one more and more cards a shown and often the other participants are saying colors that don’t match the card. Our friend stays true to his believes the first few rounds but then finds himself looking to the others to know which color to say. At the end he simply says the same as the rest no matter
the actual color of the cards….

What he didn’t know is that the other “participants” are actually paid actors to saying the wrong color in order to see what would happen and he obligingly fits right into what the study aims to prove: We humans look to each other to find the way to act.

It has been proven time and time again that we may act or say something against our beliefs in order to fit into a group. Scientists call this the “herding bias” or social proof.

If it still doesn’t resonate then try looking at your regular teenager trying to fit in. The force of the herding bias is strong with that one.
We simply do as we believe one does and adjust our looks and actions accordingly – just look at the teenagers trying to fit in.

Biases are the the brains “pre-programmings” or shortcuts made for making lifes decisions easier and the Social Proof bias is one of the most important ones to know when working with information security
Psychologist Robert Cialdini writes, “Whether the question is what to do with an empty popcorn box in a movie theater, how fast to drive on a certain stretch of highway, or how to eat the chicken at a dinner party, the actions of those around us will be important in defining the answer.”

A second reason others influence us is that humans are social. We have survived because of our ability to band together.
Early humans who formed groups were more likely to survive. This affected our psychology. As Julia Coultas, a researcher at the University of Essex, puts it, “For an individual joining a group, copying the behavior of the majority would then be a sensible, adaptive behavior. A conformist tendency would facilitate acceptance into the group and would probably lead to survival if it involved the decision, for instance, to choose between a nutritious or poisonous food, based on copying
the behavior of the majority.”

Social proof and information security
Can you imagine how this may affect us when it comes to cyber security? How a culture of not caring about the code of conduct for information security may affect newly hired? Or how the level of risk acceptance may influence the way people behave?
Knowledge of the Social proof bias can be really helpful for you when looking into spreading good information security behaviors. A common behavior of reporting anything suspicious can spread across an organization as the act of locking in the equipment before leaving the office may cause others to do so.

A simple way of utilizing the social proof bias is when communicating.
If we believe that most of us are having a specific behavior, we are much more likely to adapt to it. This could be when sending out materials: “90 % of your fellow colleagues have already completed the quiz” or “Don’t stand out, wear you access card visible like your colleagues and avoid being questioned at the door”.

An example of a nudge utilizing the social Proof bias I have implemented, is a little pop-up box popping up, when the employees try to upload data to an external fileshare. The Box simply said “Oh, it seems like you are trying to upload a file to an external filesharing service? In our company we share files using Teams”.

The pop-up box didn’t prevent the upload, but reports showed that this tiny little box at the right time made 80 % of the employees stop their action (Had it prevented the action it would be a hardcore control and not a nudge))

Negative proof
Be careful to use the social proof bias correctly as using it wrongly can really make things worse. A sentence like “6 out of ten people do not report it if the accidentally clicked a malicious link”, will make people subconsciously thinking “why should I bother report it, when the majority in our organization doesn’t?”

Examples on how you can use social proof in your work:

• Use social proof in your communication “in this company we report phishing by clicking the report mail button”
• When following up on tasks: “Great to see so many of you filling in the questionnaire. Now we just need the few of you left”

• Signs like “70 percent of employees check to see if the person behind them wears an access card, do you?”
• Use pictures of commonly known employees having the attractive behavior and exploit both social proof bias as well as the mirror neurons.